Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 16:25
Behavioral task
behavioral1
Sample
2026-07-17_e7fad132010235a129d3664ae1c9a26e_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_e7fad132010235a129d3664ae1c9a26e_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-17_e7fad132010235a129d3664ae1c9a26e_elex_wannacry.exe
- Size 320KB
- Sample260717-txe9lafv2l
- SHA256 85fe379e5d83dde3692fa033c8777b4f64931bb06d192fca5618359f69840be4
- MD5 e7fad132010235a129d3664ae1c9a26e
- SHA1 13485b12aa7e72ab39bccc18ffa0853e0ee8163f
- SHA512 79ae840dbcaa557715b4e9aa231dcc26565a9dff5f8aecfbf172144487e5062db94acbfd29bd0840d1d266b36c71eb71e903460d39ba71059051a723571f75a7
- SSDEEP 3072:xHmLmwZMgNNvT9Thv6wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:lONNvj6V/Ah1G/AcQ///NR5fn
- TLSH T1A86420191A3409EACDED1BB5AC2269EC9141E8F114F1E13FA123DFDCD8E4DA6D819F81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gldgflba.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nflkkf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ednolp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dkifkkpf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cifmjd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ffmmgceo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eofgioah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ompfnoci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iqmincia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phhhbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lejgln32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qekbaf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcndlf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lgnihd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljcldo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ganppk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gacjkjgb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bfngmd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bnhjinpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oocdme32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kghjakbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mjbopcip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cjecjahd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhpfjh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcbpcm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pdcaahbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cjejdglp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhiacb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljobiofi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Anjifbpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iojbid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Olnkfd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ffqhmf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hkehdd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gdhcagnp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckeigc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iojbid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kgacaopj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Akblpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Chibfa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mhppcn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oeicopoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kibmqond.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijqmacpl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lqfgfclm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofjgmdgg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hbbmgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lhhchi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgdinmod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ibffbnjh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Niipdpae.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Maggggaf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gldgflba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdabmcdi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fnmeic32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hdlphjaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ikokkc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mlpeol32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbljaf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eainnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hcmbnk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mbchkg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgcmdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fhhpfg32.exe - Executes dropped EXE 64 IoCs
