Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 14:33
Behavioral task
behavioral1
Sample
2026-07-20_5cf7a3a236c9e073f5d1925864faed23_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_5cf7a3a236c9e073f5d1925864faed23_elex_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-20_5cf7a3a236c9e073f5d1925864faed23_elex_wannacry.exe
- Size 320KB
- Sample260720-rw3mdsfs9v
- SHA256 96c3fdae19f32a81e2772a15d6163ece3a50dc6776d66afe6958b1943a5a4736
- MD5 5cf7a3a236c9e073f5d1925864faed23
- SHA1 a595fdea63ad230cd310aaf2e33664646f2ff49c
- SHA512 56d6a5af7435e96be78a9d40b77b920421669898fdbebd2da4c0dfb10e778a0fc663b4173745d91cb6a3e502d1299d801fa56b03253e7e3f6ce6a6310c3aab8b
- SSDEEP 3072:mi3so5O2eCU1L5HwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:mi3so01L5HV/Ah1G/AcQ///NR5fn
- TLSH T10164DB19263409EACEED2BB5AC129DE85181F9F014F1E27E6523DFDCC8E4DA2D814F91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhhiocdg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dklhmlac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lljdkn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qmbepfoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aaflag32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ccbanfko.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phaabm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nomcig32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcboan32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jdnnjane.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lchfch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fknimh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gonnhf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjchjl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmpqof32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idoknmfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hpiemj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qanhkk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cggifn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmjole32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dnbadlnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mofmhhcl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njgqaohd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Adqghpbp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajanmqbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ochjmd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eaddcnad.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjffngap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fkihgb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hhiacb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jdddjq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Plbmhadm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnbadlnj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbbpgh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jookdcie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lfgiii32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jncobabm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kifodcej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lmmoekem.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jbgdelpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pceglamm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhfacp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nhnlelfm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ajeami32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dibmfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Coldbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhcdnq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgpgplej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Inbpbnlg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qqcjnell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ccinggcj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ecpmod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jebfgl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ocbhjjqn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pkqdhnom.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gbpenpdp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iejqeiif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jbagkkgj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdmmlf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Chlffghn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eecpaeoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pdhklgnf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpkkhc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilfehcnp.exe - Executes dropped EXE 64 IoCs
