Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 14:34
Behavioral task
behavioral1
Sample
2026-07-20_54c33d21a232b2646da6b4405c5444b8_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_54c33d21a232b2646da6b4405c5444b8_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-20_54c33d21a232b2646da6b4405c5444b8_elex_wannacry.exe
- Size 320KB
- Sample260720-rxyd3aft21
- SHA256 769b9f9dce93a897117e78c410d21b1b404499011492f52a34dec3f4f9a41e44
- MD5 54c33d21a232b2646da6b4405c5444b8
- SHA1 557b7d96038e2b262b6dba9d23477270a0b32ff0
- SHA512 fb10a2a0db166fdb847345870a7aabe1e8186312bd0d03f3528e3827b69328c8494393ededbcbea75783da5ee29cabb416f5fd53c90838658c2d459170f18103
- SSDEEP 3072:QKjgDMU9OjX1xQDXF2oSwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:QKjmMU98gJSV/Ah1G/AcQ///NR5fn
- TLSH T11964301A163009EACDED1FB5AC124AE99181EAF054F1F13E6127DFDCD8E4DA6C806F91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hfgjad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bglefdke.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfcompnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ehifpm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nipedokm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Plhcglil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Joahjcgb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eplgod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Knaldo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njploeoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oncopcqj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Baickimp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kbiede32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ajbmmcii.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Clmjcfdb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hfgjad32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogkcihgj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Anadho32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Miabik32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gfpcpefb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Andqnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jjmcghjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Noijmp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmjefkap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hkbmjhdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Adfnhlfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Domdcpib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ahmlaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hhbkccji.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmkgdgej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dfglpjqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hpnohinj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pploli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kpncbemh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Djcfee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hchickeo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oejbpb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilepmjdo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onklkhnn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pnakaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jgdhab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cmipkb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igedenca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ljmfdp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmgcidqm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qkegiggl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldleoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mmlphfed.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oggjni32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfgopnbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Acclejeb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lqndahiq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fiodib32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lqmmgb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmlmlo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bbifobho.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Inpclnnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ohjlqklp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Acclejeb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lcejmeol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mepfbflb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnfiapfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bdfilkbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Acgfpf32.exe - Executes dropped EXE 64 IoCs
