Analysis
- max time kernel
61s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 22:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-01_b206a8ff07cd8bc454c1272e5434e3d7_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_b206a8ff07cd8bc454c1272e5434e3d7_elex_emotet_stop.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-07-01_b206a8ff07cd8bc454c1272e5434e3d7_elex_emotet_stop.exe
- Size 208KB
- Sample260701-13ba6agy4t
- SHA256 9da1dc9ac6a575c0dce5ba75b7c07530234605efd06ff6c8dc55f8e111dc9ab0
- MD5 b206a8ff07cd8bc454c1272e5434e3d7
- SHA1 a127fccf57c443501273077410c131843da6b4a7
- SHA512 42459eb10ccae7c3b9c9143f684afd3826fdcf5e46687b9965e8b8a82101de7a5ce29d1cb190907ec6c4e427bbd303110842bb5a8d49683a36196c95c7886df2
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfb4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LODQEj1
- TLSH T144247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 64 IoCs
pid Process 2924 RIPUYI.exe 1968 KLBOUBH.exe 848 MJHABJ.exe 2880 MWHPDWL.exe 1916 BRQBW.exe 6104 WPQ.exe 2352 RCVWI.exe 5612 KGZSNKT.exe 4152 DYODXLB.exe 4536 HOVLJ.exe 1348 YOX.exe 3328 CEEQZ.exe 2068 SUFP.exe 2200 FXVOTSY.exe 4888 ZTAX.exe 3232 DBGYIK.exe 5888 VJIDTHL.exe 5404 PWFM.exe 816 IZR.exe 3188 MHYQV.exe 5416 HNYB.exe 5568 WIHOIOH.exe 1076 AQOO.exe 124 KYQTY.exe 3860 OGWBK.exe 4256 RHZ.exe 3448 KTVVI.exe 3464 ZWF.exe 1252 IWHFXJ.exe 1984 DKM.exe 1692 ENQSM.exe 3704 SSVPBIH.exe 3724 ELYICP.exe 1440 JLG.exe 4908 EYLFV.exe 2872 MEPM.exe 2612 USQAH.exe 2916 JNZ.exe 2936 TNBJ.exe 4248 IQKWPAW.exe 3220 ALOSCQ.exe 1220 BOS.exe 4280 BUSK.exe 3644 LRY.exe 3556 PHEEDT.exe 5904 YIGJGRI.exe 5916 DNZYWUD.exe 2044 DTZ.exe 5840 EWDJL.exe 1096 YJIAVXW.exe 5920 TEMJ.exe 2648 ZXUXPR.exe 3992 EXU.exe 4416 ELUZ.exe 1872 ZYZJKY.exe 3416 MJHZ.exe 1160 PWMRI.exe 4480 JJRAKIE.exe 1200 XPZ.exe 3940 DPG.exe 5008 DAHTR.exe 4332 DFHHSF.exe 2732 FBM.exe 4148 JJTZH.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\MJHABJ.exe KLBOUBH.exe File opened for modification C:\windows\SysWOW64\OGWBK.exe KYQTY.exe File created C:\windows\SysWOW64\IQKWPAW.exe TNBJ.exe File created C:\windows\SysWOW64\TEMJ.exe.bat YJIAVXW.exe File created C:\windows\SysWOW64\KLBOUBH.exe RIPUYI.exe File opened for modification C:\windows\SysWOW64\BRQBW.exe MWHPDWL.exe File created C:\windows\SysWOW64\BRQBW.exe.bat MWHPDWL.exe File created C:\windows\SysWOW64\KGZSNKT.exe RCVWI.exe File created C:\windows\SysWOW64\OGWBK.exe KYQTY.exe File created C:\windows\SysWOW64\EYLFV.exe.bat JLG.exe File created C:\windows\SysWOW64\ELUZ.exe EXU.exe File opened for modification C:\windows\SysWOW64\ABXE.exe FOS.exe File created C:\windows\SysWOW64\RIPUYI.exe.bat 2026-07-01_b206a8ff07cd8bc454c1272e5434e3d7_elex_emotet_stop.exe File created C:\windows\SysWOW64\HOVLJ.exe.bat DYODXLB.exe File created C:\windows\SysWOW64\ENQSM.exe.bat DKM.exe File opened for modification C:\windows\SysWOW64\ELUZ.exe EXU.exe File opened for modification C:\windows\SysWOW64\FOS.exe DTNLIW.exe File created C:\windows\SysWOW64\VJIDTHL.exe.bat DBGYIK.exe File opened for modification C:\windows\SysWOW64\EYLFV.exe JLG.exe File created C:\windows\SysWOW64\MEPM.exe EYLFV.exe File created C:\windows\SysWOW64\EXU.exe ZXUXPR.exe File created C:\windows\SysWOW64\EXU.exe.bat ZXUXPR.exe File created C:\windows\SysWOW64\DAHTR.exe.bat DPG.exe File created C:\windows\SysWOW64\SSVPBIH.exe ENQSM.exe File created C:\windows\SysWOW64\BUSK.exe BOS.exe File opened for modification C:\windows\SysWOW64\TEMJ.exe