Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 11:22
Behavioral task
behavioral1
Sample
2026-07-27_68b8c65839af047599426baaf9f1d3c4_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_68b8c65839af047599426baaf9f1d3c4_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-27_68b8c65839af047599426baaf9f1d3c4_elex_wannacry.exe
- Size 320KB
- Sample260727-ngltjs1bpf
- SHA256 e9db0e7d4ee7d9c221f81dba7b1f20684a4b79ae7f08bd70f72d173f8e20ea55
- MD5 68b8c65839af047599426baaf9f1d3c4
- SHA1 205359e89ced53342853b6b518c64b0021684e1a
- SHA512 7a60a70d0377255196ea916f11be3ff14dbb0a0c974e2c5e2322a1921bf8e370b0fcc447ed88170fad17abaa17562b05832b353cb202e31201259637d10ef329
- SSDEEP 3072:4ZO9v0W9wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:4g9R9V/Ah1G/AcQ///NR5fn
- TLSH T15264DA19267409EACEED9BF5BC1649D89181E9F014F1E13E6123DFDCD8E4DAAC809F81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iihilhol.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jemfbgiq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kefiheqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gaqmej32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gkkndp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lnmbjd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mgjicb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gnnjgh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mfnojh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pmnbpm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jnqbmadp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oeclockl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qqamieno.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amodnenk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bjpjoa32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iknmfg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lcggbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nhjbjp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fpejec32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qopbjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hefneq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lnmbjd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cckkmg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofaeffpa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ockdfceh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oakbonkb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppgofcff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pmmleg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aabkldcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pmlmdd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Knaldo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajfejknb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ngombd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jqpfccgo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cjgpoq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jocepc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ombcdo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjkmhblk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iobeno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cabofaaj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdkkjl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hhfplejl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nekgna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Efamkepl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hkpgooim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Igbhpned.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pkbjchio.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iojbid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mfqlph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aagkaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jdkkjl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oeclockl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iahgki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ofgdmo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nemcca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ajnkmjqj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gmqgjl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Halmaiog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jnelha32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hgliie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Akcjel32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdpjeh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eehime32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ffgegh32.exe - Executes dropped EXE 64 IoCs
