Analysis
- max time kernel
34s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 01:02
Behavioral task
behavioral1
Sample
2026-07-28_6a62dbeb17548a98e1691487e13b6e0a_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_6a62dbeb17548a98e1691487e13b6e0a_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-28_6a62dbeb17548a98e1691487e13b6e0a_elex_wannacry.exe
- Size 320KB
- Sample260729-bdwhcsszbs
- SHA256 9297dcb4cf52717fba5a8294372a0a6504aec52310bd4167ae5059d61594233b
- MD5 6a62dbeb17548a98e1691487e13b6e0a
- SHA1 ebbb15163e8bd9724758999fb0440e06d7a0066d
- SHA512 3b960890aa38e0babb004ac96e90c100458924799068f78913dbf2c4ee92810485287b766a3982eb558581d86c19bb2e210ac44a4984c0b23a507ad24b5cb762
- SSDEEP 3072:pfUkEqwkvBREPwB0WwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:pfUjqLPEPwBlV/Ah1G/AcQ///NR5fn
- TLSH T18F642019263009EACEED2FB5EC525AD89141E8F014F1E53E6123DFECD8E4DA6D825F81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckfpai32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epdaneff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hmlpkd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ojdnbj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bkeppeii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bddjijia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Goediekj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgfdfbhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Agbkfood.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhjcdimf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ohkbldfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pkqdhnom.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odjeepna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ahpmckpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Efamkepl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Inombh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akffjkme.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glgjfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Napjnfik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aahblp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Clplff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hfcnicjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kimgad32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pckpja32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Alqjiohm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjgghc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mjkbemll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmnglh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qhigbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iohede32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjjnkkjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cioifm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fdnipbbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gpnmka32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gihgoq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgflmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nlihek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bmmppc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dannbogl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhgfoioi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipflcnln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jmplbk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jcdjka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Komhfa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nbadmege.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oemephgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bmjlpnpb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dmqdmd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kgdpgo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nboggf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkmbbajb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fkmbbajb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bbgehd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnmdfknm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkllghoq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pkcannmj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bbpoge32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahpmckpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fnegqjne.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knpeii32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbigapjb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Naejcl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkhcpkkb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hlqmla32.exe - Executes dropped EXE 64 IoCs