YJIAVXW.exe File created C:\windows\SysWOW64\ZYZJKY.exe ELUZ.exe File created C:\windows\SysWOW64\MJHZ.exe ZYZJKY.exe File created C:\windows\SysWOW64\DPG.exe XPZ.exe File opened for modification C:\windows\SysWOW64\DPG.exe XPZ.exe File created C:\windows\SysWOW64\ABXE.exe FOS.exe File opened for modification C:\windows\SysWOW64\HOVLJ.exe DYODXLB.exe File created C:\windows\SysWOW64\MHYQV.exe IZR.exe File opened for modification C:\windows\SysWOW64\IQKWPAW.exe TNBJ.exe File created C:\windows\SysWOW64\TEMJ.exe YJIAVXW.exe File opened for modification C:\windows\SysWOW64\MJHZ.exe ZYZJKY.exe File created C:\windows\SysWOW64\KLBOUBH.exe.bat RIPUYI.exe File created C:\windows\SysWOW64\MJHABJ.exe KLBOUBH.exe File created C:\windows\SysWOW64\MHYQV.exe.bat IZR.exe File opened for modification C:\windows\SysWOW64\EXU.exe ZXUXPR.exe File created C:\windows\SysWOW64\DAHTR.exe DPG.exe File created C:\windows\SysWOW64\MJHABJ.exe.bat KLBOUBH.exe File created C:\windows\SysWOW64\BRQBW.exe MWHPDWL.exe File opened for modification C:\windows\SysWOW64\VJIDTHL.exe DBGYIK.exe File created C:\windows\SysWOW64\MJHZ.exe.bat ZYZJKY.exe File created C:\windows\SysWOW64\DBGYIK.exe ZTAX.exe File opened for modification C:\windows\SysWOW64\MHYQV.exe IZR.exe File opened for modification C:\windows\SysWOW64\SSVPBIH.exe ENQSM.exe File opened for modification C:\windows\SysWOW64\BUSK.exe BOS.exe File opened for modification C:\windows\SysWOW64\DAHTR.exe DPG.exe File created C:\windows\SysWOW64\MWHPDWL.exe.bat MJHABJ.exe File created C:\windows\SysWOW64\HOVLJ.exe DYODXLB.exe File created C:\windows\SysWOW64\ABXE.exe.bat FOS.exe File created C:\windows\SysWOW64\RIPUYI.exe 2026-07-01_b206a8ff07cd8bc454c1272e5434e3d7_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\KLBOUBH.exe RIPUYI.exe File created C:\windows\SysWOW64\KGZSNKT.exe.bat RCVWI.exe File created C:\windows\SysWOW64\OGWBK.exe.bat KYQTY.exe File created C:\windows\SysWOW64\JNZ.exe USQAH.exe File created C:\windows\SysWOW64\FOS.exe DTNLIW.exe File created C:\windows\SysWOW64\MWHPDWL.exe MJHABJ.exe File created C:\windows\SysWOW64\EWDJL.exe DTZ.exe File opened for modification C:\windows\SysWOW64\ZYZJKY.exe ELUZ.exe File created C:\windows\SysWOW64\FOS.exe.bat DTNLIW.exe File opened for modification C:\windows\SysWOW64\KGZSNKT.exe RCVWI.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\LRY.exe BUSK.exe File opened for modification C:\windows\YOX.exe HOVLJ.exe File created C:\windows\system\KYQTY.exe.bat AQOO.exe File created C:\windows\system\RCVWI.exe.bat WPQ.exe File created C:\windows\ZTAX.exe.bat FXVOTSY.exe File opened for modification C:\windows\JLG.exe ELYICP.exe File created C:\windows\system\PPA.exe EWXIRXX.exe File created C:\windows\system\CEEQZ.exe YOX.exe File created C:\windows\system\CEEQZ.exe.bat YOX.exe File opened for modification C:\windows\system\FXVOTSY.exe SUFP.exe File opened for modification C:\windows\ZTAX.exe FXVOTSY.exe File created C:\windows\PWFM.exe VJIDTHL.exe File opened for modification C:\windows\TNBJ.exe JNZ.exe File opened for modification C:\windows\DTZ.exe DNZYWUD.exe File opened for modification C:\windows\system\PPA.exe EWXIRXX.exe File opened for modification C:\windows\system\RCVWI.exe WPQ.exe File opened for modification C:\windows\ZWF.exe KTVVI.exe File created C:\windows\system\DFHHSF.exe DAHTR.exe File created C:\windows\TEBAIM.exe.bat ABXE.exe File created C:\windows\system\PCH.exe.bat TEBAIM.exe File created