pid Process 5384 Gkglcfec.exe 1792 Gfaikoad.exe 4424 Hhbbmjne.exe 3188 Hfioln32.exe 1580 Hnddqp32.exe 4676 Hgliie32.exe 3408 Hfmigmgf.exe 3472 Ihnbih32.exe 3528 Inkjao32.exe 5848 Iiqooh32.exe 1184 Ikcdfbmc.exe 4872 Jenedhaa.exe 1884 Jodiaqag.exe 3896 Jeqbjgoo.exe 5228 Jbgoik32.exe 3624 Jbilnkjc.exe 5764 Kfgddi32.exe 4136 Kldmmp32.exe 4836 Kbneij32.exe 2632 Kpbfbo32.exe 1264 Keonke32.exe 5232 Lfqgjh32.exe 2772 Lpilcnoo.exe 3024 Lefdld32.exe 2964 Lpkiim32.exe 3784 Lemjlcgo.exe 5016 Llgcin32.exe 4552 Moglkikl.exe 4512 Mhbmin32.exe 5472 Miaica32.exe 3292 Mehjhbma.exe 3152 Nekgna32.exe 3420 Nppkkj32.exe 2272 Nemcca32.exe 2100 Npbhqj32.exe 1956 Ngombd32.exe 5892 Nedjdp32.exe 5780 Ogcfncjf.exe 3416 Oookbega.exe 1092 Ooaghe32.exe 4992 Ohjlqklp.exe 3492 Oenljoji.exe 4784 Olgdgibf.exe 5000 Ojkepmqp.exe 1736 Pohnhdog.exe 1064 Pebfen32.exe 5488 Pfdbknda.exe 4584 Pomgcc32.exe 3612 Plagmh32.exe 5344 Phhhbi32.exe 4140 Pcmloa32.exe 4116 Qqamieno.exe 248 Qqcjnell.exe 4740 Qfpbfljd.exe 1288 Aqffdejj.exe 964 Ajnkmjqj.exe 3556 Agbkfood.exe 968 Amodnenk.exe 2468 Aifdcgcp.exe 6112 Aopmpq32.exe 2644 Amcmie32.exe 4472 Bmfjodgc.exe 2988 Bgknlmgi.exe 2580 Bgnkamef.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Einmaaqb.exe Djhpqdlj.exe File created C:\Windows\SysWOW64\Aclhkdmp.dll Oeccijoh.exe File created C:\Windows\SysWOW64\Olhgka32.dll Pehekgmp.exe File opened for modification C:\Windows\SysWOW64\Mljmblae.exe Mofmhhcl.exe File created C:\Windows\SysWOW64\Nmcphkik.exe Nfihkq32.exe File created C:\Windows\SysWOW64\Jdhllo32.dll Ncifdlii.exe File created C:\Windows\SysWOW64\Hdajpqof.dll Ilnlhb32.exe File opened for modification C:\Windows\SysWOW64\Oilmckml.exe Ncpejd32.exe File created C:\Windows\SysWOW64\Bhldio32.exe Bcokah32.exe File created C:\Windows\SysWOW64\Iffkfkai.dll Lqndahiq.exe File created C:\Windows\SysWOW64\Fpflqjhe.dll Cfipol32.exe File created C:\Windows\SysWOW64\Ccjdpeki.dll Ooaghe32.exe File opened for modification C:\Windows\SysWOW64\Jnfcbg32.exe Jhijjp32.exe File opened for modification C:\Windows\SysWOW64\Gblbmg32.exe Gicndaep.exe File created C:\Windows\SysWOW64\Ilndon32.dll Lcbfmomc.exe File opened for modification C:\Windows\SysWOW64\Pebfen32.exe Pohnhdog.exe File created C:\Windows\SysWOW64\Plnple32.dll Dhejij32.exe File created C:\Windows\SysWOW64\Fdiijemd.dll Fligjnlo.exe File created C:\Windows\SysWOW64\Dnajjfjo.exe Dqmjqb32.exe File created C:\Windows\SysWOW64\Fbdeba32.exe Fgoadi32.exe File opened for modification C:\Windows\SysWOW64\Capbaacl.exe Cfjnch32.exe File created C:\Windows\SysWOW64\Eopjbfig.dll Bbdhbepl.exe File created C:\Windows\SysWOW64\Hgahnjpk.exe Hmicee32.exe File opened for modification C:\Windows\SysWOW64\Kmhejk32.exe Kcpqafba.exe File opened for modification C:\Windows\SysWOW64\Klceeejl.exe Kfimhkbo.exe File created C:\Windows\SysWOW64\Npfcfghe.dll Dkqahk32.exe File created C:\Windows\SysWOW64\Hjagkoho.dll Kpbfbo32.exe File created C:\Windows\SysWOW64\Fihfgc32.dll Olbdacbp.exe File opened for modification C:\Windows\SysWOW64\Pehekgmp.exe Pkcannmj.exe File created C:\Windows\SysWOW64\Iepepgmo.dll Diccal32.exe File opened for modification C:\Windows\SysWOW64\Kolakkii.exe Kojdflkl.exe File created C:\Windows\SysWOW64\Olgdgibf.exe Oenljoji.exe File created C:\Windows\SysWOW64\Icimgcph.dll Fkpoha32.exe File opened for modification C:\Windows\SysWOW64\Codhgg32.exe Cjgpoq32.exe File created C:\Windows\SysWOW64\Ohkkanbe.exe Oobfhh32.exe File opened for modification C:\Windows\SysWOW64\Bkobfdao.exe Bnkbmp32.exe File opened for modification C:\Windows\SysWOW64\Ffgegh32.exe Eehime32.exe File created