pid Process 1316 Jkaadebl.exe 1108 Jdjfmjhm.exe 3976 Kpccgk32.exe 3472 Kkkdjcjb.exe 2432 Kmlmlo32.exe 3476 Lcifde32.exe 2908 Lgfojd32.exe 1064 Ldjodh32.exe 4084 Laqlclga.exe 4472 Lacihleo.exe 1932 Mddbjg32.exe 5464 Mknjgajl.exe 1160 Mahbck32.exe 1144 Mjednmla.exe 3512 Mpoljg32.exe 5316 Nneiikqe.exe 1308 Nacboi32.exe 5520 Ncgkma32.exe 2884 Ncihbaie.exe 572 Njcpok32.exe 4756 Oqmhlego.exe 1840 Ojhijjll.exe 5004 Okgfdm32.exe 5740 Oqgkadod.exe 3404 Ogqcon32.exe 3624 Onklkhnn.exe 5332 Pegqmbch.exe 5212 Pkcepl32.exe 1076 Peljha32.exe 5928 Pkebekgo.exe 3172 Qepccqlm.exe 5732 Aeemop32.exe 4284 Ahffqk32.exe 2684 Aejfjocb.exe 4516 Anbkbe32.exe 2896 Ahjoljqc.exe 4744 Ahmlaj32.exe 5124 Bngdndfn.exe 1148 Bhohfj32.exe 2680 Bbemdb32.exe 4364 Bdfilkbb.exe 4332 Bbgiibja.exe 4840 Bbifobho.exe 1328 Bjdkcd32.exe 5472 Bejoqm32.exe 2952 Cbnpja32.exe 1624 Coepob32.exe 4464 Cliahf32.exe 2504 Caeiam32.exe 5700 Cahffmel.exe 1940 Clmjcfdb.exe 1532 Dhdkig32.exe 1224 Dbjofp32.exe 2212 Dhfhnfhc.exe 5564 Ddmhcg32.exe 4584 Dboiaoff.exe 3588 Dkjmea32.exe 4776 Dogfkpih.exe 4928 Eojcao32.exe 4712 Eolpfo32.exe 1888 Edihof32.exe 5176 Edkddeag.exe 2532 Eekanh32.exe 6032 Eaabci32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Nophma32.dll Aeodapcl.exe File opened for modification C:\Windows\SysWOW64\Gnqflhcg.exe Gicndaep.exe File created C:\Windows\SysWOW64\Pdenghpi.exe Pmkfjn32.exe File created C:\Windows\SysWOW64\Mjbjci32.dll Oopjchnh.exe File opened for modification C:\Windows\SysWOW64\Adhdcepc.exe Aokkknbl.exe File created C:\Windows\SysWOW64\Pnbmmabm.dll Ehifpm32.exe File opened for modification C:\Windows\SysWOW64\Kfiajinf.exe Kppimogj.exe File created C:\Windows\SysWOW64\Kjjinp32.exe Kdmqfi32.exe File created C:\Windows\SysWOW64\Njkiaa32.dll Mabnlh32.exe File created C:\Windows\SysWOW64\Aeaagoaj.exe Aklmjfad.exe File created C:\Windows\SysWOW64\Mmagah32.dll Lqmmgb32.exe File created C:\Windows\SysWOW64\Ndgpii32.dll Onklkhnn.exe File opened for modification C:\Windows\SysWOW64\Bdfilkbb.exe Bbemdb32.exe File created C:\Windows\SysWOW64\Mannco32.dll Bmkjdj32.exe File created C:\Windows\SysWOW64\Fnjhccnd.exe Fgppgi32.exe File opened for modification C:\Windows\SysWOW64\Pcmloa32.exe Plcdbghi.exe File created C:\Windows\SysWOW64\Pkcepl32.exe Pegqmbch.exe File created C:\Windows\SysWOW64\Mdckpqod.exe Mingbhon.exe File created C:\Windows\SysWOW64\Khaahimc.dll Ogifci32.exe File opened for modification C:\Windows\SysWOW64\Nohdaf32.exe Nhnlelfm.exe File opened for modification C:\Windows\SysWOW64\Afelal32.exe Aokceaoa.exe File opened for modification C:\Windows\SysWOW64\Plijbblh.exe Pacfdila.exe File opened for modification C:\Windows\SysWOW64\Ipeehhhb.exe Iikmlnae.exe File opened for modification C:\Windows\SysWOW64\Ncdgmkio.exe Nljopa32.exe File opened for modification C:\Windows\SysWOW64\Iqmincia.exe Igedenca.exe File created C:\Windows\SysWOW64\Eiahhdee.exe Efbllhfb.exe File opened for modification C:\Windows\SysWOW64\Fbellhbi.exe Flkdpnjl.exe File created C:\Windows\SysWOW64\Jgblcinm.dll Njcpok32.exe File created C:\Windows\SysWOW64\Qnhabp32.exe Qcbmegol.exe File opened for modification C:\Windows\SysWOW64\Bnppim32.exe Beglqgcf.exe File opened for modification C:\Windows\SysWOW64\Ceqngekl.exe Cnffjl32.exe File created C:\Windows\SysWOW64\Olcklj32.exe Ocjgcd32.exe File opened for modification C:\Windows\SysWOW64\Fpcdji32.exe Ffkpadga.exe File created C:\Windows\SysWOW64\Nljgfn32.exe Neqoidmo.exe File created C:\Windows\SysWOW64\Gbjegg32.exe Glpmkm32.exe File created C:\Windows\SysWOW64\Baekjn32.dll Heochp32.exe File opened for modification C:\Windows\SysWOW64\Mdhdkp32.exe