C:\windows\HNYB.exe.bat MHYQV.exe File opened for modification C:\windows\system\DFHHSF.exe DAHTR.exe File created C:\windows\system\DFHHSF.exe.bat DAHTR.exe File created C:\windows\TSTYF.exe NSMLOXQ.exe File created C:\windows\system\FXVOTSY.exe SUFP.exe File opened for modification C:\windows\system\BOS.exe ALOSCQ.exe File created C:\windows\system\ZXUXPR.exe TEMJ.exe File opened for modification C:\windows\KTVVI.exe RHZ.exe File created C:\windows\DNZYWUD.exe YIGJGRI.exe File created C:\windows\DNZYWUD.exe.bat YIGJGRI.exe File opened for modification C:\windows\XPZ.exe JJRAKIE.exe File created C:\windows\system\DYODXLB.exe KGZSNKT.exe File created C:\windows\YOX.exe.bat HOVLJ.exe File opened for modification C:\windows\system\USQAH.exe MEPM.exe File created C:\windows\XPZ.exe.bat JJRAKIE.exe File created C:\windows\system\JJTZH.exe FBM.exe File created C:\windows\NSMLOXQ.exe.bat KCXLK.exe File created C:\windows\KTVVI.exe RHZ.exe File created C:\windows\IWHFXJ.exe.bat ZWF.exe File created C:\windows\ZTAX.exe FXVOTSY.exe File created C:\windows\WIHOIOH.exe HNYB.exe File opened for modification C:\windows\system\KYQTY.exe AQOO.exe File created C:\windows\YJIAVXW.exe.bat EWDJL.exe File opened for modification C:\windows\system\FBM.exe DFHHSF.exe File opened for modification C:\windows\system\JJTZH.exe FBM.exe File created C:\windows\system\BOS.exe ALOSCQ.exe File opened for modification C:\windows\system\PCH.exe TEBAIM.exe File created C:\windows\WPQ.exe.bat BRQBW.exe File created C:\windows\system\RCVWI.exe WPQ.exe File created C:\windows\system\PPA.exe.bat EWXIRXX.exe File created C:\windows\KCXLK.exe PPA.exe File created C:\windows\DTZ.exe.bat DNZYWUD.exe File created C:\windows\XPZ.exe JJRAKIE.exe File created C:\windows\KCXLK.exe.bat PPA.exe File opened for modification C:\windows\system\VCOLZ.exe PCH.exe File opened for modification C:\windows\IZR.exe PWFM.exe File opened for modification C:\windows\system\PHEEDT.exe LRY.exe File created C:\windows\system\PHEEDT.exe.bat LRY.exe File created C:\windows\DTZ.exe DNZYWUD.exe File created C:\windows\ELYICP.exe.bat SSVPBIH.exe File created C:\windows\TNBJ.exe JNZ.exe File created C:\windows\system\FBM.exe.bat DFHHSF.exe File created C:\windows\DTNLIW.exe.bat TSTYF.exe File opened for modification C:\windows\SUFP.exe CEEQZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 3512 2692 WerFault.exe 87 2080 2924 WerFault.exe 92 2752 1968 WerFault.exe 98 404 848 WerFault.exe 103 1264 2880 WerFault.exe 108 3636 1916 WerFault.exe 113 2776 6104 WerFault.exe 118 5244 2352 WerFault.exe 123 1272 5612 WerFault.exe 128 748 4152 WerFault.exe 133 2228 4536 WerFault.exe 138 6100 1348 WerFault.exe 143 5352 3328 WerFault.exe 148 5564 2068 WerFault.exe 153 6092 2200 WerFault.exe 158 3180 4888 WerFault.exe 163 3004 3232 WerFault.exe 168 5084 5888 WerFault.exe 173 1876 5404 WerFault.exe 178 4836 816 WerFault.exe 183 5480 3188 WerFault.exe 188 1260 5416 WerFault.exe 193 1160 5568 WerFault.exe 198 4480 1076 WerFault.exe 205 2720 124 WerFault.exe 211 4608 3860 WerFault.exe 217 2860 4256 WerFault.exe 226 4012 3448 WerFault.exe 232 4480 3464 WerFault.exe 237 5940 1252 WerFault.exe 243 2648 1984 WerFault.exe 248 1164 1692 WerFault.exe 253 2988 3704 WerFault.exe 258 5840 3724 WerFault.exe 263 1064 1440 WerFault.exe 269 2320 4908 WerFault.exe 274 5624 2872 WerFault.exe 279 4336 2612 WerFault.exe 284 3900 2916 WerFault.exe 289 4632 2936 WerFault.exe 294 5628 4248 WerFault.exe 299 