pid Process 2328 Afhoaahg.exe 3612 Anadho32.exe 1248 Acnlqe32.exe 5536 Andqnn32.exe 5172 Bglefdke.exe 4620 Bminokil.exe 2560 Bgoalc32.exe 5960 Bnhjinpo.exe 2612 Bcebadof.exe 4536 Bjokno32.exe 4556 Beeokgei.exe 2804 Bjagcndq.exe 4928 Beglqgcf.exe 988 Bfhhho32.exe 2908 Bmbpeiaa.exe 2548 Chhdbb32.exe 3220 Cmdmki32.exe 5424 Chjaha32.exe 1172 Cmgjpi32.exe 2992 Cdabmcdi.exe 824 Cjkjjmlf.exe 2840 Ceqngekl.exe 5584 Cfakon32.exe 5880 Cmlckhig.exe 4136 Chagiqhm.exe 5792 Cokpekpj.exe 900 Ddhhnana.exe 2552 Djbpjl32.exe 5448 Degdgd32.exe 5008 Dfiaomkb.exe 2884 Dmcilgco.exe 1728 Dhhnipbe.exe 2668 Dmefafql.exe 2108 Ddonnq32.exe 2208 Dkifkkpf.exe 3648 Deokhc32.exe 4464 Dgpgplej.exe 2720 Eaekmdep.exe 4172 Ehocjo32.exe 5860 Eoilfidj.exe 3564 Edfdop32.exe 3016 Ekpmljin.exe 4864 Eeeaibid.exe 5524 Eggmqk32.exe 1380 Emaemefo.exe 4372 Ehfjkn32.exe 1144 Emcbcd32.exe 2604 Edmjpoli.exe 1624 Fobomglo.exe 4588 Femgia32.exe 5440 Fkiobhac.exe 2540 Fachob32.exe 5748 Fgppgi32.exe 5248 Fafddb32.exe 2776 Fgbmliee.exe 4476 Fnmeic32.exe 5016 Fhbifl32.exe 5064 Folacfcd.exe 5768 Fdijkmbl.exe 6044 Gnaodbhl.exe 2916 Ghgbakhb.exe 1708 Hgcfcg32.exe 3420 Hbhjqp32.exe 3296 Hnokeqll.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Bnhjinpo.exe Bgoalc32.exe File created C:\Windows\SysWOW64\Bhhhma32.dll Nlnbqjjq.exe File created C:\Windows\SysWOW64\Epokojbg.exe Ejabgcdp.exe File created C:\Windows\SysWOW64\Hpicnh32.dll Mjneec32.exe File opened for modification C:\Windows\SysWOW64\Nldhpeop.exe Nophfa32.exe File opened for modification C:\Windows\SysWOW64\Amgefl32.exe Afmmibga.exe File opened for modification C:\Windows\SysWOW64\Loeoei32.exe Lhkghofb.exe File created C:\Windows\SysWOW64\Fbhplnca.exe Flngpc32.exe File opened for modification C:\Windows\SysWOW64\Dkcehaof.exe Dieilepc.exe File created C:\Windows\SysWOW64\Jikfbkbc.exe Jofaeb32.exe File created C:\Windows\SysWOW64\Nojagf32.exe Nhpijldj.exe File created C:\Windows\SysWOW64\Piokckal.dll Nipedokm.exe File created C:\Windows\SysWOW64\Mlflog32.exe Lelcbmcc.exe File created C:\Windows\SysWOW64\Oihapg32.exe Oboicmhj.exe File created C:\Windows\SysWOW64\Conkhh32.dll Cdhmjc32.exe File created C:\Windows\SysWOW64\Dfhjefhf.exe Dmpfla32.exe File created C:\Windows\SysWOW64\Nbnpmp32.exe Nldhpeop.exe File opened for modification C:\Windows\SysWOW64\Addabl32.exe Anjifbpg.exe File created C:\Windows\SysWOW64\Mjlhpgfn.exe Mcbpcm32.exe File created C:\Windows\SysWOW64\Hjpfob32.dll Ekpmljin.exe File created C:\Windows\SysWOW64\Mcappaqj.dll Ignndo32.exe File created C:\Windows\SysWOW64\Hchickeo.exe Hmlpkd32.exe File opened for modification C:\Windows\SysWOW64\Hienee32.exe Hdhemn32.exe File created C:\Windows\SysWOW64\Gfbhpd32.dll Gihgoq32.exe File created C:\Windows\SysWOW64\Dpekndfg.dll Khknaa32.exe File created C:\Windows\SysWOW64\Aohgjgid.dll Pchljlpo.exe File opened for modification C:\Windows\SysWOW64\Gfcebf32.exe Fmjqjqao.exe File opened for modification C:\Windows\SysWOW64\Pnmojp32.exe Phcgmffo.exe File created C:\Windows\SysWOW64\Pphjbgfj.exe Pebfen32.exe File created C:\Windows\SysWOW64\Klpifhbm.dll Jlfpnn32.exe File created C:\Windows\SysWOW64\Njkiaa32.dll Mcqjhc32.exe File created C:\Windows\SysWOW64\Fmfgoa32.exe Fbpcah32.exe File created C:\Windows\SysWOW64\Glegijdk.dll Ddhhnana.exe File created C:\Windows\SysWOW64\Famffa32.dll Iacbbh32.exe File created C:\Windows\SysWOW64\Ljcoopif.dll Ljdboe32.exe File created C:\Windows\SysWOW64\Ddecpgko.exe Dnkkcmdb.exe File created C:\Windows\SysWOW64\Qqhegnhh.dll Kgkfhngo.exe File created C:\Windows\SysWOW64\Oflcid32.dll Qkhjim32.exe File opened for modification C:\Windows\SysWOW64\Olfgbl32.exe Ojgjhicl.exe File opened for modification