Analysis
- max time kernel
148s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 17:16
Behavioral task
behavioral1
Sample
2026-07-17_2fc4444ac33987aefdeb71b00545440d_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_2fc4444ac33987aefdeb71b00545440d_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-17_2fc4444ac33987aefdeb71b00545440d_elex_wannacry.exe
- Size 320KB
- Sample260717-vs5jcsct41
- SHA256 da3db9418f4d23480dc83aca3587539a68380f3fc9e5cd86671b9d9cd24b008c
- MD5 2fc4444ac33987aefdeb71b00545440d
- SHA1 7c25a6a30623c1725e5ef343af2566777722f00d
- SHA512 b3827ee149bf794ad47ab59e81791f4b5648d55feeeb6e8ee976b0d819b8c59e5b2f3e1b359b0c70935cace7d84703432022ab9e3825b1c48a6f5504f21b59b7
- SSDEEP 3072:MCkNPUPFCT2Ib6qTwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:MTNMgTFhTV/Ah1G/AcQ///NR5fn
- TLSH T1D064D91A263009EACEFD1BB6BC1249D89182E5B114F1E23E6133DFDCD8E4DA6D815F85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajckbp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jqhaolli.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgaoda32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mncjffbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ppgeqijb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nloikqnl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dclknkfp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fgbfbc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jcmkehcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kjepcqnd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmdlolmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Conagl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhdaao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kfgddi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfogohpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jgcafl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Poajdlcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ebggep32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glbjpmdd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lfgiii32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Akiijq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dlpgiebo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hejjmage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pmoabn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nebmnqdf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djhifnho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mgclja32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppgeqijb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aegbji32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhijcohe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cmhial32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hfekoc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lomqmoob.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lopmbomp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ngikpjml.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnodmijd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gkoinlbg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kbiede32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lgamhjja.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lihpbl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jncobabm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lnhadnpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ljnloi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ofijifbj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mfoclflo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajnkmjqj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mnnkaa32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmpclnof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Miomnaip.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olgnlb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qlejnqbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Djelqo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhpfjh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bepeph32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jigdoglm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iqmincia.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fllkjd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mjlhpgfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fkgbli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gneaelqk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Blbodh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmomga32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Omkmcpgo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Conagl32.exe - Executes dropped EXE 64 IoCs