2548 3220 WerFault.exe 304 5804 1220 WerFault.exe 309 5328 4280 WerFault.exe 314 1784 3644 WerFault.exe 319 5992 3556 WerFault.exe 324 4220 5904 WerFault.exe 329 3228 5916 WerFault.exe 334 1272 2044 WerFault.exe 339 4092 5840 WerFault.exe 344 4284 1096 WerFault.exe 349 3728 5920 WerFault.exe 354 4292 2648 WerFault.exe 359 3700 3992 WerFault.exe 364 3744 4416 WerFault.exe 369 1780 1872 WerFault.exe 374 1180 3416 WerFault.exe 379 3076 1160 WerFault.exe 384 4752 4480 WerFault.exe 389 5624 1200 WerFault.exe 394 2964 3940 WerFault.exe 399 3228 5008 WerFault.exe 404 4548 4332 WerFault.exe 409 3516 2732 WerFault.exe 414 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJRAKIE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYQTY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZYZJKY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PWFM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALOSCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEEQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IWHFXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAHTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLBOUBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNBJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSMLOXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENQSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEBAIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHEEDT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFHHSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KCXLK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-01_b206a8ff07cd8bc454c1272e5434e3d7_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJTZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGZSNKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AQOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNZYWUD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{D9D5CB77-5686-4422-916A-8A8C22E8840A} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{406F675D-CD4D-4312-AF43-8BBCD39EA82C} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2692 2026-07-01_b206a8ff07cd8bc454c1272e5434e3d7_elex_emotet_stop.exe 2692 2026-07-01_b206a8ff07cd8bc454c1272e5434e3d7_elex_emotet_stop.exe 2924 RIPUYI.exe 2924 RIPUYI.exe 1968 KLBOUBH.exe 1968 KLBOUBH.exe 848 MJHABJ.exe 848 MJHABJ.exe 2880 MWHPDWL.exe 2880 MWHPDWL.exe 1916 BRQBW.exe 1916 BRQBW.exe 6104 WPQ.exe 6104 WPQ.exe 2352 RCVWI.exe 2352 RCVWI.exe 5612 KGZSNKT.exe 5612 KGZSNKT.exe 4152 DYODXLB.exe 4152 DYODXLB.exe 4536 HOVLJ.exe 4536 HOVLJ.exe 1348 YOX.exe 1348 YOX.exe 3328 CEEQZ.exe 3328 CEEQZ.exe 2068 SUFP.exe 2068 SUFP.exe 2200 FXVOTSY.exe 2200 FXVOTSY.exe 4888 ZTAX.exe 4888 ZTAX.exe 3232 DBGYIK.exe 3232 DBGYIK.exe 5888 VJIDTHL.exe 5888 VJIDTHL.exe 5404 PWFM.exe 5404 PWFM.exe 816 IZR.exe 816 IZR.exe 3188 MHYQV.exe 3188 MHYQV.exe 5416 HNYB.exe 5416 HNYB.exe 5568 WIHOIOH.exe 5568 WIHOIOH.exe 1076 AQOO.exe 1076 AQOO.exe 124 KYQTY.exe 124 KYQTY.exe 1032 explorer.exe 1032 explorer.exe 3860 OGWBK.exe 3860 OGWBK.exe 4256 RHZ.exe 4256 RHZ.exe 3448 KTVVI.exe 3448 KTVVI.exe 3464 ZWF.exe 3464 ZWF.exe 1252 IWHFXJ.exe 1252 IWHFXJ.exe 1984 DKM.exe 1984 DKM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1032 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe Token: SeShutdownPrivilege 1032 explorer.exe Token: SeCreatePagefilePrivilege 1032 explorer.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 1728 sihost.