C:\Windows\SysWOW64\Beeokgei.exe Bjokno32.exe File created C:\Windows\SysWOW64\Gfgfmp32.dll Ibffbnjh.exe File created C:\Windows\SysWOW64\Hhbkccji.exe Hnlgekkc.exe File created C:\Windows\SysWOW64\Jlhoildi.dll Kjccna32.exe File created C:\Windows\SysWOW64\Qodmdb32.exe Pjgellfb.exe File opened for modification C:\Windows\SysWOW64\Dhjcdimf.exe Dmdogpmq.exe File created C:\Windows\SysWOW64\Iiigqdfd.exe Hdmohnhl.exe File created C:\Windows\SysWOW64\Blbodh32.exe Anaofa32.exe File created C:\Windows\SysWOW64\Jhnhek32.dll Fmjqjqao.exe File created C:\Windows\SysWOW64\Ekekcjih.exe Ddkbfp32.exe File created C:\Windows\SysWOW64\Llpmhodc.exe Lfcdph32.exe File opened for modification C:\Windows\SysWOW64\Qlbfnk32.exe Pehnaqid.exe File created C:\Windows\SysWOW64\Igmqpbab.exe Imdlgm32.exe File created C:\Windows\SysWOW64\Pjljnoam.dll Mjmokmji.exe File created C:\Windows\SysWOW64\Dgdhpdci.dll Cpdgjc32.exe File created C:\Windows\SysWOW64\Oemlklep.dll Dojqcjgi.exe File created C:\Windows\SysWOW64\Ckgmjh32.dll Jlqohhja.exe File created C:\Windows\SysWOW64\Lnnakg32.exe Lgdinmod.exe File created C:\Windows\SysWOW64\Okacel32.dll Npedfjfo.exe File created C:\Windows\SysWOW64\Cmgjpi32.exe Chjaha32.exe File created C:\Windows\SysWOW64\Kddnpj32.exe Jjoibadl.exe File opened for modification C:\Windows\SysWOW64\Blbodh32.exe Anaofa32.exe File created C:\Windows\SysWOW64\Dojqcjgi.exe Dddlfa32.exe File created C:\Windows\SysWOW64\Dgeegled.exe Dqkmkb32.exe File created C:\Windows\SysWOW64\Ajdjcc32.exe Akcjel32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 6936 6448 WerFault.exe 757 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddonnq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnaodbhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npedfjfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kiggln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lfjjqg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bqfokblg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Meefhl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Akcjel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgigfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mklkepal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pdalfo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fagjolao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihbdja32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epgndedc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flngpc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhkmoifp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jofaeb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dddlfa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ednolp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmnkdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cppfgnlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmflkl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkdaij32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nljgfn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nkieab32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hcmbnk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iemdep32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmfkac32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikmnec32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dgcmdj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihpgda32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iojbid32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nppfimnm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Niklip32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bocoqj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojgjhicl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddecpgko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mcbpcm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efeiahdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dgpllm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chhdbb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chagiqhm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfiaomkb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ejabgcdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oboicmhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pojccmii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kcpqafba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Coohbbeb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Amaqde32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bqdbec32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jqbbicel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnknkbdk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjbopcip.