Analysis
- max time kernel
35s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 17:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_b3142170021eb723b636c0dad043ad64_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_b3142170021eb723b636c0dad043ad64_elex_emotet_stop.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-07-08_b3142170021eb723b636c0dad043ad64_elex_emotet_stop.exe
- Size 289KB
- Sample260708-vmc7xsc12m
- SHA256 af0587b11e8b43218accf83f072280505b93bcd4ed89b92ac411f2de283db356
- MD5 b3142170021eb723b636c0dad043ad64
- SHA1 faaad4028eb6435d9a4faaff33c20a21e2766653
- SHA512 d22d81e6ab588c80da24b7472c222d0032dcd01af699a7f045e867ef7d3c83d478bfca4433088fc621cfd1543e7812e4620505e915af029cdff25add1435d48c
- SSDEEP 6144:RlZtbLWIgd1LZ9oECZbxlUS+LOvkECzJLaQVbU5:fLWI09QZb6LOvklJLJbU5
- TLSH T184549E2236C2C133D5A3027149E6C7A9777ABCB1573686CB7BC4374D2A72AE58B35381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 37 IoCs
pid Process 5564 YRZTZ.exe 2580 AZUIH.exe 2264 USK.exe 948 ANNU.exe 2512 KLBOUBH.exe 2904 MJHABJ.exe 4500 QMFV.exe 2984 OKY.exe 1268 GKAD.exe 5500 DKC.exe 4652 DHLURV.exe 4740 UDMWXG.exe 2060 NVW.exe 248 VJIDTHL.exe 2756 GBQODIT.exe 5340 OHDCNHO.exe 2972 PKGYTX.exe 1188 HNK.exe 5048 PTXIJLV.exe 1424 HBRN.exe 3112 JZE.exe 4348 JUIDH.exe 3564 PUQRYRI.exe 712 KPVB.exe 4956 EDZKLR.exe 4868 ILG.exe 1668 STIXBG.exe 3848 DBPX.exe 5808 NJRKQ.exe 4100 WKTPCU.exe 3316 ZXX.exe 2648 DNEZQM.exe 4648 OFMKIN.exe 1384 NQWAI.exe 1232 NTADWQT.exe 4188 GWEZB.exe 5248 VRN.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in System32 directory 33 IoCs
description ioc Process File created C:\windows\SysWOW64\WURHA.exe.bat VRN.exe File opened for modification C:\windows\SysWOW64\NVW.exe UDMWXG.exe File created C:\windows\SysWOW64\NVW.exe.bat UDMWXG.exe File created C:\windows\SysWOW64\KPVB.exe PUQRYRI.exe File opened for modification C:\windows\SysWOW64\ZXX.exe WKTPCU.exe File opened for modification C:\windows\SysWOW64\PTXIJLV.exe HNK.exe File created C:\windows\SysWOW64\NTADWQT.exe NQWAI.exe File created C:\windows\SysWOW64\VRN.exe GWEZB.exe File opened for modification C:\windows\SysWOW64\WURHA.exe VRN.exe File opened for modification C:\windows\SysWOW64\KLBOUBH.exe ANNU.exe File opened for modification C:\windows\SysWOW64\VJIDTHL.exe NVW.exe File created C:\windows\SysWOW64\NVW.exe UDMWXG.exe File created C:\windows\SysWOW64\DBPX.exe STIXBG.exe File opened for modification C:\windows\SysWOW64\DBPX.exe STIXBG.exe File created C:\windows\SysWOW64\DBPX.exe.bat STIXBG.exe File opened for modification C:\windows\SysWOW64\KPVB.exe PUQRYRI.exe File created C:\windows\SysWOW64\KPVB.exe.bat PUQRYRI.exe File created C:\windows\SysWOW64\NTADWQT.exe.bat NQWAI.exe File created C:\windows\SysWOW64\KLBOUBH.exe ANNU.exe File created C:\windows\SysWOW64\KLBOUBH.exe.bat ANNU.exe File created C:\windows\SysWOW64\MJHABJ.exe KLBOUBH.exe File created C:\windows\SysWOW64\VJIDTHL.exe.bat NVW.exe File created C:\windows\SysWOW64\PTXIJLV.exe HNK.exe File created C:\windows\SysWOW64\ZXX.exe WKTPCU.exe File created C:\windows\SysWOW64\VRN.exe.bat GWEZB.exe File created C:\windows\SysWOW64\WURHA.exe VRN.exe File created C:\windows\SysWOW64\MJHABJ.exe.bat KLBOUBH.exe File created C:\windows\SysWOW64\ZXX.exe.bat WKTPCU.exe File opened for modification C:\windows\SysWOW64\MJHABJ.exe KLBOUBH.exe File created C:\windows\SysWOW64\VJIDTHL.exe NVW.exe File created C:\windows\SysWOW64\PTXIJLV.exe.bat HNK.exe File opened for modification C:\windows\SysWOW64\NTADWQT.exe NQWAI.exe File opened for modification C:\windows\SysWOW64\VRN.exe GWEZB.