Mchhamcl.exe File created C:\Windows\SysWOW64\Lemjlcgo.exe Lppbdmig.exe File opened for modification C:\Windows\SysWOW64\Llgcin32.exe Lemjlcgo.exe File opened for modification C:\Windows\SysWOW64\Pjpokm32.exe Pphjbgfj.exe File opened for modification C:\Windows\SysWOW64\Gdjpff32.exe Galcjkmj.exe File opened for modification C:\Windows\SysWOW64\Lcimmn32.exe Lnldeg32.exe File created C:\Windows\SysWOW64\Ibjanpje.dll Aphngglp.exe File created C:\Windows\SysWOW64\Hjokhh32.dll Jmfdpkeo.exe File created C:\Windows\SysWOW64\Hdjemblq.dll Bafnmnjn.exe File created C:\Windows\SysWOW64\Bdamofii.dll Qobhepjf.exe File opened for modification C:\Windows\SysWOW64\Nmbaggce.exe Ngehoqdn.exe File opened for modification C:\Windows\SysWOW64\Jmfdpkeo.exe Jfllca32.exe File opened for modification C:\Windows\SysWOW64\Eecdcckf.exe Egbdekcg.exe File opened for modification C:\Windows\SysWOW64\Alnmdojp.exe Afddge32.exe File created C:\Windows\SysWOW64\Kcmmap32.exe Kgflmo32.exe File created C:\Windows\SysWOW64\Ncmdcq32.dll Eecdcckf.exe File created C:\Windows\SysWOW64\Dannbogl.exe Djcfee32.exe File opened for modification C:\Windows\SysWOW64\Hhiacb32.exe Hncmfj32.exe File opened for modification C:\Windows\SysWOW64\Jcjgeb32.exe Jlqohhja.exe File created C:\Windows\SysWOW64\Jekqgnno.exe Joahjcgb.exe File created C:\Windows\SysWOW64\Fmkgdgej.exe Fbecgned.exe File created C:\Windows\SysWOW64\Ganikk32.dll Dkjmea32.exe File opened for modification C:\Windows\SysWOW64\Nnbeie32.exe Mlciobhj.exe File opened for modification C:\Windows\SysWOW64\Olcbfp32.exe Oggjni32.exe File created C:\Windows\SysWOW64\Ncgjhf32.dll Nemcca32.exe File created C:\Windows\SysWOW64\Jkejalge.exe Jqpfccgo.exe File created C:\Windows\SysWOW64\Miabik32.exe Mbgjlq32.exe File opened for modification C:\Windows\SysWOW64\Alcfoo32.exe Afinbdon.exe - Program crash 1 IoCs
pid pid_target Process procid_target 9296 13604 WerFault.exe 937 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aeodapcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gemkobia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfcnicjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Anbkbe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlciobhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qnhabp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdoiaf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhhlog32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ncgiolkk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bobalm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahjoljqc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cclhbcho.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aihaifam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lkmihi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Agdcja32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hnagkp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kieaqe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhnlelfm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pafcjijo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ejoogm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oldjlm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qalkfl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eaabci32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iiehjgnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmgecn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkpoha32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikkppgld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bdpanj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Joahjcgb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lqcjqcnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pcmloa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Afelal32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jpooimdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mepfbflb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnfgmjfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jlqohhja.