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Napjnfik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnfahn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ompfnoci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Liocgc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfqkmj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkomgkoj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dpphcf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdhndlno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibcadcgf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bacjmh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdlphjaf.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acahge32.dll" Ojbamj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehfido32.dll" Jpenoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcikmdne.dll" Andqnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpaeap32.dll" Eaekmdep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oqimje32.dll" Loeoei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bqhlpbjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdommbij.dll" Hhiacb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Llpmhodc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Niklip32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Efdjqeni.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hgcfcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Malgmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlalhlfd.dll" Eenfff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aeeemg32.dll" Bjokno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncqjbaco.dll" Icalij32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kckgff32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ohdlke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfbeee32.dll" Bokeai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlkcocod.dll" Ebjckppa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Klceeejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mcnfhmcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Degdgd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbbggj32.dll" Oofacdaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gkdaij32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Badaholq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fachob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlhoildi.dll" Kjccna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nacmjf32.dll" Pfmdbd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nlbkjf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oeccijoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fmfnig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncikop32.dll" Efafqolp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Momjmoid.dll" Nljgfn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oanfodmk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cpbbln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmqjplak.dll" Gacjkjgb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Noijmp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pahiebeq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pkbjchio.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dmnhgdjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Njjdae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Chhdbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpdmdpdd.dll" Qdphgmlj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bnhjinpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eeqclfaa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gkdaij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Higjkehf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nclokbca.dll" Bkibqnah.