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe 1032 explorer.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2692 2026-07-01_b206a8ff07cd8bc454c1272e5434e3d7_elex_emotet_stop.exe 2692 2026-07-01_b206a8ff07cd8bc454c1272e5434e3d7_elex_emotet_stop.exe 2924 RIPUYI.exe 2924 RIPUYI.exe 1968 KLBOUBH.exe 1968 KLBOUBH.exe 848 MJHABJ.exe 848 MJHABJ.exe 2880 MWHPDWL.exe 2880 MWHPDWL.exe 1916 BRQBW.exe 1916 BRQBW.exe 6104 WPQ.exe 6104 WPQ.exe 2352 RCVWI.exe 2352 RCVWI.exe 5612 KGZSNKT.exe 5612 KGZSNKT.exe 4152 DYODXLB.exe 4152 DYODXLB.exe 4536 HOVLJ.exe 4536 HOVLJ.exe 1348 YOX.exe 1348 YOX.exe 3328 CEEQZ.exe 3328 CEEQZ.exe 2068 SUFP.exe 2068 SUFP.exe 2200 FXVOTSY.exe 2200 FXVOTSY.exe 4888 ZTAX.exe 4888 ZTAX.exe 3232 DBGYIK.exe 3232 DBGYIK.exe 5888 VJIDTHL.exe 5888 VJIDTHL.exe 5404 PWFM.exe 5404 PWFM.exe 816 IZR.exe 816 IZR.exe 3188 MHYQV.exe 3188 MHYQV.exe 5416 HNYB.exe 5416 HNYB.exe 5568 WIHOIOH.exe 5568 WIHOIOH.exe 1076 AQOO.exe 1076 AQOO.exe 124 KYQTY.exe 124 KYQTY.exe 3860 OGWBK.exe 3860 OGWBK.exe 4272 StartMenuExperienceHost.exe 2740 SearchHost.exe 1032 explorer.exe 4256 RHZ.exe 4256 RHZ.exe 3448 KTVVI.exe 3448 KTVVI.exe 3464 ZWF.exe 3464 ZWF.exe 1252 IWHFXJ.exe 1252 IWHFXJ.exe 1984 DKM.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2280 2692 2026-07-01_b206a8ff07cd8bc454c1272e5434e3d7_elex_emotet_stop.exe 88 PID 2280 wrote to memory of 2924 2280 cmd.exe 92 PID 2924 wrote to memory of 3712 2924 RIPUYI.exe 94 PID 3712 wrote to memory of 1968 3712 cmd.exe 98 PID 1968 wrote to memory of 3436 1968 KLBOUBH.exe 99 PID 3436 wrote to memory of 848 3436 cmd.exe 103 PID 848 wrote to memory of 2796 848 MJHABJ.exe 104 PID 2796 wrote to memory of 2880 2796 cmd.exe 108 PID 2880 wrote to memory of 2232 2880 MWHPDWL.exe 109 PID 2232 wrote to memory of 1916 2232 cmd.exe 113 PID 1916 wrote to memory of 2436 1916 BRQBW.exe 114 PID 2436 wrote to memory of 6104 2436 cmd.exe 118 PID 6104 wrote to memory of 5600 6104 WPQ.exe 119 PID 5600 wrote to memory of 2352 5600 cmd.exe 123 PID 2352 wrote to memory of 2316 2352 RCVWI.exe 124 PID 2316 wrote to memory of 5612 2316 cmd.exe 128 PID 5612 wrote to memory of 1292 5612 KGZSNKT.exe 129 PID 1292 wrote to memory of 4152 1292 cmd.exe 133 PID 4152 wrote to memory of 4108 4152 DYODXLB.exe 134 PID 4108 wrote to memory of 4536 4108 cmd.exe 138 PID 4536 wrote to memory of 692 4536 HOVLJ.exe 139 PID 692 wrote to memory of 1348 692 cmd.exe 143 PID 1348 wrote to memory of 4564 1348 YOX.exe 144 PID 4564 wrote to memory of 3328 4564 cmd.exe 148 PID 3328 wrote to memory of 2456 3328 CEEQZ.exe 149 PID 2456 wrote to memory of 2068 2456 cmd.exe 153 PID 2068 wrote to memory of 2360 2068 SUFP.exe 154 PID 2360 wrote to memory of 2200 2360 cmd.exe 158 PID 2200 wrote to memory of 5572 2200 FXVOTSY.exe 159 PID 5572 wrote to memory of 4888 5572 cmd.exe 163 PID 4888 wrote to memory of 4940 4888 ZTAX.exe 164 PID 4940 wrote to memory of 3232 4940 cmd.exe 168 PID 3232 wrote to memory of 2180 3232 DBGYIK.exe 169 PID 2180 wrote to memory of 5888 2180 cmd.exe 173 PID 5888 wrote to memory of 5500 5888 VJIDTHL.exe 174 PID 5500 wrote to memory of 5404 5500 cmd.exe 178 PID 5404 wrote to memory of 5260 5404 PWFM.exe 179 PID 5260 wrote to memory of 816 5260 cmd.exe 183 PID 816 wrote to memory of 2400 816 IZR.exe 184 PID 2400 wrote to memory of 3188 2400 cmd.exe 188 PID 3188 wrote to memory of 2728 3188 MHYQV.exe 189 PID 2728 wrote to memory of 5416 2728 cmd.exe 193 PID 5416 wrote to memory of 2152 5416 HNYB.exe 194 PID 2152 wrote to