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kokkqbog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kcpjgo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mdhdkp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jenedhaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Agdhln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ffkpadga.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hjedpkne.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pakleh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mgibil32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ncdgmkio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cjfaon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oepipo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Igomeb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iibclmkn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjlhpgfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ofcale32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pkebekgo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mfaqafjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nemcca32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qlhnng32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qgmbkp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eaddcnad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnihod32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlohjpoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Clmjcfdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhdkig32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eagahnob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fphneijl.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Innfan32.dll" Fdegkdim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jfbkijdo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Loqejjad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aepklffh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ildnhceg.dll" Qaalkamf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oqfdgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhhljfmp.dll" Efepln32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fjjnblhi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Boqlqd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dklhmlac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcmdjgqg.dll" Kmdqai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mingbhon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmfhigmk.dll" Oggjni32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppickpjh.dll" Dannbogl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dihllkal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Akqfef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bokpfmah.dll" Cdggoi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nacboi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fbnflihq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eolpfo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmqgdhfa.dll" Pmoabn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lafnne32.dll" Jenedhaa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jfbkijdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdhpfleg.dll" Gighom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afigdbde.dll" Kijcanhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lnbkeclf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcgmmogb.dll" Efhlan32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mfaqafjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aihaifam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lkmihi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oondhocf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccnbfi32.dll" Fbajlo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jilbgkab.dll" Ahkdhk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cahffmel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dbjofp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mdckpqod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebjiapag.dll" Cnicpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gamjea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hnagkp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nclbjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjkpio32.dll" Olcbfp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ceqngekl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbnlan32.dll" Iiehjgnp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gpmgph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kniggnim.dll" Jjgcbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mqpqghgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hedaoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ldoadabi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egcfmlqp.dll" Badipiae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qcobjk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nnfgmjfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baekjn32.dll" Heochp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mljficpd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bfcompnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dmnpah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odbblp32.dll" Kflnpild.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iibclmkn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbmpcffh.dll" Dmmifaci.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ohdlke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nljgfn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bphgoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ahffqk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ajoagadf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ininloda.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 1316 2372 2026-07-20_54c33d21a232b2646da6b4405c5444b8_elex_wannacry.exe 89 PID 1316 wrote to memory of 1108 1316 Jkaadebl.exe 90 PID 1108 wrote to memory of 3976 1108 Jdjfmjhm.exe 91 PID 3976 wrote to memory of 3472 3976 Kpccgk32.exe 92 PID 3472 wrote to memory of 2432 3472 Kkkdjcjb.exe 93 PID 2432 wrote to memory of 3476 2432 Kmlmlo32.exe 94 PID 3476 wrote to memory of 2908 3476 Lcifde32.exe 95 PID 2908 wrote to memory of 1064 2908 Lgfojd32.exe 96 PID 1064 wrote to memory of 4084 1064 Ldjodh32.exe 97 PID 4084 wrote to memory of 4472 4084 Laqlclga.exe 98 PID 4472 wrote to memory of 1932 4472 Lacihleo.exe 99 PID 1932 wrote to memory of 5464 1932 Mddbjg32.exe 100 PID 5464 wrote to memory of 1160 5464 Mknjgajl.exe 101 PID 1160 wrote to memory of 1144 1160 Mahbck32.exe 102 PID 1144 wrote to memory of 3512 1144 Mjednmla.exe 103 PID 3512 wrote to memory of 5316 3512 Mpoljg32.exe 104 PID 5316 wrote to memory of 1308 5316 Nneiikqe.exe 105 PID 1308 wrote to memory of 5520 1308 Nacboi32.exe 106 PID 5520 wrote to memory of 2884 5520 Ncgkma32.exe 107 PID 2884 wrote to memory of 572 2884 Ncihbaie.exe 108 PID 572 wrote to memory of 4756 572 Njcpok32.exe 109 PID 4756 wrote to memory of 1840 4756 Oqmhlego.exe 110 PID 1840 wrote to memory of 5004 1840 Ojhijjll.exe 111 PID 5004 wrote to memory of 5740 5004 Okgfdm32.exe 112 PID 5740 wrote to memory of 3404 5740 Oqgkadod.exe 113 PID 3404 wrote to memory of 3624 3404 Ogqcon32.exe 114 PID 3624 wrote to memory of 5332 3624 Onklkhnn.exe 115 PID 5332 wrote to memory of 5212 5332 Pegqmbch.exe 116 PID 5212 wrote to memory of 1076 5212 Pkcepl32.exe 117 PID 1076 wrote to memory of 5928 1076 Peljha32.exe 118 PID 5928 wrote to memory of 3172 5928 Pkebekgo.exe 119 PID 3172 wrote to memory of 5732 3172 Qepccqlm.exe 120 PID 5732 wrote to memory of 4284 5732 Aeemop32.exe 121 PID 4284 wrote to memory of 2684 4284 Ahffqk32.exe 122 PID 2684 wrote to memory of 4516 2684 Aejfjocb.exe 123 PID 4516 wrote to memory of 2896 4516 Anbkbe32.exe 124 PID 2896 wrote to memory of 4744 2896 Ahjoljqc.exe 125 PID 4744 wrote to memory of 5124 4744 Ahmlaj32.exe 126 PID 5124 wrote to memory of 1148 5124 Bngdndfn.exe 127 PID 1148 wrote to memory of 2680 1148 Bhohfj32.exe 128 PID 2680 wrote to memory of 4364 2680 Bbemdb32.exe 129 PID 4364 wrote to memory of 4332 4364 Bdfilkbb.exe 130 PID 4332 wrote to memory of 4840 4332 Bbgiibja.exe 131 PID 4840 wrote to memory of 1328 4840 Bbifobho.exe 132 PID 1328 wrote to memory of 5472 1328 Bjdkcd32.exe 133 PID 5472 wrote to memory of 2952 5472 Bejoqm32.exe 134 PID 2952 wrote to memory of 1624 2952 Cbnpja32.exe 135 PID 1624 