C:\Windows\SysWOW64\Mmfkac32.exe Mflbdibj.exe File opened for modification C:\Windows\SysWOW64\Aapeakij.exe Qfkqcb32.exe File created C:\Windows\SysWOW64\Lhbafo32.exe Laiiie32.exe File created C:\Windows\SysWOW64\Cffcilob.exe Ckaolcol.exe File opened for modification C:\Windows\SysWOW64\Cleeafbi.exe Cbpacmbc.exe File created C:\Windows\SysWOW64\Cleeafbi.exe Cbpacmbc.exe File opened for modification C:\Windows\SysWOW64\Ddecpgko.exe Dnkkcmdb.exe File created C:\Windows\SysWOW64\Njaakf32.exe Mokmnm32.exe File opened for modification C:\Windows\SysWOW64\Gkacff32.exe Gpkbaekd.exe File created C:\Windows\SysWOW64\Iihilhol.exe Iobeno32.exe File created C:\Windows\SysWOW64\Fcffcd32.dll Jlphnbfe.exe File created C:\Windows\SysWOW64\Blieeglf.exe Bnhegp32.exe File opened for modification C:\Windows\SysWOW64\Dhnbkfek.exe Cninnnfe.exe File created C:\Windows\SysWOW64\Amegnd32.dll Edplapnf.exe File created C:\Windows\SysWOW64\Jacggh32.exe Jhkbnbhd.exe File created C:\Windows\SysWOW64\Lefdld32.exe Lpilcnoo.exe File created C:\Windows\SysWOW64\Edgbbo32.exe Eojijg32.exe File created C:\Windows\SysWOW64\Mofmhhcl.exe Mhldlnko.exe File created C:\Windows\SysWOW64\Iiqooh32.exe Inkjao32.exe File created C:\Windows\SysWOW64\Bbdhbepl.exe Bhldio32.exe File created C:\Windows\SysWOW64\Lklbnb32.exe Lkjehbaa.exe File opened for modification C:\Windows\SysWOW64\Lqndahiq.exe Lgephccp.exe File opened for modification C:\Windows\SysWOW64\Pdfeandd.exe Pmlmdd32.exe File created C:\Windows\SysWOW64\Kgacaopj.exe Kphkee32.exe File opened for modification C:\Windows\SysWOW64\Njaakf32.exe Mokmnm32.exe File created C:\Windows\SysWOW64\Capbaacl.exe Cfjnch32.exe File opened for modification C:\Windows\SysWOW64\Elpknehe.exe Efccfojn.exe - Program crash 1 IoCs
pid pid_target Process procid_target 12968 12844 WerFault.exe 743 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lkmihi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhjpnibf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efepln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hiomppkc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ednolp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jenedhaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qaalkamf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhkmoifp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mfnojh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Njaakf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmkfjn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfmigmgf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pcmloa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdddjq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Laqhao32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aefjbo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhhiocdg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eojijg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oifpijea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgknlmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mglfibmh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihbdja32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ffjignde.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpcffalc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhjbjp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jikfbkbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hnnlcpcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ogcfncjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odmbkolo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eenfff32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iedjfodg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llmhkd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ipeehhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jocepc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edjgpi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qlggcp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Abmbaf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhgcdjje.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lqjqab32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ombcdo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgjhiibl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hgliie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Giinjg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phajgf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hhdcfe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jlbecadc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pfagcm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aimoqgqg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ooejhn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckclacmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gihpejmo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oookbega.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bmfjodgc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Codhgg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Igdnkhoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnhkklbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjemcm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdccka32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nedjdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pehekgmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mgclja32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pkbjchio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keonke32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlkejgfj.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjagkoho.dll" Kpbfbo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnclpelo.dll" Jnfcbg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cdggoi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mflbdibj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqdlal32.dll" Gohfkemf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Giecojpb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Omjfij32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Efepln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Epndddnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbpmbldi.dll" Jidigfeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjjjkcna.dll" Ppgofcff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lnmbjd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qlggcp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ocdnedkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nhmopp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fihnhc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhojahae.dll" Hlmbadfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ipeehhhb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbhhbn32.dll" Lqfgfclm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cofjljhi.dll" Aabafkgh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbppah32.dll" Bhhiocdg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ekjdnj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qclmmq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qldccjno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Igmqpbab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkamfl32.dll" Llhnpe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcnkokhm.dll" Hhfplejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mjggka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opdadpln.dll" Omjfij32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kjafha32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iiipfnch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mbgjlq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Onnmmipj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eenfff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nacmjf32.dll" Pjhpccnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Amnlfk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpdeha32.dll" Ladpnepb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Olgdgibf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Onnmmipj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Himqjpme.