pid Process 1116 Adbiojfo.exe 5600 Aqijdk32.exe 932 Ajanmqbc.exe 4992 Anadho32.exe 3480 Ajhdmplk.exe 4828 Badipiae.exe 5916 Bgckgcem.exe 1436 Beglqgcf.exe 3588 Bfhhho32.exe 2640 Bmbpeiaa.exe 5660 Cfkenogb.exe 2464 Celelf32.exe 2376 Cjindm32.exe 3696 Cabfagee.exe 5348 Cfonin32.exe 1780 Caebfg32.exe 1228 Cfakon32.exe 5004 Cagolf32.exe 2792 Cfdhdn32.exe 4976 Dmnpah32.exe 2072 Dhcdnq32.exe 3676 Dmpmfg32.exe 3180 Dhfacp32.exe 2996 Daneme32.exe 2068 Dfknem32.exe 3228 Delnbdao.exe 820 Dkifkkpf.exe 6120 Deokhc32.exe 1100 Dgpgplej.exe 5000 Eaekmdep.exe 2912 Ehocjo32.exe 3028 Emllbe32.exe 2616 Edfdop32.exe 1704 Emniheha.exe 4680 Edhado32.exe 3420 Ekbiaigk.exe 5820 Eehnnb32.exe 4740 Egijfjmp.exe 5084 Eaonccme.exe 1864 Egkgljkm.exe 2108 Faakickc.exe 4792 Fhkcfmbp.exe 2408 Fnhlndqg.exe 2248 Fhmpkmpm.exe 5516 Foghhg32.exe 3024 Feapdaof.exe 2276 Fknimh32.exe 4328 Fecmjq32.exe 972 Fkqebg32.exe 1060 Fdijkmbl.exe 5180 Gonnhf32.exe 5816 Gehfepio.exe 5504 Gkeonggf.exe 5732 Gaogja32.exe 2816 Ghiogkfp.exe 3288 Gnfhob32.exe 4148 Gdppllld.exe 5744 Gnhdea32.exe 5748 Ghnibj32.exe 4612 Gnkajapa.exe 5332 Hhbbmjne.exe 1424 Holjjd32.exe 1192 Hffbfn32.exe 264 Hkckoe32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Lebfjajb.dll Jikohe32.exe File created C:\Windows\SysWOW64\Nopogdnn.dll Lljdkn32.exe File opened for modification C:\Windows\SysWOW64\Gdppllld.exe Gnfhob32.exe File opened for modification C:\Windows\SysWOW64\Jhlgpp32.exe Jbaocfmo.exe File created C:\Windows\SysWOW64\Afinbdon.exe Akcjel32.exe File created C:\Windows\SysWOW64\Dpfcpcam.exe Doeghk32.exe File opened for modification C:\Windows\SysWOW64\Opnlpdoa.exe Oicccj32.exe File created C:\Windows\SysWOW64\Ekbiaigk.exe Edhado32.exe File opened for modification C:\Windows\SysWOW64\Kelkkpae.exe Kjffngap.exe File created C:\Windows\SysWOW64\Nobdlqnc.exe Nifldj32.exe File created C:\Windows\SysWOW64\Nlhkqngo.exe Nabfcegi.exe File opened for modification C:\Windows\SysWOW64\Adbiojfo.exe 2026-07-20_5cf7a3a236c9e073f5d1925864faed23_elex_wannacry.exe File created C:\Windows\SysWOW64\Piphaf32.exe Pcepdl32.exe File created C:\Windows\SysWOW64\Ocbhjjqn.exe Nnfpbcbf.exe File created C:\Windows\SysWOW64\Efdjqeni.exe Epjadk32.exe File opened for modification C:\Windows\SysWOW64\Paelpcgc.exe Pkkdci32.exe File opened for modification C:\Windows\SysWOW64\Flfjdn32.exe Fbnflihq.exe File opened for modification C:\Windows\SysWOW64\Pnkbdqpo.exe Phajgf32.exe File created C:\Windows\SysWOW64\Jfdppn32.dll Dhdaao32.exe File created C:\Windows\SysWOW64\Ajgehh32.dll Hoadecal.exe File created C:\Windows\SysWOW64\Cfjnch32.exe Cmaikcmf.exe File created C:\Windows\SysWOW64\Bbgehd32.exe Bkmmkj32.exe File opened for modification C:\Windows\SysWOW64\Fikbhiaf.exe Fpbmpc32.exe File created C:\Windows\SysWOW64\Dnphid32.dll Mjahfl32.exe File created C:\Windows\SysWOW64\Nekgkh32.dll Ajanmqbc.exe File created C:\Windows\SysWOW64\Khelah32.dll Dkifkkpf.exe File created C:\Windows\SysWOW64\Mbjnlfnn.exe Miaica32.exe File opened for modification C:\Windows\SysWOW64\Fbbpgh32.exe Fmfgoa32.exe File opened for modification C:\Windows\SysWOW64\Jemfbgiq.exe Jhifib32.exe File created C:\Windows\SysWOW64\Abajnm32.exe Aapnfe32.exe File created C:\Windows\SysWOW64\Fllkjd32.exe Fjjnblhi.exe File created C:\Windows\SysWOW64\Glenpb32.exe Gkdaij32.exe File created C:\Windows\SysWOW64\Dddlfa32.exe Dklhmlac.exe File opened for modification C:\Windows\SysWOW64\Mnnkaa32.exe Miabik32.exe File created C:\Windows\SysWOW64\Hnbaba32.dll Cfigib32.exe File created C:\Windows\SysWOW64\Gepkahmm.dll Eiaobjia.exe File created