memory of 5568 2152 cmd.exe 198 PID 5568 wrote to memory of 5028 5568 WIHOIOH.exe 201 PID 5028 wrote to memory of 1076 5028 cmd.exe 205 PID 1076 wrote to memory of 5356 1076 AQOO.exe 207 PID 5356 wrote to memory of 124 5356 cmd.exe 211 PID 124 wrote to memory of 2892 124 KYQTY.exe 212 PID 1728 wrote to memory of 1032 1728 sihost.exe 215 PID 2892 wrote to memory of 3860 2892 cmd.exe 217 PID 3860 wrote to memory of 1944 3860 OGWBK.exe 221 PID 1944 wrote to memory of 4256 1944 cmd.exe 226 PID 4256 wrote to memory of 4008 4256 RHZ.exe 228 PID 4008 wrote to memory of 3448 4008 cmd.exe 232 PID 3448 wrote to memory of 4884 3448 KTVVI.exe 233 PID 4884 wrote to memory of 3464 4884 cmd.exe 237 PID 3464 wrote to memory of 3344 3464 ZWF.exe 239 PID 3344 wrote to memory of 1252 3344 cmd.exe 243 PID 1252 wrote to memory of 3292 1252 IWHFXJ.exe 244 PID 3292 wrote to memory of 1984 3292 cmd.exe 248 PID 1984 wrote to memory of 4680 1984 DKM.exe 249 PID 4680 wrote to memory of 1692 4680 cmd.exe 253 PID 1692 wrote to memory of 4116 1692 ENQSM.exe 254
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_b206a8ff07cd8bc454c1272e5434e3d7_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_b206a8ff07cd8bc454c1272e5434e3d7_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIPUYI.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\windows\SysWOW64\RIPUYI.exeC:\windows\system32\RIPUYI.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLBOUBH.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\windows\SysWOW64\KLBOUBH.exeC:\windows\system32\KLBOUBH.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJHABJ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\windows\SysWOW64\MJHABJ.exeC:\windows\system32\MJHABJ.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MWHPDWL.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\windows\SysWOW64\MWHPDWL.exeC:\windows\system32\MWHPDWL.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BRQBW.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\windows\SysWOW64\BRQBW.exeC:\windows\system32\BRQBW.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPQ.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\windows\WPQ.exeC:\windows\WPQ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RCVWI.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\windows\system\RCVWI.exeC:\windows\system\RCVWI.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGZSNKT.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\windows\SysWOW64\KGZSNKT.exeC:\windows\system32\KGZSNKT.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYODXLB.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\windows\system\DYODXLB.exeC:\windows\system\DYODXLB.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HOVLJ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\windows\SysWOW64\HOVLJ.exeC:\windows\system32\HOVLJ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOX.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:692 -