pid Process 2868 Ekbiaigk.exe 3264 Eopbghnb.exe 1332 Feocoaai.exe 4232 Fkllghoq.exe 2312 Feapdaof.exe 2600 Fknimh32.exe 4416 Fdfmfmdo.exe 3248 Fnoboc32.exe 732 Fggfghap.exe 5984 Gnaodbhl.exe 240 Gdkgam32.exe 1008 Goqkne32.exe 5664 Gdncfl32.exe 4576 Gochceml.exe 4272 Gdppllld.exe 6068 Goediekj.exe 4380 Gfomfo32.exe 5440 Gohaod32.exe 3928 Hkobdeok.exe 2976 Hfdfanoa.exe 3152 Hnokeqll.exe 4932 Hdicbkci.exe 4756 Hnagkp32.exe 1076 Hhglhi32.exe 3748 Hfklamii.exe 2524 Hocqkc32.exe 832 Hfmigmgf.exe 2816 Iofmpb32.exe 1484 Idbfhiko.exe 5800 Iohjebkd.exe 6012 Iiqooh32.exe 4072 Ifdohl32.exe 6016 Igfkpd32.exe 4964 Ibkpmm32.exe 1280 Ighhed32.exe 5356 Inbpbnlg.exe 5324 Jelioh32.exe 5332 Jkfakb32.exe 3528 Jfkehk32.exe 4128 Jgmapcqe.exe 5732 Jbbfnlpk.exe 1720 Jilnjf32.exe 5948 Jecoog32.exe 4688 Jkmgladi.exe 5336 Jbgoik32.exe 5760 Jgdhab32.exe 1764 Jbilnkjc.exe 5780 Kgfdfbhj.exe 1016 Knpmcl32.exe 4288 Kejepfgd.exe 4888 Kppimogj.exe 6080 Kfiajinf.exe 4204 Klfjbpmn.exe 2452 Kflnpild.exe 5824 Khmjga32.exe 5972 Kbbodj32.exe 6116 Kimgad32.exe 4744 Knipik32.exe 244 Lechfeoi.exe 2872 Llmpco32.exe 3012 Lbghpinc.exe 3016 Liaqlcep.exe 2340 Lpkiim32.exe 2620 Lfeaegdi.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Gelfap32.dll Fipkch32.exe File created C:\Windows\SysWOW64\Anobaa32.exe Akqfef32.exe File opened for modification C:\Windows\SysWOW64\Mjkipdpg.exe Mijlhl32.exe File created C:\Windows\SysWOW64\Didmclli.dll Nkieab32.exe File created C:\Windows\SysWOW64\Eelbhc32.dll Pamikh32.exe File opened for modification C:\Windows\SysWOW64\Amcmie32.exe Ackiqpce.exe File created C:\Windows\SysWOW64\Ecbjdcml.exe Elkbcf32.exe File created C:\Windows\SysWOW64\Mmdefi32.exe Lkchoaif.exe File opened for modification C:\Windows\SysWOW64\Akniofoa.exe Ahpmckpn.exe File created C:\Windows\SysWOW64\Fnipliip.exe Flkdpnjl.exe File created C:\Windows\SysWOW64\Hqpnmlqd.dll Pckpja32.exe File opened for modification C:\Windows\SysWOW64\Ahnghafl.exe Aepklffh.exe File created C:\Windows\SysWOW64\Jjoibadl.exe Jcdafg32.exe File created C:\Windows\SysWOW64\Ljcldo32.exe Lcjchd32.exe File created C:\Windows\SysWOW64\Filicodb.exe Fhjlkg32.exe File created C:\Windows\SysWOW64\Jbmehf32.exe Ikcmklih.exe File created C:\Windows\SysWOW64\Fkcimclb.dll Jnqbmadp.exe File opened for modification C:\Windows\SysWOW64\Oeloebcb.exe Omegdebp.exe File created C:\Windows\SysWOW64\Abjllocj.dll Hjhaeklb.exe File opened for modification C:\Windows\SysWOW64\Piphaf32.exe Pojccmii.exe File created C:\Windows\SysWOW64\Nnmdfknm.exe Mlohjpoi.exe File created C:\Windows\SysWOW64\Fechhcal.exe Fnipliip.exe File created C:\Windows\SysWOW64\Hiajeoip.exe Hfcnicjl.exe File opened for modification C:\Windows\SysWOW64\Jilnjf32.exe Jbbfnlpk.exe File created C:\Windows\SysWOW64\Akamol32.exe Ajpqhdkl.exe File created C:\Windows\SysWOW64\Bkoiqjdj.exe Bhqmdoef.exe File created C:\Windows\SysWOW64\Ncdqoekn.dll Ojdnbj32.exe File created C:\Windows\SysWOW64\Jflkmqpj.dll Nalpbf32.exe File created C:\Windows\SysWOW64\Omldnfkj.exe Ojmhaklf.exe File created C:\Windows\SysWOW64\Jfhphdmq.dll Bdndik32.exe File created C:\Windows\SysWOW64\Fmfgoa32.exe Feoomd32.exe File created C:\Windows\SysWOW64\Afoqbkld.dll Fbomfokl.exe File opened for modification C:\Windows\SysWOW64\Lmkbpk32.exe Ljmfdp32.exe File created C:\Windows\SysWOW64\Ojigbcoh.dll Boeelcmm.exe File opened for modification C:\Windows\SysWOW64\Kgflmo32.exe Koodka32.exe File created C:\Windows\SysWOW64\Fagjolao.exe Fkmbbajb.exe File opened for modification C:\Windows\SysWOW64\Nlbkjf32.exe Niconj32.exe File created C:\Windows\SysWOW64\Okedmp32.exe Oidhehcl.exe File created C:\Windows\SysWOW64\Ajndbd32.exe Aaflag32.exe File opened for modification C:\Windows\SysWOW64\Hoaocf32.exe Hmpclnof.exe File opened for modification C:\Windows\SysWOW64\Jghpkq32.exe Jpnhof32.exe File created C:\Windows\SysWOW64\Fkflbb32.exe Fdlcehhn.exe File opened for modification C:\Windows\SysWOW64\Fhablf32.exe Fagjolao.exe File opened for modification C:\Windows\SysWOW64\Dannbogl.exe Dfhjefhf.exe File opened for modification