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hlbcgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ofaeffpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lhbafo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knkagdkl.dll" Hfioln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elfggmom.dll" Doanno32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Omkmcpgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgpmalme.dll" Hbldinjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kldmmp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kjhlipla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phblmhjl.dll" Mnhkklbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jodiaqag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hphglf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bckdggcn.dll" Cjjlep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nmbaggce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pmlmdd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gbnobf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ommjipel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifepjhfj.dll" Edbhgokc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olhogh32.dll" Pomgcc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Phhhbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhfinh32.dll" Kjffngap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmggegic.dll" Licfgmpa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Njgqaohd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kjblcj32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1052 wrote to memory of 5384 1052 2026-07-27_68b8c65839af047599426baaf9f1d3c4_elex_wannacry.exe 89 PID 5384 wrote to memory of 1792 5384 Gkglcfec.exe 91 PID 1792 wrote to memory of 4424 1792 Gfaikoad.exe 92 PID 4424 wrote to memory of 3188 4424 Hhbbmjne.exe 93 PID 3188 wrote to memory of 1580 3188 Hfioln32.exe 94 PID 1580 wrote to memory of 4676 1580 Hnddqp32.exe 95 PID 4676 wrote to memory of 3408 4676 Hgliie32.exe 96 PID 3408 wrote to memory of 3472 3408 Hfmigmgf.exe 97 PID 3472 wrote to memory of 3528 3472 Ihnbih32.exe 98 PID 3528 wrote to memory of 5848 3528 Inkjao32.exe 99 PID 5848 wrote to memory of 1184 5848 Iiqooh32.exe 100 PID 1184 wrote to memory of 4872 1184 Ikcdfbmc.exe 101 PID 4872 wrote to memory of 1884 4872 Jenedhaa.exe 102 PID 1884 wrote to memory of 3896 1884 Jodiaqag.exe 103 PID 3896 wrote to memory of 5228 3896 Jeqbjgoo.exe 104 PID 5228 wrote to memory of 3624 5228 Jbgoik32.exe 105 PID 3624 wrote to memory of 5764 3624 Jbilnkjc.exe 106 PID 5764 wrote to memory of 4136 5764 Kfgddi32.exe 107 PID 4136 wrote to memory of 4836 4136 Kldmmp32.exe 108 PID 4836 wrote to memory of 2632 4836 Kbneij32.exe 109 PID 2632 wrote to memory of 1264 2632 Kpbfbo32.exe 110 PID 1264 wrote to memory of 5232 1264 Keonke32.exe 111 PID 5232 wrote to memory of 2772 5232 Lfqgjh32.exe 112 PID 2772 wrote to memory of 3024 2772 Lpilcnoo.exe 113 PID 3024 wrote to memory of 2964 3024 Lefdld32.exe 114 PID 2964 wrote to memory of 3784 2964 Lpkiim32.exe 115 PID 3784 wrote to memory of 5016 3784 Lemjlcgo.exe 116 PID 5016 wrote to memory of 4552 5016 Llgcin32.exe 117 PID 4552 wrote to memory of 4512 4552 Moglkikl.exe 118 PID 4512 wrote to memory of 5472 4512 Mhbmin32.exe 119 PID 5472 wrote to memory of 3292 5472 Miaica32.exe 120 PID 3292 wrote to memory of 3152 3292 Mehjhbma.exe 121 PID 3152 wrote to memory of 3420 3152 Nekgna32.exe 122 PID 3420 wrote to memory of 2272 3420 Nppkkj32.exe 123 PID 2272 wrote to memory of 2100 2272 Nemcca32.exe 124 PID 2100 wrote to memory of 1956 2100 Npbhqj32.exe 125 PID 1956 wrote to memory of 5892 1956 Ngombd32.exe 126 PID 5892 wrote to memory of 5780 5892 Nedjdp32.exe 127 PID 5780 wrote to memory of 3416 5780 Ogcfncjf.exe 128 PID 3416 wrote to memory of 1092 3416 Oookbega.exe 129 PID 1092 wrote to memory of 4992 1092 Ooaghe32.exe 130 PID 4992 wrote to memory of 3492 4992 Ohjlqklp.exe 131 PID 3492 wrote to memory of 4784 3492 Oenljoji.exe 132 PID 4784 wrote to memory of 5000 4784 Olgdgibf.exe 133 PID 5000 wrote to memory of 1736 5000 Ojkepmqp.exe 134 PID 1736 wrote to memory of 1064 1736 Pohnhdog.exe 135 PID 1064 wrote to memory of 5488 1064 Pebfen32.exe 136 PID 5488 