C:\windows\YOX.exeC:\windows\YOX.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CEEQZ.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\windows\system\CEEQZ.exeC:\windows\system\CEEQZ.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SUFP.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\windows\SUFP.exeC:\windows\SUFP.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FXVOTSY.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\windows\system\FXVOTSY.exeC:\windows\system\FXVOTSY.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTAX.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\windows\ZTAX.exeC:\windows\ZTAX.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBGYIK.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\windows\SysWOW64\DBGYIK.exeC:\windows\system32\DBGYIK.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VJIDTHL.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\windows\SysWOW64\VJIDTHL.exeC:\windows\system32\VJIDTHL.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWFM.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\windows\PWFM.exeC:\windows\PWFM.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZR.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\windows\IZR.exeC:\windows\IZR.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MHYQV.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\windows\SysWOW64\MHYQV.exeC:\windows\system32\MHYQV.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HNYB.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\windows\HNYB.exeC:\windows\HNYB.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WIHOIOH.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\windows\WIHOIOH.exeC:\windows\WIHOIOH.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQOO.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\windows\system\AQOO.exeC:\windows\system\AQOO.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYQTY.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\windows\system\KYQTY.exeC:\windows\system\KYQTY.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OGWBK.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\SysWOW64\OGWBK.exeC:\windows\system32\OGWBK.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHZ.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\windows\RHZ.exeC:\windows\RHZ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KTVVI.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\windows\KTVVI.exeC:\windows\KTVVI.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZWF.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\windows\ZWF.exeC:\windows\ZWF.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IWHFXJ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\windows\IWHFXJ.exeC:\windows\IWHFXJ.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKM.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\windows\system\DKM.exeC:\windows\system\DKM.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ENQSM.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\windows\SysWOW64\ENQSM.exeC:\windows\system32\ENQSM.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSVPBIH.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
PID:4116 -
C:\windows\SysWOW64\SSVPBIH.exeC:\windows\system32\SSVPBIH.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ELYICP.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:3172 -
C:\windows\ELYICP.exeC:\windows\ELYICP.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLG.exe.bat" "68⤵PID:5460
-
C:\windows\JLG.exeC:\windows\JLG.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYLFV.exe.bat" "70⤵PID:1104
-
C:\windows\SysWOW64\EYLFV.exeC:\windows\system32\EYLFV.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MEPM.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3348 -
C:\windows\SysWOW64\MEPM.exeC:\windows\system32\MEPM.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USQAH.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:5336 -