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\GKAD.exe OKY.exe File opened for modification C:\windows\DHLURV.exe DNSCST.exe File created C:\windows\OHDCNHO.exe GBQODIT.exe File created C:\windows\system\EDZKLR.exe KPVB.exe File created C:\windows\system\NQWAI.exe OFMKIN.exe File created C:\windows\system\HBRN.exe PTXIJLV.exe File opened for modification C:\windows\system\GKAD.exe OKY.exe File created C:\windows\OHDCNHO.exe.bat GBQODIT.exe File created C:\windows\PKGYTX.exe OHDCNHO.exe File created C:\windows\system\DNEZQM.exe.bat ZXX.exe File created C:\windows\system\YRZTZ.exe.bat 2026-07-08_b3142170021eb723b636c0dad043ad64_elex_emotet_stop.exe File opened for modification C:\windows\system\USK.exe AZUIH.exe File created C:\windows\DHLURV.exe.bat DNSCST.exe File created C:\windows\system\JUIDH.exe JZE.exe File created C:\windows\system\EDZKLR.exe.bat KPVB.exe File opened for modification C:\windows\system\DNEZQM.exe ZXX.exe File created C:\windows\AZUIH.exe YRZTZ.exe File created C:\windows\system\HBRN.exe.bat PTXIJLV.exe File created C:\windows\system\OFMKIN.exe DNEZQM.exe File opened for modification C:\windows\AZUIH.exe YRZTZ.exe File created C:\windows\ANNU.exe USK.exe File created C:\windows\ANNU.exe.bat USK.exe File opened for modification C:\windows\system\OKY.exe QMFV.exe File created C:\windows\system\GKAD.exe.bat OKY.exe File created C:\windows\UDMWXG.exe DHLURV.exe File opened for modification C:\windows\GBQODIT.exe VJIDTHL.exe File created C:\windows\system\WKTPCU.exe NJRKQ.exe File created C:\windows\PUQRYRI.exe.bat JUIDH.exe File created C:\windows\AZUIH.exe.bat YRZTZ.exe File created C:\windows\system\QMFV.exe MJHABJ.exe File created C:\windows\system\OKY.exe QMFV.exe File opened for modification C:\windows\DKC.exe GKAD.exe File created C:\windows\DKC.exe.bat GKAD.exe File created C:\windows\DHLURV.exe DNSCST.exe File created C:\windows\STIXBG.exe ILG.exe File opened for modification C:\windows\system\YRZTZ.exe 2026-07-08_b3142170021eb723b636c0dad043ad64_elex_emotet_stop.exe File opened for modification C:\windows\ANNU.exe USK.exe File created C:\windows\UDMWXG.exe.bat DHLURV.exe File created C:\windows\system\WKTPCU.exe.bat NJRKQ.exe File opened for modification C:\windows\GWEZB.exe NTADWQT.exe File created C:\windows\system\HNK.exe.bat PKGYTX.exe File created C:\windows\STIXBG.exe.bat ILG.exe File opened for modification C:\windows\system\WKTPCU.exe NJRKQ.exe File created C:\windows\system\DNEZQM.exe ZXX.exe File opened for modification C:\windows\system\OFMKIN.exe DNEZQM.exe File created C:\windows\system\OFMKIN.exe.bat DNEZQM.exe File created C:\windows\system\USK.exe.bat AZUIH.exe File opened for modification C:\windows\system\QMFV.exe MJHABJ.exe File created C:\windows\system\QMFV.exe.bat MJHABJ.exe File created C:\windows\system\OKY.exe.bat QMFV.exe File created C:\windows\DKC.exe GKAD.exe File created C:\windows\GBQODIT.exe.bat VJIDTHL.exe File created C:\windows\PKGYTX.exe.bat OHDCNHO.exe File opened for modification C:\windows\system\HNK.exe PKGYTX.exe File created C:\windows\GBQODIT.exe VJIDTHL.exe File created C:\windows\system\JUIDH.exe.bat JZE.exe File created C:\windows\ILG.exe.bat EDZKLR.exe File opened for modification C:\windows\STIXBG.exe ILG.exe File opened for modification C:\windows\PKGYTX.exe OHDCNHO.exe File created C:\windows\system\HNK.exe PKGYTX.exe File opened for modification C:\windows\system\EDZKLR.exe KPVB.exe File created C:\windows\ILG.exe EDZKLR.exe File opened for modification C:\windows\system\NQWAI.exe OFMKIN.exe File created C:\windows\GWEZB.exe NTADWQT.