pid Process 4300 Oqpeaeel.exe 4648 Okjbimal.exe 2932 Okloomoj.exe 720 Peddhb32.exe 6052 Pegqmbch.exe 5664 Panabc32.exe 1340 Pgjfdm32.exe 1620 Pabknbef.exe 3160 Qbddmejf.exe 5100 Qgalelin.exe 4148 Aeemop32.exe 5788 Alaaajmb.exe 2324 Abkjnd32.exe 4160 Aaqgop32.exe 4624 Alfkli32.exe 2996 Bbbpnc32.exe 1196 Bhohfj32.exe 1080 Bbgiibja.exe 4444 Bdhfaj32.exe 5436 Balfko32.exe 708 Blakhgoo.exe 1540 Bblcda32.exe 5732 Cdaigi32.exe 5916 Ceaealoh.exe 5480 Clknnf32.exe 4212 Cajblmci.exe 1104 Dlpgiebo.exe 1768 Doqpkq32.exe 4132 Dejhgkgm.exe 2024 Dhkaif32.exe 2420 Deanhj32.exe 5552 Ekngqqol.exe 1176 Eaklcj32.exe 5704 Eoollocp.exe 5216 Ekemap32.exe 2008 Eekanh32.exe 4984 Eocegn32.exe 5628 Fcanmlea.exe 4296 Fljcfa32.exe 3880 Fcckcl32.exe 940 Fkopgn32.exe 2664 Flnlaahl.exe 1324 Fffqjfom.exe 1276 Gfimpfmj.exe 6004 Glcelq32.exe 2748 Glebbpbd.exe 3888 Gcojoj32.exe 5372 Gmhogppb.exe 1524 Gfpcpefb.exe 2536 Gcddjiel.exe 3764 Gkoinlbg.exe 5320 Hdgmga32.exe 4816 Hkaedk32.exe 2492 Hejjmage.exe 4840 Hckjjh32.exe 4224 Hihbco32.exe 4384 Hmfkin32.exe 4620 Hfnpacjb.exe 1220 Hmhhnmao.exe 2836 Iioicn32.exe 4860 Ipiaphop.exe 5828 Iiaein32.exe 1144 Ifefbbdj.exe 6100 Iciflfcd.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Jilnjf32.exe Jbbfnlpk.exe File opened for modification C:\Windows\SysWOW64\Bfnnhj32.exe Bmfjodgc.exe File opened for modification C:\Windows\SysWOW64\Lagekp32.exe Lkjlciem.exe File created C:\Windows\SysWOW64\Icneeq32.dll Nmbaggce.exe File opened for modification C:\Windows\SysWOW64\Aahblp32.exe Alkidi32.exe File created C:\Windows\SysWOW64\Hbeece32.exe Himqjpme.exe File created C:\Windows\SysWOW64\Cponodge.exe Conagl32.exe File created C:\Windows\SysWOW64\Knboee32.dll Gmhogppb.exe File opened for modification C:\Windows\SysWOW64\Pfgopnbo.exe Pomgcc32.exe File created C:\Windows\SysWOW64\Lfelpihk.dll Lhhchi32.exe File created C:\Windows\SysWOW64\Acanjcbi.dll Iloimopp.exe File created C:\Windows\SysWOW64\Jqhaolli.exe Jjoibadl.exe File created C:\Windows\SysWOW64\Mnjdjo32.dll Akqfef32.exe File created C:\Windows\SysWOW64\Dccfinpe.dll Fealcc32.exe File opened for modification C:\Windows\SysWOW64\Lgblhmag.exe Lqhdlc32.exe File created C:\Windows\SysWOW64\Qiokkook.dll Ngbpbjoe.exe File created C:\Windows\SysWOW64\Agcbqecp.exe Aqijdk32.exe File opened for modification C:\Windows\SysWOW64\Aflabj32.exe Aobieq32.exe File opened for modification C:\Windows\SysWOW64\Djelqo32.exe Dckdddcd.exe File created C:\Windows\SysWOW64\Mhejhkma.dll Fpbmpc32.exe File created C:\Windows\SysWOW64\Obmichdq.dll Ennqpkcm.exe File created C:\Windows\SysWOW64\Kgdpmm32.dll Onkimc32.exe File created C:\Windows\SysWOW64\Dqlodlcc.dll Mefmbbod.exe File created C:\Windows\SysWOW64\Cjcmognb.exe Bpniaool.exe File created C:\Windows\SysWOW64\Magnbnea.exe Mlkejgfj.exe File opened for modification C:\Windows\SysWOW64\Oaqbdc32.exe Ojgjhicl.exe File opened for modification C:\Windows\SysWOW64\Qlbfnk32.exe Palbpb32.exe File created C:\Windows\SysWOW64\Mjndbb32.dll Ngbeok32.exe File created C:\Windows\SysWOW64\Lkaepbjk.dll Dkndbkop.exe File opened for modification C:\Windows\SysWOW64\Jmknkk32.exe Jpgmaf32.exe File created C:\Windows\SysWOW64\Peeakakg.exe Pmlmdd32.exe File created C:\Windows\SysWOW64\Ajeljnae.dll Mlciobhj.exe File created C:\Windows\SysWOW64\Ceaealoh.exe Cdaigi32.exe File created C:\Windows\SysWOW64\Dlpgiebo.exe Cajblmci.exe File created C:\Windows\SysWOW64\Hbbmgn32.exe Hgliie32.exe File created C:\Windows\SysWOW64\Picfjl32.dll Efbllhfb.exe File opened for modification C:\Windows\SysWOW64\Gcddjiel.exe Gfpcpefb.exe File opened