C:\Windows\SysWOW64\Ljdboe32.exe Licfgmpa.exe File created C:\Windows\SysWOW64\Mhlefg32.dll Mbedag32.exe File created C:\Windows\SysWOW64\Hknnckao.dll Dkbomgde.exe File opened for modification C:\Windows\SysWOW64\Kejepfgd.exe Knpmcl32.exe File created C:\Windows\SysWOW64\Mfcmge32.exe Mpiejkql.exe File opened for modification C:\Windows\SysWOW64\Dfcqjg32.exe Cpihmmdo.exe File created C:\Windows\SysWOW64\Didjkbim.exe Dgcmdj32.exe File created C:\Windows\SysWOW64\Naaqhlmg.exe Njghkb32.exe File opened for modification C:\Windows\SysWOW64\Akoqjl32.exe Ajndbd32.exe File created C:\Windows\SysWOW64\Lclpmdhd.exe Lmbhqj32.exe File created C:\Windows\SysWOW64\Pgihppgo.exe Phhhbi32.exe File opened for modification C:\Windows\SysWOW64\Hajpli32.exe Hkpgooim.exe File created C:\Windows\SysWOW64\Acedfl32.dll Ljfodd32.exe File opened for modification C:\Windows\SysWOW64\Bcahgh32.exe Bkjpek32.exe File created C:\Windows\SysWOW64\Kkgicccd.exe Kdmqfi32.exe File opened for modification C:\Windows\SysWOW64\Akqfef32.exe Adfnhlfa.exe File opened for modification C:\Windows\SysWOW64\Gppcfk32.exe Gmafjp32.exe File created C:\Windows\SysWOW64\Amcmie32.exe Ackiqpce.exe File created C:\Windows\SysWOW64\Jibapflb.dll Hdhlhd32.exe File created C:\Windows\SysWOW64\Pibdff32.exe Pchljlpo.exe - Program crash 1 IoCs
pid pid_target Process procid_target 16564 1932 WerFault.exe 990 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpdckm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edqdij32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lebalokn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Niconj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Omldnfkj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phaabm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnqflhcg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iepako32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgmjfpco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jqbbicel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cooolhin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmfhelke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjnbhkqp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pojccmii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ccpdhfmb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfefeq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qlbfnk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnipliip.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gihgoq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qfpbfljd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Plbmhadm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gflhie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phqbaj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Plagmh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhgfoioi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gngnjk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Okpkaqmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pknqhh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chlffghn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gppcfk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdfmfmdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cipppc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjlmmbfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmjqjqao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ilnbch32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fknimh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjhjli32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pacfdila.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bkjpek32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkdhcqcj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mijlhl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nklbfaae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oefpoi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfgjcb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbmigm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Enigek32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gfgnnedj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgmapcqe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgpilc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjmokmji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odjeepna.