wrote to memory of 4464 1624 Coepob32.exe 136 PID 4464 wrote to memory of 2504 4464 Cliahf32.exe 137 PID 2504 wrote to memory of 5700 2504 Caeiam32.exe 138 PID 5700 wrote to memory of 1940 5700 Cahffmel.exe 139 PID 1940 wrote to memory of 1532 1940 Clmjcfdb.exe 140 PID 1532 wrote to memory of 1224 1532 Dhdkig32.exe 141 PID 1224 wrote to memory of 2212 1224 Dbjofp32.exe 142 PID 2212 wrote to memory of 5564 2212 Dhfhnfhc.exe 143 PID 5564 wrote to memory of 4584 5564 Ddmhcg32.exe 144 PID 4584 wrote to memory of 3588 4584 Dboiaoff.exe 145 PID 3588 wrote to memory of 4776 3588 Dkjmea32.exe 146 PID 4776 wrote to memory of 4928 4776 Dogfkpih.exe 147 PID 4928 wrote to memory of 4712 4928 Eojcao32.exe 148 PID 4712 wrote to memory of 1888 4712 Eolpfo32.exe 149 PID 1888 wrote to memory of 5176 1888 Edihof32.exe 150 PID 5176 wrote to memory of 2532 5176 Edkddeag.exe 151 PID 2532 wrote to memory of 6032 2532 Eekanh32.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_54c33d21a232b2646da6b4405c5444b8_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_54c33d21a232b2646da6b4405c5444b8_elex_wannacry.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\Jkaadebl.exeC:\Windows\system32\Jkaadebl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\Jdjfmjhm.exeC:\Windows\system32\Jdjfmjhm.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\Kpccgk32.exeC:\Windows\system32\Kpccgk32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\Kkkdjcjb.exeC:\Windows\system32\Kkkdjcjb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\Kmlmlo32.exeC:\Windows\system32\Kmlmlo32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\Lcifde32.exeC:\Windows\system32\Lcifde32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\Lgfojd32.exeC:\Windows\system32\Lgfojd32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\Ldjodh32.exeC:\Windows\system32\Ldjodh32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\Laqlclga.exeC:\Windows\system32\Laqlclga.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\Lacihleo.exeC:\Windows\system32\Lacihleo.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\Mddbjg32.exeC:\Windows\system32\Mddbjg32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\Mknjgajl.exeC:\Windows\system32\Mknjgajl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\Mahbck32.exeC:\Windows\system32\Mahbck32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\Mjednmla.exeC:\Windows\system32\Mjednmla.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\Mpoljg32.exeC:\Windows\system32\Mpoljg32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\Nneiikqe.exeC:\Windows\system32\Nneiikqe.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Windows\SysWOW64\Nacboi32.exeC:\Windows\system32\Nacboi32.exe18⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\Ncgkma32.exeC:\Windows\system32\Ncgkma32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Windows\SysWOW64\Ncihbaie.exeC:\Windows\system32\Ncihbaie.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\Njcpok32.exeC:\Windows\system32\Njcpok32.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\Oqmhlego.exeC:\Windows\system32\Oqmhlego.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\Ojhijjll.exeC:\Windows\system32\Ojhijjll.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\Okgfdm32.exeC:\Windows\system32\Okgfdm32.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\Oqgkadod.exeC:\Windows\system32\Oqgkadod.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\SysWOW64\Ogqcon32.exeC:\Windows\system32\Ogqcon32.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\Onklkhnn.exeC:\Windows\system32\Onklkhnn.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\Pegqmbch.exeC:\Windows\system32\Pegqmbch.exe28⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Windows\SysWOW64\Pkcepl32.exeC:\Windows\system32\Pkcepl32.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Windows\SysWOW64\Peljha32.exeC:\Windows\system32\Peljha32.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\Pkebekgo.exeC:\Windows\system32\Pkebekgo.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Windows\SysWOW64\Qepccqlm.exeC:\Windows\system32\Qepccqlm.