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 2240 5072 WerFault.exe 87 556 5564 WerFault.exe 92 700 2580 WerFault.exe 98 5460 2264 WerFault.exe 103 5172 948 WerFault.exe 108 2004 2512 WerFault.exe 113 4792 2904 WerFault.exe 118 3664 4500 WerFault.exe 123 5028 2984 WerFault.exe 128 3508 1268 WerFault.exe 135 2188 5500 WerFault.exe 141 4616 3956 WerFault.exe 151 3192 4652 WerFault.exe 157 5660 4740 WerFault.exe 162 2416 2060 WerFault.exe 167 4100 248 WerFault.exe 173 4336 2756 WerFault.exe 178 1944 5340 WerFault.exe 183 3024 2972 WerFault.exe 188 4792 1188 WerFault.exe 193 3664 5048 WerFault.exe 198 4332 1424 WerFault.exe 203 3304 3112 WerFault.exe 208 4364 4348 WerFault.exe 213 4928 3564 WerFault.exe 218 2520 712 WerFault.exe 223 2792 4956 WerFault.exe 228 5984 4868 WerFault.exe 233 4984 1668 WerFault.exe 238 4872 3848 WerFault.exe 243 1276 5808 WerFault.exe 248 4336 4100 WerFault.exe 253 520 3316 WerFault.exe 259 1200 2648 WerFault.exe 264 6024 4648 WerFault.exe 269 5184 1384 WerFault.exe 274 5856 1232 WerFault.exe 279 5576 4188 WerFault.exe 284 4844 5248 WerFault.exe 289 4756 1276 WerFault.exe 294 6016 2600 WerFault.exe 299 3024 4400 WerFault.exe 304 4408 4344 WerFault.exe 309 5460 4376 WerFault.exe 314 5856 5172 WerFault.exe 319 5788 1996 WerFault.exe 324 4168 4160 WerFault.exe 329 6128 1548 WerFault.exe 334 1388 1880 WerFault.exe 339 3132 788 WerFault.exe 344 4408 1052 WerFault.exe 349 416 5596 WerFault.exe 354 6052 5112 WerFault.exe 359 5724 5576 WerFault.exe 364 4592 4116 WerFault.exe 369 2804 4692 WerFault.exe 374 6068 2004 WerFault.exe 379 2956 6004 WerFault.exe 384 1072 2748 WerFault.exe 389 752 1936 WerFault.exe 394 4312 3688 WerFault.exe 398 4172 4804 WerFault.exe 404 4432 3520 WerFault.exe 409 6100 5148 WerFault.exe 414 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUQRYRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_b3142170021eb723b636c0dad043ad64_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANNU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YRZTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DHLURV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJRKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBRN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJHABJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WKTPCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUIDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTADWQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLBOUBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QMFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STIXBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHDCNHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNEZQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWEZB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZUIH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KPVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NQWAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNSCST.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VJIDTHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OFMKIN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDMWXG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBQODIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PKGYTX.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 38 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{57C63A6D-8A12-4A2E-ACB1-53CB0AADED27} explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{6D3E98A2-77D3-42DC-88C4-FEBF2EDFC1BA} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5072 2026-07-08_b3142170021eb723b636c0dad043ad64_elex_emotet_stop.exe 5072 2026-07-08_b3142170021eb723b636c0dad043ad64_elex_emotet_stop.exe 5564 YRZTZ.exe 5564 YRZTZ.exe 2580 AZUIH.exe 2580 AZUIH.exe 2264 USK.exe 2264 USK.exe 948 ANNU.exe 948 ANNU.exe 2512 KLBOUBH.exe 2512 KLBOUBH.exe 2904 MJHABJ.exe 2904 MJHABJ.exe 4500 QMFV.exe 4500 QMFV.exe 2984 OKY.exe 2984 OKY.exe 1268 GKAD.exe 1268 GKAD.exe 3196 