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eeqclfaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbnobf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lemjlcgo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nedjdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Agpoqoaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnjjpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ffaogm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gifadggi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlfnkoia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dkfanqmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfdfanoa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Embkhn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Idieob32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Imieblgl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Licfgmpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggmjpdaf.dll" Piphaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acpnih32.dll" Efoiko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fdnipbbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ekbiaigk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjjile32.dll" Hnokeqll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adonmkao.dll" Oampdkbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klmomihj.dll" Dmakgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ljcldo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Palbpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibenomhb.dll" Mecjbl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jbbfnlpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gdkgam32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jbgoik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Knpmcl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fdlcehhn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhcalb32.dll" Nhmejf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gbofmmmj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lbghpinc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dobkgc32.dll" Fmiaimki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhhkhqeo.dll" Cmflkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Meepne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obnhjf32.dll" Naecieef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldakbepc.dll" Oldjlm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Deliaf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gflhie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngcjqemf.dll" Jggjpgmc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmdcnq32.dll" Cleeafbi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fieacc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhbllc32.dll" Gnaodbhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdfoblfp.dll" Opcqgh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbmpcffh.dll" Daiegp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hjhaeklb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qhlkbaho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccoolcnf.dll" Innfgb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dodeamcl.dll" Hiajeoip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Galcjkmj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Maealn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pndggkbm.dll" Gbcohl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cocamaam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dpnbhl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ljfodd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdcbqcjc.dll" Jljbogaf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hkpgooim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mijlhl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkagaa32.dll" Oblmnmjl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Djnfppqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Glbjpmdd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ipplmh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Acilkp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcggpcmm.dll" Lbkkpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fimhcbkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apjmealg.dll" Eplnijdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppagmd32.dll" Laqhao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gccbgclj.dll" Phpkgc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdimglke.dll" Pkqdhnom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkealmio.dll" Giaaoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdommbij.dll" Hhiacb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhlkkb32.dll" Jdhndlno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ojmhaklf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kppimogj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jqihjbod.