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\Aeemop32.exeC:\Windows\system32\Aeemop32.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\Ahffqk32.exeC:\Windows\system32\Ahffqk32.exe34⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\Aejfjocb.exeC:\Windows\system32\Aejfjocb.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\Anbkbe32.exeC:\Windows\system32\Anbkbe32.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\Ahjoljqc.exeC:\Windows\system32\Ahjoljqc.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\Ahmlaj32.exeC:\Windows\system32\Ahmlaj32.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\Bngdndfn.exeC:\Windows\system32\Bngdndfn.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\SysWOW64\Bhohfj32.exeC:\Windows\system32\Bhohfj32.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\Bbemdb32.exeC:\Windows\system32\Bbemdb32.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\Bdfilkbb.exeC:\Windows\system32\Bdfilkbb.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\Bbgiibja.exeC:\Windows\system32\Bbgiibja.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\Bbifobho.exeC:\Windows\system32\Bbifobho.exe44⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\Bjdkcd32.exeC:\Windows\system32\Bjdkcd32.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\Bejoqm32.exeC:\Windows\system32\Bejoqm32.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\SysWOW64\Cbnpja32.exeC:\Windows\system32\Cbnpja32.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\Coepob32.exeC:\Windows\system32\Coepob32.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\Cliahf32.exeC:\Windows\system32\Cliahf32.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\Caeiam32.exeC:\Windows\system32\Caeiam32.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\Cahffmel.exeC:\Windows\system32\Cahffmel.exe51⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Windows\SysWOW64\Clmjcfdb.exeC:\Windows\system32\Clmjcfdb.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\Dhdkig32.exeC:\Windows\system32\Dhdkig32.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\Dbjofp32.exeC:\Windows\system32\Dbjofp32.exe54⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\Dhfhnfhc.exeC:\Windows\system32\Dhfhnfhc.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\Ddmhcg32.exeC:\Windows\system32\Ddmhcg32.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\Dboiaoff.exeC:\Windows\system32\Dboiaoff.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\Dkjmea32.exeC:\Windows\system32\Dkjmea32.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\Dogfkpih.exeC:\Windows\system32\Dogfkpih.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\Eojcao32.exeC:\Windows\system32\Eojcao32.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\Eolpfo32.exeC:\Windows\system32\Eolpfo32.exe61⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\Edihof32.exeC:\Windows\system32\Edihof32.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\Edkddeag.exeC:\Windows\system32\Edkddeag.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Windows\SysWOW64\Eekanh32.exeC:\Windows\system32\Eekanh32.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\Eaabci32.exeC:\Windows\system32\Eaabci32.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6032 -
C:\Windows\SysWOW64\Fdbked32.exeC:\Windows\system32\Fdbked32.exe66⤵PID:4680
-
C:\Windows\SysWOW64\Fdegkdim.exeC:\Windows\system32\Fdegkdim.exe67⤵
- Modifies registry class
PID:2624 -
C:\Windows\SysWOW64\Fojlhmic.exeC:\Windows\system32\Fojlhmic.exe68⤵PID:5240
-
C:\Windows\SysWOW64\Fomhnmgp.exeC:\Windows\system32\Fomhnmgp.exe69⤵PID:1620
-
C:\Windows\SysWOW64\Fkcibnmd.exeC:\Windows\system32\Fkcibnmd.exe70⤵PID:1120
-
C:\Windows\SysWOW64\Gbmaog32.exeC:\Windows\system32\Gbmaog32.exe71⤵PID:4156
-
C:\Windows\SysWOW64\Gfkjef32.exeC:\Windows\system32\Gfkjef32.exe72⤵PID:2384
-
C:\Windows\SysWOW64\Gfngke32.exeC:\Windows\system32\Gfngke32.exe73⤵PID:1672
-
C:\Windows\SysWOW64\Gfpcpefb.exeC:\Windows\system32\Gfpcpefb.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1592 -
C:\Windows\SysWOW64\Gohhik32.exeC:\Windows\system32\Gohhik32.exe75⤵PID:4312
-
C:\Windows\SysWOW64\Gkoinlbg.exeC:\Windows\system32\Gkoinlbg.exe76⤵PID:3344
-