explorer.exe 3196 explorer.exe 3956 DNSCST.exe 3956 DNSCST.exe 4652 DHLURV.exe 4652 DHLURV.exe 4740 UDMWXG.exe 4740 UDMWXG.exe 2060 NVW.exe 2060 NVW.exe 248 VJIDTHL.exe 248 VJIDTHL.exe 2756 GBQODIT.exe 2756 GBQODIT.exe 5340 OHDCNHO.exe 5340 OHDCNHO.exe 2972 PKGYTX.exe 2972 PKGYTX.exe 1188 HNK.exe 1188 HNK.exe 5048 PTXIJLV.exe 5048 PTXIJLV.exe 1424 HBRN.exe 1424 HBRN.exe 3112 JZE.exe 3112 JZE.exe 4348 JUIDH.exe 4348 JUIDH.exe 3564 PUQRYRI.exe 3564 PUQRYRI.exe 712 KPVB.exe 712 KPVB.exe 4956 EDZKLR.exe 4956 EDZKLR.exe 4868 ILG.exe 4868 ILG.exe 1668 STIXBG.exe 1668 STIXBG.exe 3848 DBPX.exe 3848 DBPX.exe 5808 NJRKQ.exe 5808 NJRKQ.exe 4100 WKTPCU.exe 4100 WKTPCU.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3196 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe - Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 960 sihost.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe - Suspicious use of SendNotifyMessage 38 IoCs
pid Process 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5072 2026-07-08_b3142170021eb723b636c0dad043ad64_elex_emotet_stop.exe 5072 2026-07-08_b3142170021eb723b636c0dad043ad64_elex_emotet_stop.exe 5564 YRZTZ.exe 5564 YRZTZ.exe 2580 AZUIH.exe 2580 AZUIH.exe 2264 USK.exe 2264 USK.exe 948 ANNU.exe 948 ANNU.exe 2512 KLBOUBH.exe 2512 KLBOUBH.exe 2904 MJHABJ.exe 2904 MJHABJ.exe 4500 QMFV.exe 4500 QMFV.exe 2984 OKY.exe 2984 OKY.exe 1268 GKAD.exe 1268 GKAD.exe 4752 SearchHost.exe 3728 StartMenuExperienceHost.exe 3956 DNSCST.exe 3956 DNSCST.exe 3196 explorer.exe 4652 DHLURV.exe 4652 DHLURV.exe 4740 UDMWXG.exe 4740 UDMWXG.exe 2060 NVW.exe 2060 NVW.exe 248 VJIDTHL.exe 248 VJIDTHL.exe 2756 GBQODIT.exe 2756 GBQODIT.exe 5340 OHDCNHO.exe 5340 OHDCNHO.exe 2972 PKGYTX.exe 2972 PKGYTX.exe 1188 HNK.exe 1188 HNK.exe 5048 PTXIJLV.exe 5048 PTXIJLV.exe 1424 HBRN.exe 1424 HBRN.exe 3112 JZE.exe 3112 JZE.exe 4348 JUIDH.exe 4348 JUIDH.exe 3564 PUQRYRI.exe 3564 PUQRYRI.exe 712 KPVB.exe 712 KPVB.exe 4956 EDZKLR.exe 4956 EDZKLR.exe 4868 ILG.exe 4868 ILG.exe 1668 STIXBG.exe 1668 STIXBG.exe 3848 DBPX.exe 3848 DBPX.exe 5808 NJRKQ.exe 5808 NJRKQ.exe 4100 WKTPCU.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5072 wrote to memory of 1860 5072 2026-07-08_b3142170021eb723b636c0dad043ad64_elex_emotet_stop.exe 88 PID 1860 wrote to memory of 5564 1860 cmd.exe 92 PID 5564 wrote to memory of 3504 5564 YRZTZ.exe 94 PID 3504 wrote to memory of 2580 3504 cmd.exe 98 PID 2580 wrote to memory of 4288 2580 AZUIH.exe 99 PID 4288 wrote to memory of 2264 4288 cmd.exe 103 PID 2264 wrote to memory of 4076 2264 USK.exe 104 PID 4076 wrote to memory of 948 4076 cmd.exe 108 PID 948 wrote to memory of 2044 948 ANNU.exe 109 PID 2044 wrote to memory of 2512 2044 cmd.exe 113 PID 2512 wrote to memory of 5232 2512 KLBOUBH.exe 114 PID 5232 wrote to memory of 2904 5232 cmd.exe 118 PID 2904 wrote to memory of 6104 2904 MJHABJ.exe 119 PID 6104 wrote to memory of 4500 6104 cmd.exe 123 PID 4500 wrote to memory of 2468 4500 QMFV.exe 124 PID 2468 wrote to memory of 2984 2468 cmd.exe 128 PID 2984 wrote to memory of 4092 2984 OKY.exe 131 PID 4092 wrote to memory of 1268 4092 cmd.exe 135 PID 1268 wrote to memory of 2688 1268 GKAD.exe 137 PID 2688 wrote to memory of 5500 2688 cmd.exe 141 PID 960 wrote to memory of 3196 960 sihost.exe 142 PID 780 wrote to memory of 3956 780 cmd.exe 151 PID 3956 wrote to memory of 1732 3956 DNSCST.exe 152 PID 1732 wrote to memory of 4652 1732 cmd.exe 157 PID 4652 wrote to memory of 6124 4652 DHLURV.exe 158 PID 6124 wrote to memory of 4740 6124 cmd.exe 162 PID 4740 wrote to memory of 3620 4740 UDMWXG.exe 163 PID 3620 wrote to memory of 2060 3620 cmd.exe 167 PID 2060 wrote to memory of 1400 2060 NVW.exe 169 PID 1400 wrote to memory of 248 1400 cmd.exe 173 PID 