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bhldio32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4828 wrote to memory of 2868 4828 2026-07-28_6a62dbeb17548a98e1691487e13b6e0a_elex_wannacry.exe 90 PID 2868 wrote to memory of 3264 2868 Ekbiaigk.exe 91 PID 3264 wrote to memory of 1332 3264 Eopbghnb.exe 92 PID 1332 wrote to memory of 4232 1332 Feocoaai.exe 93 PID 4232 wrote to memory of 2312 4232 Fkllghoq.exe 94 PID 2312 wrote to memory of 2600 2312 Feapdaof.exe 95 PID 2600 wrote to memory of 4416 2600 Fknimh32.exe 96 PID 4416 wrote to memory of 3248 4416 Fdfmfmdo.exe 97 PID 3248 wrote to memory of 732 3248 Fnoboc32.exe 98 PID 732 wrote to memory of 5984 732 Fggfghap.exe 99 PID 5984 wrote to memory of 240 5984 Gnaodbhl.exe 100 PID 240 wrote to memory of 1008 240 Gdkgam32.exe 101 PID 1008 wrote to memory of 5664 1008 Goqkne32.exe 102 PID 5664 wrote to memory of 4576 5664 Gdncfl32.exe 103 PID 4576 wrote to memory of 4272 4576 Gochceml.exe 104 PID 4272 wrote to memory of 6068 4272 Gdppllld.exe 105 PID 6068 wrote to memory of 4380 6068 Goediekj.exe 106 PID 4380 wrote to memory of 5440 4380 Gfomfo32.exe 107 PID 5440 wrote to memory of 3928 5440 Gohaod32.exe 108 PID 3928 wrote to memory of 2976 3928 Hkobdeok.exe 109 PID 2976 wrote to memory of 3152 2976 Hfdfanoa.exe 110 PID 3152 wrote to memory of 4932 3152 Hnokeqll.exe 111 PID 4932 wrote to memory of 4756 4932 Hdicbkci.exe 112 PID 4756 wrote to memory of 1076 4756 Hnagkp32.exe 113 PID 1076 wrote to memory of 3748 1076 Hhglhi32.exe 114 PID 3748 wrote to memory of 2524 3748 Hfklamii.exe 115 PID 2524 wrote to memory of 832 2524 Hocqkc32.exe 116 PID 832 wrote to memory of 2816 832 Hfmigmgf.exe 117 PID 2816 wrote to memory of 1484 2816 Iofmpb32.exe 118 PID 1484 wrote to memory of 5800 1484 Idbfhiko.exe 119 PID 5800 wrote to memory of 6012 5800 Iohjebkd.exe 120 PID 6012 wrote to memory of 4072 6012 Iiqooh32.exe 121 PID 4072 wrote to memory of 6016 4072 Ifdohl32.exe 122 PID 6016 wrote to memory of 4964 6016 Igfkpd32.exe 123 PID 4964 wrote to memory of 1280 4964 Ibkpmm32.exe 124 PID 1280 wrote to memory of 5356 1280 Ighhed32.exe 125 PID 5356 wrote to memory of 5324 5356 Inbpbnlg.exe 126 PID 5324 wrote to memory of 5332 5324 Jelioh32.exe 127 PID 5332 wrote to memory of 3528 5332 Jkfakb32.exe 128 PID 3528 wrote to memory of 4128 3528 Jfkehk32.exe 129 PID 4128 wrote to memory of 5732 4128 Jgmapcqe.exe 130 PID 5732 wrote to memory of 1720 5732 Jbbfnlpk.exe 131 PID 1720 wrote to memory of 5948 1720 Jilnjf32.exe 132 PID 5948 wrote to memory of 4688 5948 Jecoog32.exe 133 PID 4688 wrote to memory of 5336 4688 Jkmgladi.exe 134 PID 5336 wrote to memory of 5760 5336 Jbgoik32.exe 135 PID 5760 wrote to memory of 1764 5760 Jgdhab32.exe 136 PID 1764 wrote to memory of 5780 1764 Jbilnkjc.exe 137 PID 5780 wrote to memory of 1016 5780 Kgfdfbhj.exe 138 PID 1016 wrote to memory of 4288 1016 Knpmcl32.exe 139 PID 4288 wrote to memory of 4888 4288 Kejepfgd.exe 140 PID 4888 wrote to memory of 6080 4888 Kppimogj.exe 141 PID 6080 wrote to memory of 4204 6080 Kfiajinf.exe 142 PID 4204 wrote to memory of 2452 4204 Klfjbpmn.exe 143 PID 2452 wrote to memory of 5824 2452 Kflnpild.exe 144 PID 5824 wrote to memory of 5972 5824 Khmjga32.exe 145 PID 5972 wrote to memory of 6116 5972 Kbbodj32.exe 146 PID 6116 wrote to memory of 4744 6116 Kimgad32.exe 147 PID 4744 wrote to memory of 244 4744 Knipik32.exe 148 PID 244 wrote to memory of 2872 244 Lechfeoi.exe 149 PID 2872 wrote to memory of 3012 2872 Llmpco32.exe 150 PID 3012 wrote to memory of 3016 3012 Lbghpinc.exe 151 PID 3016 wrote to memory of 2340 3016 Liaqlcep.exe 152 PID 2340 wrote to memory of 2620 2340 Lpkiim32.exe 153