for modification C:\Windows\SysWOW64\Holjjd32.exe Hfdfanoa.exe File created C:\Windows\SysWOW64\Hmejje32.dll Jilnjf32.exe File created C:\Windows\SysWOW64\Cggqjn32.dll Fmehnn32.exe File opened for modification C:\Windows\SysWOW64\Bmofkm32.exe Bbiamd32.exe File opened for modification C:\Windows\SysWOW64\Fifhmi32.exe Eblpqono.exe File opened for modification C:\Windows\SysWOW64\Gdncfl32.exe Goqkne32.exe File created C:\Windows\SysWOW64\Oidopn32.exe Ocjgcd32.exe File created C:\Windows\SysWOW64\Hphglf32.exe Gnjjpk32.exe File created C:\Windows\SysWOW64\Odmpdm32.dll Dfdpjj32.exe File created C:\Windows\SysWOW64\Panabc32.exe Pegqmbch.exe File created C:\Windows\SysWOW64\Holjjd32.exe Hfdfanoa.exe File created C:\Windows\SysWOW64\Abmbaf32.exe Ahenip32.exe File created C:\Windows\SysWOW64\Jcmkehcg.exe Jlcchn32.exe File opened for modification C:\Windows\SysWOW64\Bojogb32.exe Bhpfjh32.exe File created C:\Windows\SysWOW64\Cdggoi32.exe Bojogb32.exe File opened for modification C:\Windows\SysWOW64\Knlknigf.exe Kcfgaq32.exe File created C:\Windows\SysWOW64\Gjiipife.dll Bnfmcn32.exe File opened for modification C:\Windows\SysWOW64\Kfnkeh32.exe Kijjldkh.exe File created C:\Windows\SysWOW64\Nockfgao.exe Nekgna32.exe File created C:\Windows\SysWOW64\Ofbjei32.dll Hhdhhchf.exe File created C:\Windows\SysWOW64\Oagnib32.dll Bhldio32.exe File created C:\Windows\SysWOW64\Clgbfe32.exe Cbbnim32.exe File opened for modification C:\Windows\SysWOW64\Moiphnde.exe Mjlhpgfn.exe File created C:\Windows\SysWOW64\Knbmicga.dll Jpgmaf32.exe File opened for modification C:\Windows\SysWOW64\Poomom32.exe Phddbbnf.exe File opened for modification C:\Windows\SysWOW64\Lmaafcml.exe Lfgiii32.exe File opened for modification C:\Windows\SysWOW64\Peddhb32.exe Okloomoj.exe - Program crash 1 IoCs
pid pid_target Process procid_target 8936 9068 WerFault.exe 952 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddjmkg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dkcehaof.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Glcelq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Benijhla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chmnnamb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kfiajinf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lbnnphhk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jnaighhk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nklbfaae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bohbackj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmbdkj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdfmfmdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Poajdlcq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbbkmebo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnokhonp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Baldmiom.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cjcmognb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpaqkgba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kqbdej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mkjnop32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfhhho32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eiaobjia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gikkof32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Adfnhlfa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pgiojf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bmpcpjcd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kfnkeh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocamcc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qfneamlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Noeaaqlq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oejijiip.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Allpnplb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bepeph32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nockfgao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nedjdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Injcginc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phddbbnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pidaleei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lqdakjak.