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Llbinnbq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aflabj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epkakham.dll" Beglqgcf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Akamol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iepepgmo.dll" Dkbomgde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ancqfljf.dll" Anjifbpg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Opqopj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnoijo32.dll" Cknlln32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cmdmki32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gmpqof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Alimnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aigpaf32.dll" Jglkfmmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nophfa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnefpdco.dll" Ipflcnln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjkije32.dll" Dqmjqb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eoilfidj.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4560 wrote to memory of 2328 4560 2026-07-17_e7fad132010235a129d3664ae1c9a26e_elex_wannacry.exe 89 PID 2328 wrote to memory of 3612 2328 Afhoaahg.exe 90 PID 3612 wrote to memory of 1248 3612 Anadho32.exe 91 PID 1248 wrote to memory of 5536 1248 Acnlqe32.exe 92 PID 5536 wrote to memory of 5172 5536 Andqnn32.exe 93 PID 5172 wrote to memory of 4620 5172 Bglefdke.exe 94 PID 4620 wrote to memory of 2560 4620 Bminokil.exe 95 PID 2560 wrote to memory of 5960 2560 Bgoalc32.exe 96 PID 5960 wrote to memory of 2612 5960 Bnhjinpo.exe 97 PID 2612 wrote to memory of 4536 2612 Bcebadof.exe 98 PID 4536 wrote to memory of 4556 4536 Bjokno32.exe 99 PID 4556 wrote to memory of 2804 4556 Beeokgei.exe 100 PID 2804 wrote to memory of 4928 2804 Bjagcndq.exe 101 PID 4928 wrote to memory of 988 4928 Beglqgcf.exe 102 PID 988 wrote to memory of 2908 988 Bfhhho32.exe 103 PID 2908 wrote to memory of 2548 2908 Bmbpeiaa.exe 104 PID 2548 wrote to memory of 3220 2548 Chhdbb32.exe 105 PID 3220 wrote to memory of 5424 3220 Cmdmki32.exe 106 PID 5424 wrote to memory of 1172 5424 Chjaha32.exe 107 PID 1172 wrote to memory of 2992 1172 Cmgjpi32.exe 108 PID 2992 wrote to memory of 824 2992 Cdabmcdi.exe 109 PID 824 wrote to memory of 2840 824 Cjkjjmlf.exe 110 PID 2840 wrote to memory of 5584 2840 Ceqngekl.exe 111 PID 5584 wrote to memory of 5880 5584 Cfakon32.exe 112 PID 5880 wrote to memory of 4136 5880 Cmlckhig.exe 113 PID 4136 wrote to memory of 5792 4136 Chagiqhm.exe 114 PID 5792 wrote to memory of 900 5792 Cokpekpj.exe 115 PID 900 wrote to memory of 2552 900 Ddhhnana.exe 116 PID 2552 wrote to memory of 5448 2552 Djbpjl32.exe 117 PID 5448 wrote to memory of 5008 5448 Degdgd32.exe 118 PID 5008 wrote to memory of 2884 5008 Dfiaomkb.exe 119 PID 2884 wrote to memory of 1728 2884 Dmcilgco.exe 120 PID 1728 wrote to memory of 2668 1728 Dhhnipbe.exe 121 PID 2668 wrote to memory of 2108 2668 Dmefafql.exe 122 PID 2108 wrote to memory of 2208 2108 Ddonnq32.exe 123 PID 2208 wrote to memory of 3648 2208 Dkifkkpf.exe 124 PID 3648 wrote to memory of 4464 3648 Deokhc32.exe 125 PID 4464 wrote to memory of 2720 4464 Dgpgplej.exe 126 PID 2720 wrote to memory of 4172 2720 Eaekmdep.exe 127 PID 4172 wrote to memory of 5860 4172 Ehocjo32.exe 128 PID 5860 wrote to memory of 3564 5860 Eoilfidj.exe 129 PID 3564 wrote to memory of 3016 3564 Edfdop32.exe 130 PID 3016 wrote to memory of 4864 3016 Ekpmljin.exe 131 PID 4864 wrote to memory of 5524 4864 Eeeaibid.exe 132 PID 5524 wrote to memory of 1380 5524 Eggmqk32.exe 133 PID 1380 wrote to memory of 4372 1380 Emaemefo.exe 134 PID 4372 wrote to memory of 1144 4372 Ehfjkn32.exe 135 PID 1144 wrote to memory of 2604 1144 Emcbcd32.exe 136 PID 2604 wrote to memory of 1624 2604 Edmjpoli.exe 137 PID 1624 wrote to memory of 4588 1624 Fobomglo.exe 138 PID 4588 wrote to memory of 5440 4588 Femgia32.exe 139 PID 5440 wrote to memory of 2540 5440 Fkiobhac.exe 140 PID 2540 wrote to