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_6a62dbeb17548a98e1691487e13b6e0a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_6a62dbeb17548a98e1691487e13b6e0a_elex_wannacry.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\Ekbiaigk.exeC:\Windows\system32\Ekbiaigk.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\Eopbghnb.exeC:\Windows\system32\Eopbghnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\Feocoaai.exeC:\Windows\system32\Feocoaai.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\Fkllghoq.exeC:\Windows\system32\Fkllghoq.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\Feapdaof.exeC:\Windows\system32\Feapdaof.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\Fknimh32.exeC:\Windows\system32\Fknimh32.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\Fdfmfmdo.exeC:\Windows\system32\Fdfmfmdo.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\Fnoboc32.exeC:\Windows\system32\Fnoboc32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\Fggfghap.exeC:\Windows\system32\Fggfghap.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\Gnaodbhl.exeC:\Windows\system32\Gnaodbhl.exe11⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Windows\SysWOW64\Gdkgam32.exeC:\Windows\system32\Gdkgam32.exe12⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\Goqkne32.exeC:\Windows\system32\Goqkne32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\Gdncfl32.exeC:\Windows\system32\Gdncfl32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\SysWOW64\Gochceml.exeC:\Windows\system32\Gochceml.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\Gdppllld.exeC:\Windows\system32\Gdppllld.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\Goediekj.exeC:\Windows\system32\Goediekj.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Windows\SysWOW64\Gfomfo32.exeC:\Windows\system32\Gfomfo32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\Gohaod32.exeC:\Windows\system32\Gohaod32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Windows\SysWOW64\Hkobdeok.exeC:\Windows\system32\Hkobdeok.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\Hfdfanoa.exeC:\Windows\system32\Hfdfanoa.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\Hnokeqll.exeC:\Windows\system32\Hnokeqll.exe22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\Hdicbkci.exeC:\Windows\system32\Hdicbkci.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\Hnagkp32.exeC:\Windows\system32\Hnagkp32.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\Hhglhi32.exeC:\Windows\system32\Hhglhi32.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\Hfklamii.exeC:\Windows\system32\Hfklamii.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\Hocqkc32.exeC:\Windows\system32\Hocqkc32.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\Hfmigmgf.exeC:\Windows\system32\Hfmigmgf.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\Iofmpb32.exeC:\Windows\system32\Iofmpb32.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\Idbfhiko.exeC:\Windows\system32\Idbfhiko.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\Iohjebkd.exeC:\Windows\system32\Iohjebkd.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\Iiqooh32.exeC:\Windows\system32\Iiqooh32.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\Ifdohl32.exeC:\Windows\system32\Ifdohl32.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\Igfkpd32.exeC:\Windows\system32\Igfkpd32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\SysWOW64\Ibkpmm32.exeC:\Windows\system32\Ibkpmm32.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\Ighhed32.exeC:\Windows\system32\Ighhed32.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\Inbpbnlg.exeC:\Windows\system32\Inbpbnlg.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Windows\SysWOW64\Jelioh32.exeC:\Windows\system32\Jelioh32.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Windows\SysWOW64\Jkfakb32.exeC:\Windows\system32\Jkfakb32.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Windows\SysWOW64\Jfkehk32.exeC:\Windows\system32\Jfkehk32.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\Jgmapcqe.exeC:\Windows\system32\Jgmapcqe.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\Jbbfnlpk.exeC:\Windows\system32\Jbbfnlpk.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\Jilnjf32.exeC:\Windows\system32\Jilnjf32.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\Jecoog32.exeC:\Windows\system32\Jecoog32.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\SysWOW64\Jkmgladi.exeC:\Windows\system32\Jkmgladi.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\Jbgoik32.exeC:\Windows\system32\Jbgoik32.exe46⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\Jgdhab32.exeC:\Windows\system32\Jgdhab32.