248 wrote to memory of 5000 248 VJIDTHL.exe 174 PID 5000 wrote to memory of 2756 5000 cmd.exe 178 PID 2756 wrote to memory of 6092 2756 GBQODIT.exe 179 PID 6092 wrote to memory of 5340 6092 cmd.exe 183 PID 5340 wrote to memory of 1332 5340 OHDCNHO.exe 184 PID 1332 wrote to memory of 2972 1332 cmd.exe 188 PID 2972 wrote to memory of 5036 2972 PKGYTX.exe 189 PID 5036 wrote to memory of 1188 5036 cmd.exe 193 PID 1188 wrote to memory of 1192 1188 HNK.exe 194 PID 1192 wrote to memory of 5048 1192 cmd.exe 198 PID 5048 wrote to memory of 2720 5048 PTXIJLV.exe 199 PID 2720 wrote to memory of 1424 2720 cmd.exe 203 PID 1424 wrote to memory of 5744 1424 HBRN.exe 204 PID 5744 wrote to memory of 3112 5744 cmd.exe 208 PID 3112 wrote to memory of 5032 3112 JZE.exe 209 PID 5032 wrote to memory of 4348 5032 cmd.exe 213 PID 4348 wrote to memory of 5376 4348 JUIDH.exe 214 PID 5376 wrote to memory of 3564 5376 cmd.exe 218 PID 3564 wrote to memory of 5616 3564 PUQRYRI.exe 219 PID 5616 wrote to memory of 712 5616 cmd.exe 223 PID 712 wrote to memory of 5188 712 KPVB.exe 224 PID 5188 wrote to memory of 4956 5188 cmd.exe 228 PID 4956 wrote to memory of 5076 4956 EDZKLR.exe 229 PID 5076 wrote to memory of 4868 5076 cmd.exe 233 PID 4868 wrote to memory of 3340 4868 ILG.exe 234 PID 3340 wrote to memory of 1668 3340 cmd.exe 238 PID 1668 wrote to memory of 4532 1668 STIXBG.exe 239 PID 4532 wrote to memory of 3848 4532 cmd.exe 243 PID 3848 wrote to memory of 5796 3848 DBPX.exe 244 PID 5796 wrote to memory of 5808 5796 cmd.exe 248 PID 5808 wrote to memory of 5020 5808 NJRKQ.exe 249 PID 5020 wrote to memory of 4100 5020 cmd.exe 253 PID 4100 wrote to memory of 1428 4100 WKTPCU.exe 254 PID 1428 wrote to memory of 3316 1428 cmd.exe 259
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_b3142170021eb723b636c0dad043ad64_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_b3142170021eb723b636c0dad043ad64_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YRZTZ.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\windows\system\YRZTZ.exeC:\windows\system\YRZTZ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AZUIH.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\windows\AZUIH.exeC:\windows\AZUIH.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USK.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\windows\system\USK.exeC:\windows\system\USK.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ANNU.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\windows\ANNU.exeC:\windows\ANNU.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLBOUBH.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\windows\SysWOW64\KLBOUBH.exeC:\windows\system32\KLBOUBH.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJHABJ.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\windows\SysWOW64\MJHABJ.exeC:\windows\system32\MJHABJ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QMFV.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\windows\system\QMFV.exeC:\windows\system\QMFV.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKY.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\windows\system\OKY.exeC:\windows\system\OKY.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKAD.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\windows\system\GKAD.exeC:\windows\system\GKAD.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DKC.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\windows\DKC.exeC:\windows\DKC.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNSCST.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:780 -