memory of 5748 2540 Fachob32.exe 141 PID 5748 wrote to memory of 5248 5748 Fgppgi32.exe 142 PID 5248 wrote to memory of 2776 5248 Fafddb32.exe 143 PID 2776 wrote to memory of 4476 2776 Fgbmliee.exe 144 PID 4476 wrote to memory of 5016 4476 Fnmeic32.exe 145 PID 5016 wrote to memory of 5064 5016 Fhbifl32.exe 146 PID 5064 wrote to memory of 5768 5064 Folacfcd.exe 147 PID 5768 wrote to memory of 6044 5768 Fdijkmbl.exe 148 PID 6044 wrote to memory of 2916 6044 Gnaodbhl.exe 149 PID 2916 wrote to memory of 1708 2916 Ghgbakhb.exe 150 PID 1708 wrote to memory of 3420 1708 Hgcfcg32.exe 151 PID 3420 wrote to memory of 3296 3420 Hbhjqp32.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_e7fad132010235a129d3664ae1c9a26e_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_e7fad132010235a129d3664ae1c9a26e_elex_wannacry.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\Afhoaahg.exeC:\Windows\system32\Afhoaahg.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\Anadho32.exeC:\Windows\system32\Anadho32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\Acnlqe32.exeC:\Windows\system32\Acnlqe32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\Andqnn32.exeC:\Windows\system32\Andqnn32.exe5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\SysWOW64\Bglefdke.exeC:\Windows\system32\Bglefdke.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Windows\SysWOW64\Bminokil.exeC:\Windows\system32\Bminokil.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\Bgoalc32.exeC:\Windows\system32\Bgoalc32.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\Bnhjinpo.exeC:\Windows\system32\Bnhjinpo.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\SysWOW64\Bcebadof.exeC:\Windows\system32\Bcebadof.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\Bjokno32.exeC:\Windows\system32\Bjokno32.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\Beeokgei.exeC:\Windows\system32\Beeokgei.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\Bjagcndq.exeC:\Windows\system32\Bjagcndq.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\Beglqgcf.exeC:\Windows\system32\Beglqgcf.exe14⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\Bfhhho32.exeC:\Windows\system32\Bfhhho32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\Bmbpeiaa.exeC:\Windows\system32\Bmbpeiaa.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\Chhdbb32.exeC:\Windows\system32\Chhdbb32.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\Cmdmki32.exeC:\Windows\system32\Cmdmki32.exe18⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\Chjaha32.exeC:\Windows\system32\Chjaha32.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Windows\SysWOW64\Cmgjpi32.exeC:\Windows\system32\Cmgjpi32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\Cdabmcdi.exeC:\Windows\system32\Cdabmcdi.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\Cjkjjmlf.exeC:\Windows\system32\Cjkjjmlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\Ceqngekl.exeC:\Windows\system32\Ceqngekl.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\Cfakon32.exeC:\Windows\system32\Cfakon32.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\Cmlckhig.exeC:\Windows\system32\Cmlckhig.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Windows\SysWOW64\Chagiqhm.exeC:\Windows\system32\Chagiqhm.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\Cokpekpj.exeC:\Windows\system32\Cokpekpj.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\Ddhhnana.exeC:\Windows\system32\Ddhhnana.exe28⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\Djbpjl32.exeC:\Windows\system32\Djbpjl32.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\Degdgd32.exeC:\Windows\system32\Degdgd32.exe30⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\SysWOW64\Dfiaomkb.exeC:\Windows\system32\Dfiaomkb.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\Dmcilgco.exeC:\Windows\system32\Dmcilgco.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\Dhhnipbe.exeC:\Windows\system32\Dhhnipbe.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\Dmefafql.exeC:\Windows\system32\Dmefafql.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\Ddonnq32.exeC:\Windows\system32\Ddonnq32.