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mglfibmh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Malgmm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmgjpi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Goqkne32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kijjldkh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oenljoji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eainnn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fajgekol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iaaflh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekngqqol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mphoob32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmmelo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ijlkqj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Plijbblh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djhifnho.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljcldo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oanfodmk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gehfepio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdncfl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flnlaahl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mgagll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgckgcem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ppemmg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pomgcc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bjodch32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ojajbdde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkpkcm32.dll" Ogifci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dmnpah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjqqid32.dll" Foghhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iambqaim.dll" Ebggep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbppah32.dll" Bgkijp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Deanhj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dchnan32.dll" Dmpmfg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ajnkmjqj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhejhkma.dll" Fpbmpc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Icalij32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ihlechfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gjohnkdd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijbkqe32.dll" Qhigbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Igmqpbab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pcnhfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nclokbca.dll" Bgnfpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nolbfo32.dll" Ooaghe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oondhocf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dcgjie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cbbnim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgdpmm32.dll" Onkimc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Facakcce.dll" Dhnlapbo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hffbfn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdaemjcg.dll" Bjaqih32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ljpideje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agkejbik.dll" Lqikfi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mpnnek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikfgga32.dll" Idbfhiko.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jigdoglm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Djcfee32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hkeajn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cnodmijd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cglbanmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iphihnjk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aceijg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kgjggkqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idfkmkhe.dll" Lgamhjja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcmdcg32.dll" Fikbhiaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Akqfef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