C:\Windows\SysWOW64\Hienee32.exe Hckeikcl.exe File opened for modification C:\Windows\SysWOW64\Lknocb32.exe Lmmoekem.exe File created C:\Windows\SysWOW64\Chiipg32.exe Cndecn32.exe File created C:\Windows\SysWOW64\Mdcodl32.dll Ncfmhecp.exe File created C:\Windows\SysWOW64\Ccbhhl32.exe Cimckcoe.exe File opened for modification C:\Windows\SysWOW64\Oampdkbj.exe Okbhgq32.exe File opened for modification C:\Windows\SysWOW64\Ajpqhdkl.exe Acfhkj32.exe File opened for modification C:\Windows\SysWOW64\Gfgnnedj.exe Gpnfak32.exe File opened for modification C:\Windows\SysWOW64\Kphkee32.exe Jebfgl32.exe File created C:\Windows\SysWOW64\Iiicin32.dll Dgeegled.exe File created C:\Windows\SysWOW64\Jijaef32.exe Jkfakb32.exe File created C:\Windows\SysWOW64\Nbpiochc.dll Bjlpcbqo.exe File created C:\Windows\SysWOW64\Aggdaq32.dll Hgahnjpk.exe File created C:\Windows\SysWOW64\Mjokpm32.exe Mebchf32.exe File opened for modification C:\Windows\SysWOW64\Ilnbch32.exe Ipgbngfp.exe File created C:\Windows\SysWOW64\Eqkfapoe.exe Ekoniian.exe File created C:\Windows\SysWOW64\Iiehjgnp.exe Inpclnnj.exe File opened for modification C:\Windows\SysWOW64\Fkflbb32.exe Fpagdj32.exe File opened for modification C:\Windows\SysWOW64\Oefpoi32.exe Olnkfd32.exe File created C:\Windows\SysWOW64\Ghfebfje.dll Kjepcqnd.exe File opened for modification C:\Windows\SysWOW64\Emenhcdf.exe Efkfkilj.exe File created C:\Windows\SysWOW64\Gfgnnedj.exe Gpnfak32.exe File created C:\Windows\SysWOW64\Jdnocbgl.dll Dmglmpkn.exe File created C:\Windows\SysWOW64\Lobogqeq.dll Jdddjq32.exe File created C:\Windows\SysWOW64\Emoanbll.exe Enkdjkep.exe File created C:\Windows\SysWOW64\Glndff32.dll Hpgigj32.exe File created C:\Windows\SysWOW64\Eagcfjcn.dll Oicccj32.exe File created C:\Windows\SysWOW64\Hanolipa.dll Efhlan32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 8820 8492 WerFault.exe 885 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qlbfnk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Addabl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hngebq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ildibc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iiqooh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Khmjga32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpmpgfhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chlffghn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hnibhp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Molefh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qqcjnell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnnkaa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pkqdhnom.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Icfediio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjccna32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lcjchd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Clbhkfdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Modgnn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jpegeo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qfepnmjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dffmogji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnjjpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hhoomd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgblhmag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dgqqnjea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bopefnnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hhfenc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjafha32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pfmdbd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nomcig32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpcdji32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmooak32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oeclockl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blbodh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckgnbl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihnbih32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pajekb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Imdlgm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Coldbl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhldlnko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jfpocjfa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfchcijo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkflbb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfngmd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Diafkl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hoaocf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggjqqg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfhhho32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eaonccme.