C:\windows\DNSCST.exeC:\windows\DNSCST.exe23⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DHLURV.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\windows\DHLURV.exeC:\windows\DHLURV.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UDMWXG.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\windows\UDMWXG.exeC:\windows\UDMWXG.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVW.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\windows\SysWOW64\NVW.exeC:\windows\system32\NVW.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VJIDTHL.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\windows\SysWOW64\VJIDTHL.exeC:\windows\system32\VJIDTHL.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GBQODIT.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\windows\GBQODIT.exeC:\windows\GBQODIT.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHDCNHO.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\windows\OHDCNHO.exeC:\windows\OHDCNHO.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PKGYTX.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\windows\PKGYTX.exeC:\windows\PKGYTX.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HNK.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\windows\system\HNK.exeC:\windows\system\HNK.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PTXIJLV.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\windows\SysWOW64\PTXIJLV.exeC:\windows\system32\PTXIJLV.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBRN.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\windows\system\HBRN.exeC:\windows\system\HBRN.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZE.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\windows\JZE.exeC:\windows\JZE.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JUIDH.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\windows\system\JUIDH.exeC:\windows\system\JUIDH.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUQRYRI.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\windows\PUQRYRI.exeC:\windows\PUQRYRI.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KPVB.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\windows\SysWOW64\KPVB.exeC:\windows\system32\KPVB.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EDZKLR.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\windows\system\EDZKLR.exeC:\windows\system\EDZKLR.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ILG.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\windows\ILG.exeC:\windows\ILG.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\STIXBG.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\windows\STIXBG.exeC:\windows\STIXBG.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBPX.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\windows\SysWOW64\DBPX.exeC:\windows\system32\DBPX.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NJRKQ.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\windows\system\NJRKQ.exeC:\windows\system\NJRKQ.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WKTPCU.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\windows\system\WKTPCU.exeC:\windows\system\WKTPCU.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZXX.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\windows\SysWOW64\ZXX.exeC:\windows\system32\ZXX.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DNEZQM.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5068 -
C:\windows\system\DNEZQM.exeC:\windows\system\DNEZQM.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OFMKIN.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3716 -
C:\windows\system\OFMKIN.exeC:\windows\system\OFMKIN.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NQWAI.exe.bat" "70⤵PID:3568
-
C:\windows\system\NQWAI.exeC:\windows\system\NQWAI.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NTADWQT.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:5088 -