C:\windows\system\USQAH.exeC:\windows\system\USQAH.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JNZ.exe.bat" "76⤵PID:3716
-
C:\windows\SysWOW64\JNZ.exeC:\windows\system32\JNZ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TNBJ.exe.bat" "78⤵PID:2040
-
C:\windows\TNBJ.exeC:\windows\TNBJ.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IQKWPAW.exe.bat" "80⤵PID:2932
-
C:\windows\SysWOW64\IQKWPAW.exeC:\windows\system32\IQKWPAW.exe81⤵
- Executes dropped EXE
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ALOSCQ.exe.bat" "82⤵PID:5448
-
C:\windows\SysWOW64\ALOSCQ.exeC:\windows\system32\ALOSCQ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BOS.exe.bat" "84⤵PID:5252
-
C:\windows\system\BOS.exeC:\windows\system\BOS.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BUSK.exe.bat" "86⤵PID:4988
-
C:\windows\SysWOW64\BUSK.exeC:\windows\system32\BUSK.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LRY.exe.bat" "88⤵PID:4132
-
C:\windows\system\LRY.exeC:\windows\system\LRY.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHEEDT.exe.bat" "90⤵PID:1548
-
C:\windows\system\PHEEDT.exeC:\windows\system\PHEEDT.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YIGJGRI.exe.bat" "92⤵PID:3732
-
C:\windows\system\YIGJGRI.exeC:\windows\system\YIGJGRI.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNZYWUD.exe.bat" "94⤵PID:3180
-
C:\windows\DNZYWUD.exeC:\windows\DNZYWUD.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DTZ.exe.bat" "96⤵PID:4540
-
C:\windows\DTZ.exeC:\windows\DTZ.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EWDJL.exe.bat" "98⤵PID:872
-
C:\windows\SysWOW64\EWDJL.exeC:\windows\system32\EWDJL.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YJIAVXW.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:2720 -
C:\windows\YJIAVXW.exeC:\windows\YJIAVXW.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TEMJ.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:4948 -
C:\windows\SysWOW64\TEMJ.exeC:\windows\system32\TEMJ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZXUXPR.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:5820 -
C:\windows\system\ZXUXPR.exeC:\windows\system\ZXUXPR.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXU.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:4616 -
C:\windows\SysWOW64\EXU.exeC:\windows\system32\EXU.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ELUZ.exe.bat" "108⤵PID:4808
-
C:\windows\SysWOW64\ELUZ.exeC:\windows\system32\ELUZ.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZYZJKY.exe.bat" "110⤵PID:4628
-
C:\windows\SysWOW64\ZYZJKY.exeC:\windows\system32\ZYZJKY.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJHZ.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:2168 -
C:\windows\SysWOW64\MJHZ.exeC:\windows\system32\MJHZ.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWMRI.exe.bat" "114⤵PID:5760
-
C:\windows\PWMRI.exeC:\windows\PWMRI.exe115⤵
- Executes dropped EXE
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JJRAKIE.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:5296 -
C:\windows\JJRAKIE.exeC:\windows\JJRAKIE.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XPZ.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4104 -
C:\windows\XPZ.exeC:\windows\XPZ.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DPG.exe.bat" "120⤵PID:6008
-
C:\windows\SysWOW64\DPG.exeC:\windows\system32\DPG.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-