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Khhalafg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bqhlpbjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ecpmod32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hgokikan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mgnldkgj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lchfch32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Feapdaof.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cikgecag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbplgbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lafmce32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfkenogb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghiogkfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihlechfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Licmbccm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aichng32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ccbhhl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccdncaoc.dll" Gngnjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cfldob32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hefneq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqmdhonl.dll" Jiglgl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oanodnip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gejhol32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mledgm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Peaokh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hgdedj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgpjde32.dll" Idoknmfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncldajki.dll" Gldgflba.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Apmhbf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Badipiae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Feapdaof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdcodl32.dll" Ncfmhecp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nmdgbamf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bakobdbb.dll" Apmhbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhekfhho.dll" Gbiomqjh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ahpdnaci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoibfj32.dll" Ponfdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nepmnppf.dll" Eglkhk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dfhjefhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Elbhde32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Glgjfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbhkindf.dll" Hhmmffbg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lhdqhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccmaihoc.dll" Aichng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hkbddo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ahnghafl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acnnof32.dll" Icfediio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ohceqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oqfbihll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Baadbo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Chiipg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efdenq32.dll" Hmpclnof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Llnnfnlc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idailabn.dll" Jhndepbi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gmndjf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gdaomobj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paapjc32.dll" Pahiebeq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nggnjl32.dll" Agdcja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gebbdm32.dll" Lhpepoel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khpbenjh.dll" Opnlpdoa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cjmpeffh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dffmogji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fphneijl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Higjkehf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iehialmj.dll" Lmbhqj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mmdefi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cmdfpbkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Baohmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ilnbch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Haafcf32.dll" Eoepohml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hpkkhc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mjggka32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pmfedhie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bmofkm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Agdcja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eldjpoja.dll" Mlqjlmjp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nhnlelfm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ajeami32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ajpqhdkl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dmjefkap.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1156 wrote to memory of 1116 1156 2026-07-20_5cf7a3a236c9e073f5d1925864faed23_elex_wannacry.exe 89 PID 1116 wrote to memory of 5600 1116 Adbiojfo.exe 90 PID 5600 wrote to memory of 932 5600 Aqijdk32.exe 91 PID 932 wrote to memory of 4992 932 Ajanmqbc.exe 92 PID 4992 wrote to memory of 3480 4992 Anadho32.exe 93 PID 3480 wrote to memory of 4828 3480 Ajhdmplk.exe 94 PID 4828 wrote to memory of 5916 4828 Badipiae.exe 95 PID 5916 wrote to memory of 1436 5916 Bgckgcem.exe 96 PID 1436 wrote to memory of 3588 1436 Beglqgcf.exe 97 PID 3588 wrote to memory of 2640 3588 Bfhhho32.exe 98 PID 2640 wrote to memory of 5660 2640 Bmbpeiaa.exe 99 PID 5660 wrote to memory of 2464 5660 Cfkenogb.exe 100 PID 2464 wrote to memory of 2376 2464 Celelf32.exe 101 PID 2376 wrote to memory of 3696 2376 Cjindm32.exe 102 PID 3696 wrote to memory of 5348 3696 Cabfagee.exe 103 PID 5348 wrote to memory of 1780 5348 Cfonin32.exe 104 PID 1780 wrote to memory of 1228 1780 Caebfg32.exe 105 PID 1228 wrote to memory of 5004 1228 Cfakon32.exe 106 PID 5004 wrote to memory of 2792 5004 Cagolf32.exe 107 PID 2792 wrote to memory of 4976 2792 Cfdhdn32.exe 108 PID 4976 wrote to memory of 2072 4976 Dmnpah32.exe 109 PID 2072 wrote to memory of 3676 2072 Dhcdnq32.exe 110 PID 3676 wrote to memory of 3180 3676 Dmpmfg32.exe 111 PID 3180 wrote to memory of 2996 3180 Dhfacp32.exe 112 PID 2996 wrote to memory of 2068 2996 Daneme32.exe 113 PID 2068 wrote to memory of 3228 2068 Dfknem32.exe 114 PID 3228 wrote to memory of 820 3228 Delnbdao.exe 115 PID 820 wrote to memory of 6120 820 Dkifkkpf.exe 116 PID 6120 wrote to memory of 1100 6120 Deokhc32.exe 117 PID 1100 wrote to memory of 5000 1100 Dgpgplej.exe 118 PID 5000 wrote to memory of 2912 5000 Eaekmdep.exe 119 PID 2912 wrote to memory of 3028 2912 Ehocjo32.exe 120 PID 3028 wrote to memory of 2616 3028 Emllbe32.exe 121 PID 2616 wrote to memory of 1704 2616 Edfdop32.exe 122 PID 1704 wrote to memory of 4680 1704 Emniheha.exe 123 PID 4680 wrote to memory of 3420 4680 Edhado32.exe 124 PID 3420 wrote to memory of 5820 3420 Ekbiaigk.exe 125 PID 5820 wrote to memory of 4740 5820 Eehnnb32.exe 126 PID 4740 wrote to memory of 5084 4740 Egijfjmp.exe 127 PID 5084 wrote to memory of 1864 5084 Eaonccme.exe 128 PID 1864 wrote to memory of 2108 1864 Egkgljkm.exe 129 PID 2108 wrote to memory of 4792 2108 Faakickc.exe 130 PID 4792 wrote to memory of 2408 4792 Fhkcfmbp.exe 131 PID 2408 wrote to memory of 2248 2408 Fnhlndqg.exe 132 PID 2248 wrote to memory of 5516 2248 Fhmpkmpm.exe 133 PID 5516 wrote to memory of 3024 5516 Foghhg32.exe 134 PID 3024 wrote to memory of 2276 3024 Feapdaof.exe 135 PID 