C:\windows\SysWOW64\NTADWQT.exeC:\windows\system32\NTADWQT.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWEZB.exe.bat" "74⤵PID:5044
-
C:\windows\GWEZB.exeC:\windows\GWEZB.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRN.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:5836 -
C:\windows\SysWOW64\VRN.exeC:\windows\system32\VRN.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WURHA.exe.bat" "78⤵PID:5028
-
C:\windows\SysWOW64\WURHA.exeC:\windows\system32\WURHA.exe79⤵PID:1276
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WARWBW.exe.bat" "80⤵PID:5440
-
C:\windows\SysWOW64\WARWBW.exeC:\windows\system32\WARWBW.exe81⤵PID:2600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UQDZ.exe.bat" "82⤵PID:6096
-
C:\windows\system\UQDZ.exeC:\windows\system\UQDZ.exe83⤵PID:4400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGE.exe.bat" "84⤵PID:5732
-
C:\windows\SysWOW64\KGE.exeC:\windows\system32\KGE.exe85⤵PID:4344
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OWSYH.exe.bat" "86⤵PID:3968
-
C:\windows\system\OWSYH.exeC:\windows\system\OWSYH.exe87⤵PID:4376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IJXHRHP.exe.bat" "88⤵PID:4964
-
C:\windows\system\IJXHRHP.exeC:\windows\system\IJXHRHP.exe89⤵PID:5172
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AJRMV.exe.bat" "90⤵PID:1832
-
C:\windows\system\AJRMV.exeC:\windows\system\AJRMV.exe91⤵PID:1996
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SMDIACS.exe.bat" "92⤵PID:3192
-
C:\windows\SysWOW64\SMDIACS.exeC:\windows\system32\SMDIACS.exe93⤵PID:4160
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNCE.exe.bat" "94⤵PID:3204
-
C:\windows\SysWOW64\YNCE.exeC:\windows\system32\YNCE.exe95⤵PID:1548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TAHNUE.exe.bat" "96⤵PID:1404
-
C:\windows\system\TAHNUE.exeC:\windows\system\TAHNUE.exe97⤵PID:1880
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZAPB.exe.bat" "98⤵PID:2896
-
C:\windows\SysWOW64\ZAPB.exeC:\windows\system32\ZAPB.exe99⤵PID:788
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OQQSJ.exe.bat" "100⤵PID:3280
-
C:\windows\OQQSJ.exeC:\windows\OQQSJ.exe101⤵PID:1052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\URYGSOI.exe.bat" "102⤵PID:1152
-
C:\windows\URYGSOI.exeC:\windows\URYGSOI.exe103⤵PID:5596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BHZGZK.exe.bat" "104⤵PID:2872
-
C:\windows\BHZGZK.exeC:\windows\BHZGZK.exe105⤵PID:5112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YMEDG.exe.bat" "106⤵PID:4764
-
C:\windows\system\YMEDG.exeC:\windows\system\YMEDG.exe107⤵PID:5576
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ENM.exe.bat" "108⤵PID:5788
-
C:\windows\system\ENM.exeC:\windows\system\ENM.exe109⤵PID:4116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ESM.exe.bat" "110⤵PID:5948
-
C:\windows\ESM.exeC:\windows\ESM.exe111⤵PID:4692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFXXOX.exe.bat" "112⤵PID:2832
-
C:\windows\SysWOW64\VFXXOX.exeC:\windows\system32\VFXXOX.exe113⤵PID:2004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EOZCSDT.exe.bat" "114⤵PID:3344
-
C:\windows\EOZCSDT.exeC:\windows\EOZCSDT.exe115⤵PID:6004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZBDL.exe.bat" "116⤵PID:5868
-
C:\windows\system\ZBDL.exeC:\windows\system\ZBDL.exe117⤵PID:2748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TOIVEC.exe.bat" "118⤵PID:5560
-
C:\windows\system\TOIVEC.exeC:\windows\system\TOIVEC.exe119⤵PID:1936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LPCAQAY.exe.bat" "120⤵PID:5100
-
C:\windows\system\LPCAQAY.exeC:\windows\system\LPCAQAY.exe121⤵PID:3688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-