kallmekb.dll" Ldgkdbia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clomaf32.dll" Odocbmfd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bfhhho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nekgna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eigohp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iocheg32.dll" Oajmdd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mmcnlc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dhdaao32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nepgcgje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbpclq32.dll" Laiaqp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aclhkdmp.dll" Okpkaqmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Onnmmipj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibopfamc.dll" Fmancbji.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fbnflihq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pfanmcao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Komkno32.dll" Fgbfbc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggenahaa.dll" Hkpqdifa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdclkefm.dll" Dddlfa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bmkjdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Goediekj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibenomhb.dll" Magnbnea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mnnkaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ennqpkcm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fphebcac.dll" Jfcbcp32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1856 wrote to memory of 4300 1856 2026-07-17_2fc4444ac33987aefdeb71b00545440d_elex_wannacry.exe 90 PID 4300 wrote to memory of 4648 4300 Oqpeaeel.exe 91 PID 4648 wrote to memory of 2932 4648 Okjbimal.exe 92 PID 2932 wrote to memory of 720 2932 Okloomoj.exe 93 PID 720 wrote to memory of 6052 720 Peddhb32.exe 94 PID 6052 wrote to memory of 5664 6052 Pegqmbch.exe 95 PID 5664 wrote to memory of 1340 5664 Panabc32.exe 96 PID 1340 wrote to memory of 1620 1340 Pgjfdm32.exe 97 PID 1620 wrote to memory of 3160 1620 Pabknbef.exe 98 PID 3160 wrote to memory of 5100 3160 Qbddmejf.exe 99 PID 5100 wrote to memory of 4148 5100 Qgalelin.exe 100 PID 4148 wrote to memory of 5788 4148 Aeemop32.exe 101 PID 5788 wrote to memory of 2324 5788 Alaaajmb.exe 102 PID 2324 wrote to memory of 4160 2324 Abkjnd32.exe 103 PID 4160 wrote to memory of 4624 4160 Aaqgop32.exe 104 PID 4624 wrote to memory of 2996 4624 Alfkli32.exe 105 PID 2996 wrote to memory of 1196 2996 Bbbpnc32.exe 106 PID 1196 wrote to memory of 1080 1196 Bhohfj32.exe 107 PID 1080 wrote to memory of 4444 1080 Bbgiibja.exe 108 PID 4444 wrote to memory of 5436 4444 Bdhfaj32.exe 109 PID 5436 wrote to memory of 708 5436 Balfko32.exe 110 PID 708 wrote to memory of 1540 708 Blakhgoo.exe 111 PID 1540 wrote to memory of 5732 1540 Bblcda32.exe 112 PID 5732 wrote to memory of 5916 5732 Cdaigi32.exe 113 PID 5916 wrote to memory of 5480 5916 Ceaealoh.exe 114 PID 5480 wrote to memory of 4212 5480 Clknnf32.exe 115 PID 4212 wrote to memory of 1104 4212 Cajblmci.exe 116 PID 1104 wrote to memory of 1768 1104 Dlpgiebo.exe 117 PID 1768 wrote to memory of 4132 1768 Doqpkq32.exe 118 PID 4132 wrote to memory of 2024 4132 Dejhgkgm.exe 119 PID 2024 wrote to memory of 2420 2024 Dhkaif32.exe 120 PID 2420 wrote to memory of 5552 2420 Deanhj32.exe 121 PID 5552 wrote to memory of 1176 5552 Ekngqqol.exe 122 PID 1176 wrote to memory of 5704 1176 Eaklcj32.exe 123 PID 5704 wrote to memory of 5216 5704 Eoollocp.exe 124 PID 5216 wrote to memory of 2008 5216 Ekemap32.exe 125 PID 2008 wrote to memory of 4984 2008 Eekanh32.exe 126 PID 4984 wrote to memory of 5628 4984 Eocegn32.exe 127 PID 5628 wrote to memory of 4296 5628 Fcanmlea.exe 128 PID 4296 wrote to memory of 3880 4296 Fljcfa32.exe 129 PID 3880 wrote to memory of 940 3880 Fcckcl32.exe 130 PID 940 wrote to memory of 2664 940 Fkopgn32.exe 131 PID 2664 wrote to memory of 1324 2664 Flnlaahl.exe 132 PID 1324 wrote to memory of 1276 1324 Fffqjfom.exe 133 PID 1276 wrote to memory of 6004 1276 Gfimpfmj.exe 134 PID 6004 wrote to memory of 2748 6004 Glcelq32.exe 