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\Dkifkkpf.exeC:\Windows\system32\Dkifkkpf.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\Deokhc32.exeC:\Windows\system32\Deokhc32.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\Dgpgplej.exeC:\Windows\system32\Dgpgplej.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\Eaekmdep.exeC:\Windows\system32\Eaekmdep.exe39⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\Ehocjo32.exeC:\Windows\system32\Ehocjo32.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\Eoilfidj.exeC:\Windows\system32\Eoilfidj.exe41⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\Edfdop32.exeC:\Windows\system32\Edfdop32.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\Ekpmljin.exeC:\Windows\system32\Ekpmljin.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\Eeeaibid.exeC:\Windows\system32\Eeeaibid.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\Eggmqk32.exeC:\Windows\system32\Eggmqk32.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Windows\SysWOW64\Emaemefo.exeC:\Windows\system32\Emaemefo.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\Ehfjkn32.exeC:\Windows\system32\Ehfjkn32.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\Emcbcd32.exeC:\Windows\system32\Emcbcd32.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\Edmjpoli.exeC:\Windows\system32\Edmjpoli.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\Fobomglo.exeC:\Windows\system32\Fobomglo.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\Femgia32.exeC:\Windows\system32\Femgia32.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\Fkiobhac.exeC:\Windows\system32\Fkiobhac.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Windows\SysWOW64\Fachob32.exeC:\Windows\system32\Fachob32.exe53⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\Fgppgi32.exeC:\Windows\system32\Fgppgi32.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Windows\SysWOW64\Fafddb32.exeC:\Windows\system32\Fafddb32.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Windows\SysWOW64\Fgbmliee.exeC:\Windows\system32\Fgbmliee.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\Fnmeic32.exeC:\Windows\system32\Fnmeic32.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\Fhbifl32.exeC:\Windows\system32\Fhbifl32.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\Folacfcd.exeC:\Windows\system32\Folacfcd.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\Fdijkmbl.exeC:\Windows\system32\Fdijkmbl.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\SysWOW64\Gnaodbhl.exeC:\Windows\system32\Gnaodbhl.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\Ghgbakhb.exeC:\Windows\system32\Ghgbakhb.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\Hgcfcg32.exeC:\Windows\system32\Hgcfcg32.exe63⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\Hbhjqp32.exeC:\Windows\system32\Hbhjqp32.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\Hnokeqll.exeC:\Windows\system32\Hnokeqll.exe65⤵
- Executes dropped EXE
PID:3296 -
C:\Windows\SysWOW64\Hkckoe32.exeC:\Windows\system32\Hkckoe32.exe66⤵PID:2340
-
C:\Windows\SysWOW64\Hdlphjaf.exeC:\Windows\system32\Hdlphjaf.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2104 -
C:\Windows\SysWOW64\Hkehdd32.exeC:\Windows\system32\Hkehdd32.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6084 -
C:\Windows\SysWOW64\Hgliie32.exeC:\Windows\system32\Hgliie32.exe69⤵PID:5952
-
C:\Windows\SysWOW64\Hbbmgn32.exeC:\Windows\system32\Hbbmgn32.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2956 -
C:\Windows\SysWOW64\Ininloda.exeC:\Windows\system32\Ininloda.exe71⤵PID:1780
-
C:\Windows\SysWOW64\Ikmnec32.exeC:\Windows\system32\Ikmnec32.exe72⤵
- System Location Discovery: System Language Discovery
PID:2928 -
C:\Windows\SysWOW64\Ibffbnjh.exeC:\Windows\system32\Ibffbnjh.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:4604 -
C:\Windows\SysWOW64\Ikokkc32.exeC:\Windows\system32\Ikokkc32.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6020 -
C:\Windows\SysWOW64\Ikagpcof.exeC:\Windows\system32\Ikagpcof.exe75⤵PID:1520
-
C:\Windows\SysWOW64\Ighhed32.exeC:\Windows\system32\Ighhed32.exe76⤵PID:3216
-
C:\Windows\SysWOW64\Jigdoglm.exeC:\Windows\system32\Jigdoglm.exe77⤵PID:5716
-