2276 wrote to memory of 4328 2276 Fknimh32.exe 136 PID 4328 wrote to memory of 972 4328 Fecmjq32.exe 137 PID 972 wrote to memory of 1060 972 Fkqebg32.exe 138 PID 1060 wrote to memory of 5180 1060 Fdijkmbl.exe 139 PID 5180 wrote to memory of 5816 5180 Gonnhf32.exe 140 PID 5816 wrote to memory of 5504 5816 Gehfepio.exe 141 PID 5504 wrote to memory of 5732 5504 Gkeonggf.exe 142 PID 5732 wrote to memory of 2816 5732 Gaogja32.exe 143 PID 2816 wrote to memory of 3288 2816 Ghiogkfp.exe 144 PID 3288 wrote to memory of 4148 3288 Gnfhob32.exe 145 PID 4148 wrote to memory of 5744 4148 Gdppllld.exe 146 PID 5744 wrote to memory of 5748 5744 Gnhdea32.exe 147 PID 5748 wrote to memory of 4612 5748 Ghnibj32.exe 148 PID 4612 wrote to memory of 5332 4612 Gnkajapa.exe 149 PID 5332 wrote to memory of 1424 5332 Hhbbmjne.exe 150 PID 1424 wrote to memory of 1192 1424 Holjjd32.exe 151 PID 1192 wrote to memory of 264 1192 Hffbfn32.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_5cf7a3a236c9e073f5d1925864faed23_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5cf7a3a236c9e073f5d1925864faed23_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\Adbiojfo.exeC:\Windows\system32\Adbiojfo.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\Aqijdk32.exeC:\Windows\system32\Aqijdk32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\Ajanmqbc.exeC:\Windows\system32\Ajanmqbc.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\Anadho32.exeC:\Windows\system32\Anadho32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\Ajhdmplk.exeC:\Windows\system32\Ajhdmplk.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\Badipiae.exeC:\Windows\system32\Badipiae.exe7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\Bgckgcem.exeC:\Windows\system32\Bgckgcem.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Windows\SysWOW64\Beglqgcf.exeC:\Windows\system32\Beglqgcf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\Bfhhho32.exeC:\Windows\system32\Bfhhho32.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\Bmbpeiaa.exeC:\Windows\system32\Bmbpeiaa.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\Cfkenogb.exeC:\Windows\system32\Cfkenogb.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\Celelf32.exeC:\Windows\system32\Celelf32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\Cjindm32.exeC:\Windows\system32\Cjindm32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\Cabfagee.exeC:\Windows\system32\Cabfagee.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\Cfonin32.exeC:\Windows\system32\Cfonin32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Windows\SysWOW64\Caebfg32.exeC:\Windows\system32\Caebfg32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\Cfakon32.exeC:\Windows\system32\Cfakon32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\Cagolf32.exeC:\Windows\system32\Cagolf32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\Cfdhdn32.exeC:\Windows\system32\Cfdhdn32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\Dmnpah32.exeC:\Windows\system32\Dmnpah32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\Dhcdnq32.exeC:\Windows\system32\Dhcdnq32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\Dmpmfg32.exeC:\Windows\system32\Dmpmfg32.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\Dhfacp32.exeC:\Windows\system32\Dhfacp32.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\Daneme32.exeC:\Windows\system32\Daneme32.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\Dfknem32.exeC:\Windows\system32\Dfknem32.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\Delnbdao.exeC:\Windows\system32\Delnbdao.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\Dkifkkpf.exeC:\Windows\system32\Dkifkkpf.exe28⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\Deokhc32.exeC:\Windows\system32\Deokhc32.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\Dgpgplej.exeC:\Windows\system32\Dgpgplej.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\Eaekmdep.exeC:\Windows\system32\Eaekmdep.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\Ehocjo32.exeC:\Windows\system32\Ehocjo32.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\Emllbe32.exeC:\Windows\system32\Emllbe32.