135 PID 2748 wrote to memory of 3888 2748 Glebbpbd.exe 136 PID 3888 wrote to memory of 5372 3888 Gcojoj32.exe 137 PID 5372 wrote to memory of 1524 5372 Gmhogppb.exe 138 PID 1524 wrote to memory of 2536 1524 Gfpcpefb.exe 139 PID 2536 wrote to memory of 3764 2536 Gcddjiel.exe 140 PID 3764 wrote to memory of 5320 3764 Gkoinlbg.exe 141 PID 5320 wrote to memory of 4816 5320 Hdgmga32.exe 142 PID 4816 wrote to memory of 2492 4816 Hkaedk32.exe 143 PID 2492 wrote to memory of 4840 2492 Hejjmage.exe 144 PID 4840 wrote to memory of 4224 4840 Hckjjh32.exe 145 PID 4224 wrote to memory of 4384 4224 Hihbco32.exe 146 PID 4384 wrote to memory of 4620 4384 Hmfkin32.exe 147 PID 4620 wrote to memory of 1220 4620 Hfnpacjb.exe 148 PID 1220 wrote to memory of 2836 1220 Hmhhnmao.exe 149 PID 2836 wrote to memory of 4860 2836 Iioicn32.exe 150 PID 4860 wrote to memory of 5828 4860 Ipiaphop.exe 151 PID 5828 wrote to memory of 1144 5828 Iiaein32.exe 152 PID 1144 wrote to memory of 6100 1144 Ifefbbdj.exe 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_2fc4444ac33987aefdeb71b00545440d_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_2fc4444ac33987aefdeb71b00545440d_elex_wannacry.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\Oqpeaeel.exeC:\Windows\system32\Oqpeaeel.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\Okjbimal.exeC:\Windows\system32\Okjbimal.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\Okloomoj.exeC:\Windows\system32\Okloomoj.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\Peddhb32.exeC:\Windows\system32\Peddhb32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\Pegqmbch.exeC:\Windows\system32\Pegqmbch.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\SysWOW64\Panabc32.exeC:\Windows\system32\Panabc32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\SysWOW64\Pgjfdm32.exeC:\Windows\system32\Pgjfdm32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\Pabknbef.exeC:\Windows\system32\Pabknbef.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\Qbddmejf.exeC:\Windows\system32\Qbddmejf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\Qgalelin.exeC:\Windows\system32\Qgalelin.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\Aeemop32.exeC:\Windows\system32\Aeemop32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\Alaaajmb.exeC:\Windows\system32\Alaaajmb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\Abkjnd32.exeC:\Windows\system32\Abkjnd32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\Aaqgop32.exeC:\Windows\system32\Aaqgop32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\Alfkli32.exeC:\Windows\system32\Alfkli32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\Bbbpnc32.exeC:\Windows\system32\Bbbpnc32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\Bhohfj32.exeC:\Windows\system32\Bhohfj32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\Bbgiibja.exeC:\Windows\system32\Bbgiibja.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\Bdhfaj32.exeC:\Windows\system32\Bdhfaj32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\Balfko32.exeC:\Windows\system32\Balfko32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\SysWOW64\Blakhgoo.exeC:\Windows\system32\Blakhgoo.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\Bblcda32.exeC:\Windows\system32\Bblcda32.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\Cdaigi32.exeC:\Windows\system32\Cdaigi32.exe24⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\Ceaealoh.exeC:\Windows\system32\Ceaealoh.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Windows\SysWOW64\Clknnf32.exeC:\Windows\system32\Clknnf32.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Windows\SysWOW64\Cajblmci.exeC:\Windows\system32\Cajblmci.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\Dlpgiebo.exeC:\Windows\system32\Dlpgiebo.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\Doqpkq32.exeC:\Windows\system32\Doqpkq32.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\Dejhgkgm.exeC:\Windows\system32\Dejhgkgm.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\Dhkaif32.exeC:\Windows\system32\Dhkaif32.