C:\Windows\SysWOW64\Jbpihlbn.exeC:\Windows\system32\Jbpihlbn.exe78⤵PID:2036
-
C:\Windows\SysWOW64\Jodiaqag.exeC:\Windows\system32\Jodiaqag.exe79⤵PID:5144
-
C:\Windows\SysWOW64\Jgonfcnb.exeC:\Windows\system32\Jgonfcnb.exe80⤵PID:4452
-
C:\Windows\SysWOW64\Jfpocjfa.exeC:\Windows\system32\Jfpocjfa.exe81⤵PID:3492
-
C:\Windows\SysWOW64\Jkmgladi.exeC:\Windows\system32\Jkmgladi.exe82⤵PID:3472
-
C:\Windows\SysWOW64\Jfbkijdo.exeC:\Windows\system32\Jfbkijdo.exe83⤵PID:4944
-
C:\Windows\SysWOW64\Kgfdfbhj.exeC:\Windows\system32\Kgfdfbhj.exe84⤵PID:3224
-
C:\Windows\SysWOW64\Kfgddi32.exeC:\Windows\system32\Kfgddi32.exe85⤵PID:5828
-
C:\Windows\SysWOW64\Khknaa32.exeC:\Windows\system32\Khknaa32.exe86⤵
- Drops file in System32 directory
PID:1168 -
C:\Windows\SysWOW64\Knefnkla.exeC:\Windows\system32\Knefnkla.exe87⤵PID:3040
-
C:\Windows\SysWOW64\Kijjldkh.exeC:\Windows\system32\Kijjldkh.exe88⤵PID:3372
-
C:\Windows\SysWOW64\Kngcdkjo.exeC:\Windows\system32\Kngcdkjo.exe89⤵PID:5240
-
C:\Windows\SysWOW64\Keakqeal.exeC:\Windows\system32\Keakqeal.exe90⤵PID:2764
-
C:\Windows\SysWOW64\Knipik32.exeC:\Windows\system32\Knipik32.exe91⤵PID:5136
-
C:\Windows\SysWOW64\Liocgc32.exeC:\Windows\system32\Liocgc32.exe92⤵
- System Location Discovery: System Language Discovery
PID:4980 -
C:\Windows\SysWOW64\Lfcdph32.exeC:\Windows\system32\Lfcdph32.exe93⤵
- Drops file in System32 directory
PID:960 -
C:\Windows\SysWOW64\Llpmhodc.exeC:\Windows\system32\Llpmhodc.exe94⤵
- Modifies registry class
PID:1628 -
C:\Windows\SysWOW64\Lehaad32.exeC:\Windows\system32\Lehaad32.exe95⤵PID:3376
-
C:\Windows\SysWOW64\Llbinnbq.exeC:\Windows\system32\Llbinnbq.exe96⤵
- Modifies registry class
PID:3008 -
C:\Windows\SysWOW64\Lfgnkgbf.exeC:\Windows\system32\Lfgnkgbf.exe97⤵PID:6136
-
C:\Windows\SysWOW64\Lldfcn32.exeC:\Windows\system32\Lldfcn32.exe98⤵PID:5396
-
C:\Windows\SysWOW64\Lfjjqg32.exeC:\Windows\system32\Lfjjqg32.exe99⤵
- System Location Discovery: System Language Discovery
PID:4500 -
C:\Windows\SysWOW64\Lhkghofb.exeC:\Windows\system32\Lhkghofb.exe100⤵
- Drops file in System32 directory
PID:468 -
C:\Windows\SysWOW64\Loeoei32.exeC:\Windows\system32\Loeoei32.exe101⤵
- Modifies registry class
PID:5752 -
C:\Windows\SysWOW64\Mhncnodp.exeC:\Windows\system32\Mhncnodp.exe102⤵PID:248
-
C:\Windows\SysWOW64\Mbchkg32.exeC:\Windows\system32\Mbchkg32.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2304 -
C:\Windows\SysWOW64\Mhppcn32.exeC:\Windows\system32\Mhppcn32.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5940 -
C:\Windows\SysWOW64\Mbedag32.exeC:\Windows\system32\Mbedag32.exe105⤵PID:5128
-
C:\Windows\SysWOW64\Mhbmin32.exeC:\Windows\system32\Mhbmin32.exe106⤵PID:688
-
C:\Windows\SysWOW64\Mbhafgpp.exeC:\Windows\system32\Mbhafgpp.exe107⤵PID:2532
-
C:\Windows\SysWOW64\Mlpeol32.exeC:\Windows\system32\Mlpeol32.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:596 -
C:\Windows\SysWOW64\Mfejme32.exeC:\Windows\system32\Mfejme32.exe109⤵PID:3540
-
C:\Windows\SysWOW64\Nbljaf32.exeC:\Windows\system32\Nbljaf32.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3128 -
C:\Windows\SysWOW64\Nhicjm32.exeC:\Windows\system32\Nhicjm32.exe111⤵PID:2632
-
C:\Windows\SysWOW64\Nockfgao.exeC:\Windows\system32\Nockfgao.exe112⤵PID:948
-
C:\Windows\SysWOW64\Niipdpae.exeC:\Windows\system32\Niipdpae.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5720 -
C:\Windows\SysWOW64\Npbhqj32.exeC:\Windows\system32\Npbhqj32.exe114⤵PID:6068
-
C:\Windows\SysWOW64\Niklip32.exeC:\Windows\system32\Niklip32.exe115⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3880 -
C:\Windows\SysWOW64\Npedfjfo.exeC:\Windows\system32\Npedfjfo.exe116⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1160 -
C:\Windows\SysWOW64\Nhpijldj.exeC:\Windows\system32\Nhpijldj.exe117⤵
- Drops file in System32 directory
PID:6128 -
C:\Windows\SysWOW64\Nojagf32.exeC:\Windows\system32\Nojagf32.exe118⤵PID:5616
-
C:\Windows\SysWOW64\Nipedokm.exeC:\Windows\system32\Nipedokm.exe119⤵
- Drops file in System32 directory
PID:1704 -
C:\Windows\SysWOW64\Nlnbqjjq.exeC:\Windows\system32\Nlnbqjjq.exe120⤵
- Drops file in System32 directory
PID:5684 -
C:\Windows\SysWOW64\Ogcfncjf.exeC:\Windows\system32\Ogcfncjf.exe121⤵PID:5176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-