wrote to memory of 4584 5488 Pfdbknda.exe 137 PID 4584 wrote to memory of 3612 4584 Pomgcc32.exe 138 PID 3612 wrote to memory of 5344 3612 Plagmh32.exe 139 PID 5344 wrote to memory of 4140 5344 Phhhbi32.exe 140 PID 4140 wrote to memory of 4116 4140 Pcmloa32.exe 141 PID 4116 wrote to memory of 248 4116 Qqamieno.exe 142 PID 248 wrote to memory of 4740 248 Qqcjnell.exe 143 PID 4740 wrote to memory of 1288 4740 Qfpbfljd.exe 144 PID 1288 wrote to memory of 964 1288 Aqffdejj.exe 145 PID 964 wrote to memory of 3556 964 Ajnkmjqj.exe 146 PID 3556 wrote to memory of 968 3556 Agbkfood.exe 147 PID 968 wrote to memory of 2468 968 Amodnenk.exe 148 PID 2468 wrote to memory of 6112 2468 Aifdcgcp.exe 149 PID 6112 wrote to memory of 2644 6112 Aopmpq32.exe 150 PID 2644 wrote to memory of 4472 2644 Amcmie32.exe 151 PID 4472 wrote to memory of 2988 4472 Bmfjodgc.exe 152 PID 2988 wrote to memory of 2580 2988 Bgknlmgi.exe 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_68b8c65839af047599426baaf9f1d3c4_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_68b8c65839af047599426baaf9f1d3c4_elex_wannacry.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\Gkglcfec.exeC:\Windows\system32\Gkglcfec.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\Gfaikoad.exeC:\Windows\system32\Gfaikoad.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\Hhbbmjne.exeC:\Windows\system32\Hhbbmjne.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\Hfioln32.exeC:\Windows\system32\Hfioln32.exe5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\Hnddqp32.exeC:\Windows\system32\Hnddqp32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\Hgliie32.exeC:\Windows\system32\Hgliie32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\Hfmigmgf.exeC:\Windows\system32\Hfmigmgf.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\Ihnbih32.exeC:\Windows\system32\Ihnbih32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\Inkjao32.exeC:\Windows\system32\Inkjao32.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\Iiqooh32.exeC:\Windows\system32\Iiqooh32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Windows\SysWOW64\Ikcdfbmc.exeC:\Windows\system32\Ikcdfbmc.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\Jenedhaa.exeC:\Windows\system32\Jenedhaa.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\Jodiaqag.exeC:\Windows\system32\Jodiaqag.exe14⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\Jeqbjgoo.exeC:\Windows\system32\Jeqbjgoo.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\Jbgoik32.exeC:\Windows\system32\Jbgoik32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Windows\SysWOW64\Jbilnkjc.exeC:\Windows\system32\Jbilnkjc.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\Kfgddi32.exeC:\Windows\system32\Kfgddi32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Windows\SysWOW64\Kldmmp32.exeC:\Windows\system32\Kldmmp32.exe19⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\Kbneij32.exeC:\Windows\system32\Kbneij32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\Kpbfbo32.exeC:\Windows\system32\Kpbfbo32.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\Keonke32.exeC:\Windows\system32\Keonke32.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\Lfqgjh32.exeC:\Windows\system32\Lfqgjh32.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Windows\SysWOW64\Lpilcnoo.exeC:\Windows\system32\Lpilcnoo.exe24⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\Lefdld32.exeC:\Windows\system32\Lefdld32.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\Lpkiim32.exeC:\Windows\system32\Lpkiim32.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\Lemjlcgo.exeC:\Windows\system32\Lemjlcgo.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\Llgcin32.exeC:\Windows\system32\Llgcin32.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\Moglkikl.exeC:\Windows\system32\Moglkikl.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\Mhbmin32.exeC:\Windows\system32\Mhbmin32.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\Miaica32.exeC:\Windows\system32\Miaica32.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\SysWOW64\Mehjhbma.exeC:\Windows\system32\Mehjhbma.