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\Deanhj32.exeC:\Windows\system32\Deanhj32.exe32⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\Ekngqqol.exeC:\Windows\system32\Ekngqqol.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\SysWOW64\Eaklcj32.exeC:\Windows\system32\Eaklcj32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\Eoollocp.exeC:\Windows\system32\Eoollocp.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\SysWOW64\Ekemap32.exeC:\Windows\system32\Ekemap32.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Windows\SysWOW64\Eekanh32.exeC:\Windows\system32\Eekanh32.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\Eocegn32.exeC:\Windows\system32\Eocegn32.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\Fcanmlea.exeC:\Windows\system32\Fcanmlea.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Windows\SysWOW64\Fljcfa32.exeC:\Windows\system32\Fljcfa32.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\Fcckcl32.exeC:\Windows\system32\Fcckcl32.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\Fkopgn32.exeC:\Windows\system32\Fkopgn32.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\Flnlaahl.exeC:\Windows\system32\Flnlaahl.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\Fffqjfom.exeC:\Windows\system32\Fffqjfom.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\Gfimpfmj.exeC:\Windows\system32\Gfimpfmj.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\Glcelq32.exeC:\Windows\system32\Glcelq32.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Windows\SysWOW64\Glebbpbd.exeC:\Windows\system32\Glebbpbd.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\Gcojoj32.exeC:\Windows\system32\Gcojoj32.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\Gmhogppb.exeC:\Windows\system32\Gmhogppb.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Windows\SysWOW64\Gfpcpefb.exeC:\Windows\system32\Gfpcpefb.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\Gcddjiel.exeC:\Windows\system32\Gcddjiel.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\Gkoinlbg.exeC:\Windows\system32\Gkoinlbg.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\Hdgmga32.exeC:\Windows\system32\Hdgmga32.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Windows\SysWOW64\Hkaedk32.exeC:\Windows\system32\Hkaedk32.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\Hejjmage.exeC:\Windows\system32\Hejjmage.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\Hckjjh32.exeC:\Windows\system32\Hckjjh32.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\Hihbco32.exeC:\Windows\system32\Hihbco32.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\Hmfkin32.exeC:\Windows\system32\Hmfkin32.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\Hfnpacjb.exeC:\Windows\system32\Hfnpacjb.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\Hmhhnmao.exeC:\Windows\system32\Hmhhnmao.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\Iioicn32.exeC:\Windows\system32\Iioicn32.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\Ipiaphop.exeC:\Windows\system32\Ipiaphop.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\Iiaein32.exeC:\Windows\system32\Iiaein32.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Windows\SysWOW64\Ifefbbdj.exeC:\Windows\system32\Ifefbbdj.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\Iciflfcd.exeC:\Windows\system32\Iciflfcd.exe65⤵
- Executes dropped EXE
PID:6100 -
C:\Windows\SysWOW64\Iejcco32.exeC:\Windows\system32\Iejcco32.exe66⤵PID:4600
-
C:\Windows\SysWOW64\Ippgqg32.exeC:\Windows\system32\Ippgqg32.exe67⤵PID:3704
-
C:\Windows\SysWOW64\Ilfhfh32.exeC:\Windows\system32\Ilfhfh32.exe68⤵PID:5792
-
C:\Windows\SysWOW64\Jfllca32.exeC:\Windows\system32\Jfllca32.exe69⤵PID:752
-
C:\Windows\SysWOW64\Jpdqlgdc.exeC:\Windows\system32\Jpdqlgdc.exe70⤵PID:5576
-
C:\Windows\SysWOW64\Jpgmaf32.exeC:\Windows\system32\Jpgmaf32.exe71⤵
- Drops file in System32 directory
PID:4244 -
C:\Windows\SysWOW64\Jmknkk32.exeC:\Windows\system32\Jmknkk32.exe72⤵PID:2732
-
C:\Windows\SysWOW64\Jfcbcp32.exeC:\Windows\system32\Jfcbcp32.exe73⤵
- Modifies registry class
PID:4748 -
C:\Windows\SysWOW64\Jmmjpjpg.exeC:\Windows\system32\Jmmjpjpg.exe74⤵PID:1748
-
C:\Windows\SysWOW64\Jfeoip32.exeC:\Windows\system32\Jfeoip32.exe75⤵PID:1384
-