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\Edfdop32.exeC:\Windows\system32\Edfdop32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\Emniheha.exeC:\Windows\system32\Emniheha.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\Edhado32.exeC:\Windows\system32\Edhado32.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\Ekbiaigk.exeC:\Windows\system32\Ekbiaigk.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\Eehnnb32.exeC:\Windows\system32\Eehnnb32.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Windows\SysWOW64\Egijfjmp.exeC:\Windows\system32\Egijfjmp.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\Eaonccme.exeC:\Windows\system32\Eaonccme.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\Egkgljkm.exeC:\Windows\system32\Egkgljkm.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\Faakickc.exeC:\Windows\system32\Faakickc.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\Fhkcfmbp.exeC:\Windows\system32\Fhkcfmbp.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\Fnhlndqg.exeC:\Windows\system32\Fnhlndqg.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\Fhmpkmpm.exeC:\Windows\system32\Fhmpkmpm.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\Foghhg32.exeC:\Windows\system32\Foghhg32.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Windows\SysWOW64\Feapdaof.exeC:\Windows\system32\Feapdaof.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\Fknimh32.exeC:\Windows\system32\Fknimh32.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\Fecmjq32.exeC:\Windows\system32\Fecmjq32.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\Fkqebg32.exeC:\Windows\system32\Fkqebg32.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\Fdijkmbl.exeC:\Windows\system32\Fdijkmbl.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\Gonnhf32.exeC:\Windows\system32\Gonnhf32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Windows\SysWOW64\Gehfepio.exeC:\Windows\system32\Gehfepio.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\Gkeonggf.exeC:\Windows\system32\Gkeonggf.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Windows\SysWOW64\Gaogja32.exeC:\Windows\system32\Gaogja32.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\Ghiogkfp.exeC:\Windows\system32\Ghiogkfp.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\Gnfhob32.exeC:\Windows\system32\Gnfhob32.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\Gdppllld.exeC:\Windows\system32\Gdppllld.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\Gnhdea32.exeC:\Windows\system32\Gnhdea32.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\Ghnibj32.exeC:\Windows\system32\Ghnibj32.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Windows\SysWOW64\Gnkajapa.exeC:\Windows\system32\Gnkajapa.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\Hhbbmjne.exeC:\Windows\system32\Hhbbmjne.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Windows\SysWOW64\Holjjd32.exeC:\Windows\system32\Holjjd32.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\Hffbfn32.exeC:\Windows\system32\Hffbfn32.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\Hkckoe32.exeC:\Windows\system32\Hkckoe32.exe65⤵
- Executes dropped EXE
PID:264 -
C:\Windows\SysWOW64\Hdlphjaf.exeC:\Windows\system32\Hdlphjaf.exe66⤵PID:3612
-
C:\Windows\SysWOW64\Hoadecal.exeC:\Windows\system32\Hoadecal.exe67⤵
- Drops file in System32 directory
PID:5616 -
C:\Windows\SysWOW64\Hocqkc32.exeC:\Windows\system32\Hocqkc32.exe68⤵PID:5528
-
C:\Windows\SysWOW64\Ihlechfj.exeC:\Windows\system32\Ihlechfj.exe69⤵
- System Location Discovery: System Language Discovery
PID:3784 -
C:\Windows\SysWOW64\Ininloda.exeC:\Windows\system32\Ininloda.exe70⤵PID:5020
-
C:\Windows\SysWOW64\Ihnbih32.exeC:\Windows\system32\Ihnbih32.exe71⤵
- System Location Discovery: System Language Discovery
PID:3248 -
C:\Windows\SysWOW64\Iiqooh32.exeC:\Windows\system32\Iiqooh32.exe72⤵
- System Location Discovery: System Language Discovery
PID:1856 -
C:\Windows\SysWOW64\Inmggo32.exeC:\Windows\system32\Inmggo32.exe73⤵PID:2028
-
C:\Windows\SysWOW64\Inpclnnj.exeC:\Windows\system32\Inpclnnj.exe74⤵
- Drops file in System32 directory
PID:3220 -
C:\Windows\SysWOW64\Iiehjgnp.exeC:\Windows\system32\Iiehjgnp.exe75⤵PID:3100