C:\Windows\SysWOW64\Hdgmga32.exeC:\Windows\system32\Hdgmga32.exe77⤵PID:1872
-
C:\Windows\SysWOW64\Hkaedk32.exeC:\Windows\system32\Hkaedk32.exe78⤵PID:2780
-
C:\Windows\SysWOW64\Hfgjad32.exeC:\Windows\system32\Hfgjad32.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1416 -
C:\Windows\SysWOW64\Hkdbik32.exeC:\Windows\system32\Hkdbik32.exe80⤵PID:4760
-
C:\Windows\SysWOW64\Heochp32.exeC:\Windows\system32\Heochp32.exe81⤵
- Drops file in System32 directory
- Modifies registry class
PID:2676 -
C:\Windows\SysWOW64\Hfnpacjb.exeC:\Windows\system32\Hfnpacjb.exe82⤵PID:5096
-
C:\Windows\SysWOW64\Icbpkg32.exeC:\Windows\system32\Icbpkg32.exe83⤵PID:4892
-
C:\Windows\SysWOW64\Ieeihomg.exeC:\Windows\system32\Ieeihomg.exe84⤵PID:5788
-
C:\Windows\SysWOW64\Ilpaei32.exeC:\Windows\system32\Ilpaei32.exe85⤵PID:1852
-
C:\Windows\SysWOW64\Imonol32.exeC:\Windows\system32\Imonol32.exe86⤵PID:4576
-
C:\Windows\SysWOW64\Ibncmchl.exeC:\Windows\system32\Ibncmchl.exe87⤵PID:5696
-
C:\Windows\SysWOW64\Jfllca32.exeC:\Windows\system32\Jfllca32.exe88⤵
- Drops file in System32 directory
PID:5712 -
C:\Windows\SysWOW64\Jmfdpkeo.exeC:\Windows\system32\Jmfdpkeo.exe89⤵
- Drops file in System32 directory
PID:5036 -
C:\Windows\SysWOW64\Jeaidn32.exeC:\Windows\system32\Jeaidn32.exe90⤵PID:3176
-
C:\Windows\SysWOW64\Jlkaahjg.exeC:\Windows\system32\Jlkaahjg.exe91⤵PID:4176
-
C:\Windows\SysWOW64\Jioajliq.exeC:\Windows\system32\Jioajliq.exe92⤵PID:1272
-
C:\Windows\SysWOW64\Jcefgeif.exeC:\Windows\system32\Jcefgeif.exe93⤵PID:4164
-
C:\Windows\SysWOW64\Jmmjpjpg.exeC:\Windows\system32\Jmmjpjpg.exe94⤵PID:936
-
C:\Windows\SysWOW64\Jcgbmd32.exeC:\Windows\system32\Jcgbmd32.exe95⤵PID:3552
-
C:\Windows\SysWOW64\Jidkek32.exeC:\Windows\system32\Jidkek32.exe96⤵PID:2876
-
C:\Windows\SysWOW64\Kpncbemh.exeC:\Windows\system32\Kpncbemh.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2992 -
C:\Windows\SysWOW64\Kekljlkp.exeC:\Windows\system32\Kekljlkp.exe98⤵PID:1628
-
C:\Windows\SysWOW64\Kdllhdco.exeC:\Windows\system32\Kdllhdco.exe99⤵PID:1068
-
C:\Windows\SysWOW64\Kmdqai32.exeC:\Windows\system32\Kmdqai32.exe100⤵
- Modifies registry class
PID:5404 -
C:\Windows\SysWOW64\Kdnincal.exeC:\Windows\system32\Kdnincal.exe101⤵PID:2464
-
C:\Windows\SysWOW64\Kmfmfigl.exeC:\Windows\system32\Kmfmfigl.exe102⤵PID:5020
-
C:\Windows\SysWOW64\Keabkkdg.exeC:\Windows\system32\Keabkkdg.exe103⤵PID:5532
-
C:\Windows\SysWOW64\Kdcbic32.exeC:\Windows\system32\Kdcbic32.exe104⤵PID:4420
-
C:\Windows\SysWOW64\Kipkaj32.exeC:\Windows\system32\Kipkaj32.exe105⤵PID:4708
-
C:\Windows\SysWOW64\Ldeonbkd.exeC:\Windows\system32\Ldeonbkd.exe106⤵PID:1704
-
C:\Windows\SysWOW64\Libggiik.exeC:\Windows\system32\Libggiik.exe107⤵PID:2768
-
C:\Windows\SysWOW64\Lbjlpo32.exeC:\Windows\system32\Lbjlpo32.exe108⤵PID:5400
-
C:\Windows\SysWOW64\Lmppmh32.exeC:\Windows\system32\Lmppmh32.exe109⤵PID:5876
-
C:\Windows\SysWOW64\Lfhdem32.exeC:\Windows\system32\Lfhdem32.exe110⤵PID:3204
-
C:\Windows\SysWOW64\Ldleoa32.exeC:\Windows\system32\Ldleoa32.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5376 -
C:\Windows\SysWOW64\Ldoadabi.exeC:\Windows\system32\Ldoadabi.exe112⤵
- Modifies registry class
PID:3920 -
C:\Windows\SysWOW64\Mljficpd.exeC:\Windows\system32\Mljficpd.exe113⤵
- Modifies registry class
PID:3440 -
C:\Windows\SysWOW64\Mingbhon.exeC:\Windows\system32\Mingbhon.exe114⤵
- Drops file in System32 directory
- Modifies registry class
PID:5956 -
C:\Windows\SysWOW64\Mdckpqod.exeC:\Windows\system32\Mdckpqod.exe115⤵
- Modifies registry class
PID:904 -
C:\Windows\SysWOW64\Mmlphfed.exeC:\Windows\system32\Mmlphfed.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1988 -
C:\Windows\SysWOW64\Mchhamcl.exeC:\Windows\system32\Mchhamcl.exe117⤵
- Drops file in System32 directory
PID:4388 -
C:\Windows\SysWOW64\Mdhdkp32.exeC:\Windows\system32\Mdhdkp32.exe118⤵
- System Location Discovery: System Language Discovery
PID:3184 -
C:\Windows\SysWOW64\Mlciobhj.exeC:\Windows\system32\Mlciobhj.exe119⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1336 -
C:\Windows\SysWOW64\Nnbeie32.exeC:\Windows\system32\Nnbeie32.exe120⤵PID:4848
-
C:\Windows\SysWOW64\Ngkjbkem.exeC:\Windows\system32\Ngkjbkem.exe121⤵PID:1720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-