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\Nekgna32.exeC:\Windows\system32\Nekgna32.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\Nppkkj32.exeC:\Windows\system32\Nppkkj32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\Nemcca32.exeC:\Windows\system32\Nemcca32.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\Npbhqj32.exeC:\Windows\system32\Npbhqj32.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\Ngombd32.exeC:\Windows\system32\Ngombd32.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\Nedjdp32.exeC:\Windows\system32\Nedjdp32.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Windows\SysWOW64\Ogcfncjf.exeC:\Windows\system32\Ogcfncjf.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\SysWOW64\Oookbega.exeC:\Windows\system32\Oookbega.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\Ooaghe32.exeC:\Windows\system32\Ooaghe32.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\Ohjlqklp.exeC:\Windows\system32\Ohjlqklp.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\Oenljoji.exeC:\Windows\system32\Oenljoji.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\Olgdgibf.exeC:\Windows\system32\Olgdgibf.exe44⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\Ojkepmqp.exeC:\Windows\system32\Ojkepmqp.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\Pohnhdog.exeC:\Windows\system32\Pohnhdog.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\Pebfen32.exeC:\Windows\system32\Pebfen32.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\Pfdbknda.exeC:\Windows\system32\Pfdbknda.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Windows\SysWOW64\Pomgcc32.exeC:\Windows\system32\Pomgcc32.exe49⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\Plagmh32.exeC:\Windows\system32\Plagmh32.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\Phhhbi32.exeC:\Windows\system32\Phhhbi32.exe51⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\SysWOW64\Pcmloa32.exeC:\Windows\system32\Pcmloa32.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\Qqamieno.exeC:\Windows\system32\Qqamieno.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\Qqcjnell.exeC:\Windows\system32\Qqcjnell.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\Qfpbfljd.exeC:\Windows\system32\Qfpbfljd.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\Aqffdejj.exeC:\Windows\system32\Aqffdejj.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\Ajnkmjqj.exeC:\Windows\system32\Ajnkmjqj.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\SysWOW64\Agbkfood.exeC:\Windows\system32\Agbkfood.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\Amodnenk.exeC:\Windows\system32\Amodnenk.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\Aifdcgcp.exeC:\Windows\system32\Aifdcgcp.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\Aopmpq32.exeC:\Windows\system32\Aopmpq32.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Windows\SysWOW64\Amcmie32.exeC:\Windows\system32\Amcmie32.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\Bmfjodgc.exeC:\Windows\system32\Bmfjodgc.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\Bgknlmgi.exeC:\Windows\system32\Bgknlmgi.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\Bgnkamef.exeC:\Windows\system32\Bgnkamef.exe65⤵
- Executes dropped EXE
PID:2580 -
C:\Windows\SysWOW64\Bcdlgnkk.exeC:\Windows\system32\Bcdlgnkk.exe66⤵PID:4820
-
C:\Windows\SysWOW64\Bpkllo32.exeC:\Windows\system32\Bpkllo32.exe67⤵PID:2752
-
C:\Windows\SysWOW64\Bciebm32.exeC:\Windows\system32\Bciebm32.exe68⤵PID:4772
-
C:\Windows\SysWOW64\Cfjnch32.exeC:\Windows\system32\Cfjnch32.exe69⤵
- Drops file in System32 directory
PID:3268 -
C:\Windows\SysWOW64\Capbaacl.exeC:\Windows\system32\Capbaacl.exe70⤵PID:4672
-
C:\Windows\SysWOW64\Cflkihbd.exeC:\Windows\system32\Cflkihbd.exe71⤵PID:2128
-
C:\Windows\SysWOW64\Cabofaaj.exeC:\Windows\system32\Cabofaaj.exe72⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2856 -
C:\Windows\SysWOW64\Ccbhhl32.exeC:\Windows\system32\Ccbhhl32.exe73⤵PID:5864
-
C:\Windows\SysWOW64\Cmklaaek.exeC:\Windows\system32\Cmklaaek.exe74⤵PID:2232
-
C:\Windows\SysWOW64\Dfcqjg32.exeC:\Windows\system32\Dfcqjg32.exe75⤵PID:4648
-
C:\Windows\SysWOW64\Dffmogji.exeC:\Windows\system32\Dffmogji.exe76⤵PID:5656