-
C:\Windows\SysWOW64\Inbpbnlg.exeC:\Windows\system32\Inbpbnlg.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1312 -
C:\Windows\SysWOW64\Jkfakb32.exeC:\Windows\system32\Jkfakb32.exe77⤵
- Drops file in System32 directory
PID:6020 -
C:\Windows\SysWOW64\Jijaef32.exeC:\Windows\system32\Jijaef32.exe78⤵PID:3124
-
C:\Windows\SysWOW64\Jodiaqag.exeC:\Windows\system32\Jodiaqag.exe79⤵PID:4584
-
C:\Windows\SysWOW64\Jpffgp32.exeC:\Windows\system32\Jpffgp32.exe80⤵PID:3348
-
C:\Windows\SysWOW64\Jfpocjfa.exeC:\Windows\system32\Jfpocjfa.exe81⤵
- System Location Discovery: System Language Discovery
PID:2988 -
C:\Windows\SysWOW64\Jfbkijdo.exeC:\Windows\system32\Jfbkijdo.exe82⤵PID:1456
-
C:\Windows\SysWOW64\Jlocaabf.exeC:\Windows\system32\Jlocaabf.exe83⤵PID:1348
-
C:\Windows\SysWOW64\Kehhjfif.exeC:\Windows\system32\Kehhjfif.exe84⤵PID:5412
-
C:\Windows\SysWOW64\Klapgq32.exeC:\Windows\system32\Klapgq32.exe85⤵PID:1376
-
C:\Windows\SysWOW64\Khhalafg.exeC:\Windows\system32\Khhalafg.exe86⤵
- System Location Discovery: System Language Discovery
PID:2820 -
C:\Windows\SysWOW64\Kelaef32.exeC:\Windows\system32\Kelaef32.exe87⤵PID:3488
-
C:\Windows\SysWOW64\Kpbfbo32.exeC:\Windows\system32\Kpbfbo32.exe88⤵PID:1936
-
C:\Windows\SysWOW64\Kflnpild.exeC:\Windows\system32\Kflnpild.exe89⤵PID:5408
-
C:\Windows\SysWOW64\Khmjga32.exeC:\Windows\system32\Khmjga32.exe90⤵
- System Location Discovery: System Language Discovery
PID:4760 -
C:\Windows\SysWOW64\Kbbodj32.exeC:\Windows\system32\Kbbodj32.exe91⤵PID:108
-
C:\Windows\SysWOW64\Khpgmqpp.exeC:\Windows\system32\Khpgmqpp.exe92⤵PID:4556
-
C:\Windows\SysWOW64\Knipik32.exeC:\Windows\system32\Knipik32.exe93⤵PID:4620
-
C:\Windows\SysWOW64\Liocgc32.exeC:\Windows\system32\Liocgc32.exe94⤵PID:1400
-
C:\Windows\SysWOW64\Lbghpinc.exeC:\Windows\system32\Lbghpinc.exe95⤵PID:5760
-
C:\Windows\SysWOW64\Lhdqhp32.exeC:\Windows\system32\Lhdqhp32.exe96⤵
- Modifies registry class
PID:240 -
C:\Windows\SysWOW64\Lbjeei32.exeC:\Windows\system32\Lbjeei32.exe97⤵PID:5856
-
C:\Windows\SysWOW64\Licmbccm.exeC:\Windows\system32\Licmbccm.exe98⤵
- System Location Discovery: System Language Discovery
PID:5740 -
C:\Windows\SysWOW64\Lblakh32.exeC:\Windows\system32\Lblakh32.exe99⤵PID:1264
-
C:\Windows\SysWOW64\Lhijcohe.exeC:\Windows\system32\Lhijcohe.exe100⤵PID:2372
-
C:\Windows\SysWOW64\Locbpi32.exeC:\Windows\system32\Locbpi32.exe101⤵PID:5804
-
C:\Windows\SysWOW64\Lemjlcgo.exeC:\Windows\system32\Lemjlcgo.exe102⤵PID:5712
-
C:\Windows\SysWOW64\Lpbojlfd.exeC:\Windows\system32\Lpbojlfd.exe103⤵PID:1124
-
C:\Windows\SysWOW64\Mbqkfhfh.exeC:\Windows\system32\Mbqkfhfh.exe104⤵PID:5752
-
C:\Windows\SysWOW64\Mlipomli.exeC:\Windows\system32\Mlipomli.exe105⤵PID:3408
-
C:\Windows\SysWOW64\Mfoclflo.exeC:\Windows\system32\Mfoclflo.exe106⤵PID:1128
-
C:\Windows\SysWOW64\Mhppcn32.exeC:\Windows\system32\Mhppcn32.exe107⤵PID:4984
-
C:\Windows\SysWOW64\Mfaqafjl.exeC:\Windows\system32\Mfaqafjl.exe108⤵PID:916
-
C:\Windows\SysWOW64\Mhbmin32.exeC:\Windows\system32\Mhbmin32.exe109⤵PID:4464
-
C:\Windows\SysWOW64\Molefh32.exeC:\Windows\system32\Molefh32.exe110⤵
- System Location Discovery: System Language Discovery
PID:5196 -
C:\Windows\SysWOW64\Miaica32.exeC:\Windows\system32\Miaica32.exe111⤵
- Drops file in System32 directory
PID:3040 -
C:\Windows\SysWOW64\Mbjnlfnn.exeC:\Windows\system32\Mbjnlfnn.exe112⤵PID:5780
-
C:\Windows\SysWOW64\Midfiq32.exeC:\Windows\system32\Midfiq32.exe113⤵PID:4428
-
C:\Windows\SysWOW64\Noaoagca.exeC:\Windows\system32\Noaoagca.exe114⤵PID:4892
-
C:\Windows\SysWOW64\Nifcnpch.exeC:\Windows\system32\Nifcnpch.exe115⤵PID:2008
-
C:\Windows\SysWOW64\Nppkkj32.exeC:\Windows\system32\Nppkkj32.exe116⤵PID:5696
-
C:\Windows\SysWOW64\Ngjcgdba.exeC:\Windows\system32\Ngjcgdba.exe117⤵PID:3404
-
C:\Windows\SysWOW64\Nlglpkpi.exeC:\Windows\system32\Nlglpkpi.exe118⤵PID:5432
-
C:\Windows\SysWOW64\Nbadmege.exeC:\Windows\system32\Nbadmege.exe119⤵PID:3356
-
C:\Windows\SysWOW64\Nhnlelfm.exeC:\Windows\system32\Nhnlelfm.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5656 -
C:\Windows\SysWOW64\Ngombd32.exeC:\Windows\system32\Ngombd32.exe121⤵PID:752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-