C:\Windows\SysWOW64\Kpncbemh.exeC:\Windows\system32\Kpncbemh.exe76⤵PID:704
-
C:\Windows\SysWOW64\Kmbdkj32.exeC:\Windows\system32\Kmbdkj32.exe77⤵
- System Location Discovery: System Language Discovery
PID:6024 -
C:\Windows\SysWOW64\Kfjhdobb.exeC:\Windows\system32\Kfjhdobb.exe78⤵PID:2360
-
C:\Windows\SysWOW64\Kfmejopp.exeC:\Windows\system32\Kfmejopp.exe79⤵PID:4432
-
C:\Windows\SysWOW64\Kdqecc32.exeC:\Windows\system32\Kdqecc32.exe80⤵PID:4668
-
C:\Windows\SysWOW64\Kimnlj32.exeC:\Windows\system32\Kimnlj32.exe81⤵PID:3548
-
C:\Windows\SysWOW64\Kdcbic32.exeC:\Windows\system32\Kdcbic32.exe82⤵PID:1868
-
C:\Windows\SysWOW64\Libggiik.exeC:\Windows\system32\Libggiik.exe83⤵PID:3208
-
C:\Windows\SysWOW64\Ldgkdbia.exeC:\Windows\system32\Ldgkdbia.exe84⤵
- Modifies registry class
PID:5784 -
C:\Windows\SysWOW64\Lfhdem32.exeC:\Windows\system32\Lfhdem32.exe85⤵PID:4664
-
C:\Windows\SysWOW64\Lpqioclc.exeC:\Windows\system32\Lpqioclc.exe86⤵PID:3532
-
C:\Windows\SysWOW64\Lgmnqmam.exeC:\Windows\system32\Lgmnqmam.exe87⤵PID:5952
-
C:\Windows\SysWOW64\Mebkbi32.exeC:\Windows\system32\Mebkbi32.exe88⤵PID:1060
-
C:\Windows\SysWOW64\Mphoob32.exeC:\Windows\system32\Mphoob32.exe89⤵
- System Location Discovery: System Language Discovery
PID:3332 -
C:\Windows\SysWOW64\Mgagll32.exeC:\Windows\system32\Mgagll32.exe90⤵
- System Location Discovery: System Language Discovery
PID:2568 -
C:\Windows\SysWOW64\Mlnpdc32.exeC:\Windows\system32\Mlnpdc32.exe91⤵PID:5848
-
C:\Windows\SysWOW64\Mgddal32.exeC:\Windows\system32\Mgddal32.exe92⤵PID:3336
-
C:\Windows\SysWOW64\Mgfqgkib.exeC:\Windows\system32\Mgfqgkib.exe93⤵PID:5948
-
C:\Windows\SysWOW64\Mlciobhj.exeC:\Windows\system32\Mlciobhj.exe94⤵
- Drops file in System32 directory
PID:3860 -
C:\Windows\SysWOW64\Meknhh32.exeC:\Windows\system32\Meknhh32.exe95⤵PID:464
-
C:\Windows\SysWOW64\Npabeq32.exeC:\Windows\system32\Npabeq32.exe96⤵PID:5904
-
C:\Windows\SysWOW64\Niifnf32.exeC:\Windows\system32\Niifnf32.exe97⤵PID:4992
-
C:\Windows\SysWOW64\Npcokpln.exeC:\Windows\system32\Npcokpln.exe98⤵PID:1736
-
C:\Windows\SysWOW64\Nepgcgje.exeC:\Windows\system32\Nepgcgje.exe99⤵
- Modifies registry class
PID:5144 -
C:\Windows\SysWOW64\Nljopa32.exeC:\Windows\system32\Nljopa32.exe100⤵PID:5836
-
C:\Windows\SysWOW64\Ncdgmkio.exeC:\Windows\system32\Ncdgmkio.exe101⤵PID:1900
-
C:\Windows\SysWOW64\Nnjljd32.exeC:\Windows\system32\Nnjljd32.exe102⤵PID:3688
-
C:\Windows\SysWOW64\Ngbpbjoe.exeC:\Windows\system32\Ngbpbjoe.exe103⤵
- Drops file in System32 directory
PID:4140 -
C:\Windows\SysWOW64\Nloikqnl.exeC:\Windows\system32\Nloikqnl.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2388 -
C:\Windows\SysWOW64\Nciahk32.exeC:\Windows\system32\Nciahk32.exe105⤵PID:6108
-
C:\Windows\SysWOW64\Ojcidelf.exeC:\Windows\system32\Ojcidelf.exe106⤵PID:4912
-
C:\Windows\SysWOW64\Odhman32.exeC:\Windows\system32\Odhman32.exe107⤵PID:5400
-
C:\Windows\SysWOW64\Ofijifbj.exeC:\Windows\system32\Ofijifbj.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4872 -
C:\Windows\SysWOW64\Olcbfp32.exeC:\Windows\system32\Olcbfp32.exe109⤵PID:4280
-
C:\Windows\SysWOW64\Ogifci32.exeC:\Windows\system32\Ogifci32.exe110⤵
- Modifies registry class
PID:2012 -
C:\Windows\SysWOW64\Oqakln32.exeC:\Windows\system32\Oqakln32.exe111⤵PID:2308
-
C:\Windows\SysWOW64\Ojjoedfn.exeC:\Windows\system32\Ojjoedfn.exe112⤵PID:3276
-
C:\Windows\SysWOW64\Odocbmfd.exeC:\Windows\system32\Odocbmfd.exe113⤵
- Modifies registry class
PID:4112 -
C:\Windows\SysWOW64\Omjhgoco.exeC:\Windows\system32\Omjhgoco.exe114⤵PID:4256
-
C:\Windows\SysWOW64\Pfcmpdjp.exeC:\Windows\system32\Pfcmpdjp.exe115⤵PID:2760
-
C:\Windows\SysWOW64\Pmmelo32.exeC:\Windows\system32\Pmmelo32.exe116⤵
- System Location Discovery: System Language Discovery
PID:5640 -
C:\Windows\SysWOW64\Pgbijg32.exeC:\Windows\system32\Pgbijg32.exe117⤵PID:2692
-
C:\Windows\SysWOW64\Pmoabn32.exeC:\Windows\system32\Pmoabn32.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5360 -
C:\Windows\SysWOW64\Pcijoh32.exeC:\Windows\system32\Pcijoh32.exe119⤵PID:2432
-
C:\Windows\SysWOW64\Pnonla32.exeC:\Windows\system32\Pnonla32.exe120⤵PID:5308
-
C:\Windows\SysWOW64\Pckfdh32.exeC:\Windows\system32\Pckfdh32.exe121⤵PID:5564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-