-
C:\Windows\SysWOW64\Dhejij32.exeC:\Windows\system32\Dhejij32.exe77⤵
- Drops file in System32 directory
PID:6092 -
C:\Windows\SysWOW64\Diffabgj.exeC:\Windows\system32\Diffabgj.exe78⤵PID:1988
-
C:\Windows\SysWOW64\Djfckenm.exeC:\Windows\system32\Djfckenm.exe79⤵PID:3844
-
C:\Windows\SysWOW64\Djhpqdlj.exeC:\Windows\system32\Djhpqdlj.exe80⤵
- Drops file in System32 directory
PID:4216 -
C:\Windows\SysWOW64\Einmaaqb.exeC:\Windows\system32\Einmaaqb.exe81⤵PID:4908
-
C:\Windows\SysWOW64\Efamkepl.exeC:\Windows\system32\Efamkepl.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1980 -
C:\Windows\SysWOW64\Ehaieh32.exeC:\Windows\system32\Ehaieh32.exe83⤵PID:4232
-
C:\Windows\SysWOW64\Eplnijdj.exeC:\Windows\system32\Eplnijdj.exe84⤵PID:5688
-
C:\Windows\SysWOW64\Empococc.exeC:\Windows\system32\Empococc.exe85⤵PID:2968
-
C:\Windows\SysWOW64\Edjgpi32.exeC:\Windows\system32\Edjgpi32.exe86⤵
- System Location Discovery: System Language Discovery
PID:5044 -
C:\Windows\SysWOW64\Ffkpadga.exeC:\Windows\system32\Ffkpadga.exe87⤵PID:1332
-
C:\Windows\SysWOW64\Fdopkhfk.exeC:\Windows\system32\Fdopkhfk.exe88⤵PID:4548
-
C:\Windows\SysWOW64\Fmgecn32.exeC:\Windows\system32\Fmgecn32.exe89⤵PID:5060
-
C:\Windows\SysWOW64\Fgpilc32.exeC:\Windows\system32\Fgpilc32.exe90⤵PID:3552
-
C:\Windows\SysWOW64\Fdcjfg32.exeC:\Windows\system32\Fdcjfg32.exe91⤵PID:3616
-
C:\Windows\SysWOW64\Fmlnomif.exeC:\Windows\system32\Fmlnomif.exe92⤵PID:6064
-
C:\Windows\SysWOW64\Fkpoha32.exeC:\Windows\system32\Fkpoha32.exe93⤵
- Drops file in System32 directory
PID:5988 -
C:\Windows\SysWOW64\Gdhcagnp.exeC:\Windows\system32\Gdhcagnp.exe94⤵PID:2652
-
C:\Windows\SysWOW64\Gmqgjl32.exeC:\Windows\system32\Gmqgjl32.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4344 -
C:\Windows\SysWOW64\Gdjpff32.exeC:\Windows\system32\Gdjpff32.exe96⤵PID:2844
-
C:\Windows\SysWOW64\Gighom32.exeC:\Windows\system32\Gighom32.exe97⤵PID:2008
-
C:\Windows\SysWOW64\Ghhhmebd.exeC:\Windows\system32\Ghhhmebd.exe98⤵PID:6120
-
C:\Windows\SysWOW64\Gaqmej32.exeC:\Windows\system32\Gaqmej32.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:824 -
C:\Windows\SysWOW64\Gkianp32.exeC:\Windows\system32\Gkianp32.exe100⤵PID:1476
-
C:\Windows\SysWOW64\Gpfjfg32.exeC:\Windows\system32\Gpfjfg32.exe101⤵PID:5856
-
C:\Windows\SysWOW64\Gkkndp32.exeC:\Windows\system32\Gkkndp32.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2664 -
C:\Windows\SysWOW64\Hphglf32.exeC:\Windows\system32\Hphglf32.exe103⤵
- Modifies registry class
PID:1428 -
C:\Windows\SysWOW64\Hgboiq32.exeC:\Windows\system32\Hgboiq32.exe104⤵PID:5336
-
C:\Windows\SysWOW64\Hpkcafjg.exeC:\Windows\system32\Hpkcafjg.exe105⤵PID:3724
-
C:\Windows\SysWOW64\Hkpgooim.exeC:\Windows\system32\Hkpgooim.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1732 -
C:\Windows\SysWOW64\Hpmpgfhd.exeC:\Windows\system32\Hpmpgfhd.exe107⤵PID:3712
-
C:\Windows\SysWOW64\Hkbddo32.exeC:\Windows\system32\Hkbddo32.exe108⤵PID:1080
-
C:\Windows\SysWOW64\Halmaiog.exeC:\Windows\system32\Halmaiog.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2332 -
C:\Windows\SysWOW64\Hkeajn32.exeC:\Windows\system32\Hkeajn32.exe110⤵PID:3312
-
C:\Windows\SysWOW64\Hhiacb32.exeC:\Windows\system32\Hhiacb32.exe111⤵PID:3832
-
C:\Windows\SysWOW64\Inejlibi.exeC:\Windows\system32\Inejlibi.exe112⤵PID:1896
-
C:\Windows\SysWOW64\Ihknibbo.exeC:\Windows\system32\Ihknibbo.exe113⤵PID:1924
-
C:\Windows\SysWOW64\Ijlkqj32.exeC:\Windows\system32\Ijlkqj32.exe114⤵PID:3440
-
C:\Windows\SysWOW64\Ihnkobpl.exeC:\Windows\system32\Ihnkobpl.exe115⤵PID:4320
-
C:\Windows\SysWOW64\Injcginc.exeC:\Windows\system32\Injcginc.exe116⤵PID:628
-
C:\Windows\SysWOW64\Igbhpned.exeC:\Windows\system32\Igbhpned.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5408 -
C:\Windows\SysWOW64\Ibhlmgdj.exeC:\Windows\system32\Ibhlmgdj.exe118⤵PID:5652
-
C:\Windows\SysWOW64\Ihbdja32.exeC:\Windows\system32\Ihbdja32.exe119⤵
- System Location Discovery: System Language Discovery
PID:1392 -
C:\Windows\SysWOW64\Inombh32.exeC:\Windows\system32\Inombh32.exe120⤵PID:5616
-
C:\Windows\SysWOW64\Ihdaoajd.exeC:\Windows\system32\Ihdaoajd.exe121⤵PID:4744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-