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\Jbilnkjc.exeC:\Windows\system32\Jbilnkjc.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\Kgfdfbhj.exeC:\Windows\system32\Kgfdfbhj.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\SysWOW64\Knpmcl32.exeC:\Windows\system32\Knpmcl32.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\Kejepfgd.exeC:\Windows\system32\Kejepfgd.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\Kppimogj.exeC:\Windows\system32\Kppimogj.exe52⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\Kfiajinf.exeC:\Windows\system32\Kfiajinf.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Windows\SysWOW64\Klfjbpmn.exeC:\Windows\system32\Klfjbpmn.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\Kflnpild.exeC:\Windows\system32\Kflnpild.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\Khmjga32.exeC:\Windows\system32\Khmjga32.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\Kbbodj32.exeC:\Windows\system32\Kbbodj32.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\Kimgad32.exeC:\Windows\system32\Kimgad32.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Windows\SysWOW64\Knipik32.exeC:\Windows\system32\Knipik32.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\Lechfeoi.exeC:\Windows\system32\Lechfeoi.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\SysWOW64\Llmpco32.exeC:\Windows\system32\Llmpco32.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\Lbghpinc.exeC:\Windows\system32\Lbghpinc.exe62⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\Liaqlcep.exeC:\Windows\system32\Liaqlcep.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\Lpkiim32.exeC:\Windows\system32\Lpkiim32.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\Lfeaegdi.exeC:\Windows\system32\Lfeaegdi.exe65⤵
- Executes dropped EXE
PID:2620 -
C:\Windows\SysWOW64\Lhfmmp32.exeC:\Windows\system32\Lhfmmp32.exe66⤵PID:572
-
C:\Windows\SysWOW64\Loqejjad.exeC:\Windows\system32\Loqejjad.exe67⤵PID:4564
-
C:\Windows\SysWOW64\Lifjgb32.exeC:\Windows\system32\Lifjgb32.exe68⤵PID:1916
-
C:\Windows\SysWOW64\Locbpi32.exeC:\Windows\system32\Locbpi32.exe69⤵PID:1980
-
C:\Windows\SysWOW64\Lemjlcgo.exeC:\Windows\system32\Lemjlcgo.exe70⤵
- System Location Discovery: System Language Discovery
PID:5832 -
C:\Windows\SysWOW64\Llgcin32.exeC:\Windows\system32\Llgcin32.exe71⤵PID:2792
-
C:\Windows\SysWOW64\Mbqkfhfh.exeC:\Windows\system32\Mbqkfhfh.exe72⤵PID:2812
-
C:\Windows\SysWOW64\Mikcbb32.exeC:\Windows\system32\Mikcbb32.exe73⤵PID:3100
-
C:\Windows\SysWOW64\Mbchkg32.exeC:\Windows\system32\Mbchkg32.exe74⤵PID:1548
-
C:\Windows\SysWOW64\Mhppcn32.exeC:\Windows\system32\Mhppcn32.exe75⤵PID:5956
-
C:\Windows\SysWOW64\Mbedag32.exeC:\Windows\system32\Mbedag32.exe76⤵
- Drops file in System32 directory
PID:928 -
C:\Windows\SysWOW64\Miomnaip.exeC:\Windows\system32\Miomnaip.exe77⤵PID:1196
-
C:\Windows\SysWOW64\Mpiejkql.exeC:\Windows\system32\Mpiejkql.exe78⤵
- Drops file in System32 directory
PID:6136 -
C:\Windows\SysWOW64\Mfcmge32.exeC:\Windows\system32\Mfcmge32.exe79⤵PID:3608
-
C:\Windows\SysWOW64\Mhdjonng.exeC:\Windows\system32\Mhdjonng.exe80⤵PID:4172
-
C:\Windows\SysWOW64\Mfejme32.exeC:\Windows\system32\Mfejme32.exe81⤵PID:5172
-
C:\Windows\SysWOW64\Mlbbel32.exeC:\Windows\system32\Mlbbel32.exe82⤵PID:1924
-
C:\Windows\SysWOW64\Noaoagca.exeC:\Windows\system32\Noaoagca.exe83⤵PID:3192
-
C:\Windows\SysWOW64\Nhicjm32.exeC:\Windows\system32\Nhicjm32.exe84⤵PID:2900
-
C:\Windows\SysWOW64\Nboggf32.exeC:\Windows\system32\Nboggf32.exe85⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5660 -
C:\Windows\SysWOW64\Nhlpom32.exeC:\Windows\system32\Nhlpom32.exe86⤵PID:2684
-
C:\Windows\SysWOW64\Nbadmege.exeC:\Windows\system32\Nbadmege.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1796 -
C:\Windows\SysWOW64\Nlihek32.exeC:\Windows\system32\Nlihek32.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5004 -
C:\Windows\SysWOW64\Ngombd32.exeC:\Windows\system32\Ngombd32.exe89⤵PID:2644
-
C:\Windows\SysWOW64\Nhpijldj.exeC:\Windows\system32\Nhpijldj.exe90⤵PID:5880
-
C:\Windows\SysWOW64\Nojagf32.exeC:\Windows\system32\Nojagf32.exe91⤵PID:4208
-
C:\Windows\SysWOW64\Nedjdp32.exeC:\Windows\system32\Nedjdp32.exe92⤵
- System Location Discovery: System Language Discovery
PID:3300 -
C:\Windows\SysWOW64\Oomnmfid.exeC:\Windows\system32\Oomnmfid.exe93⤵PID:3164
-
C:\Windows\SysWOW64\Oeffip32.exeC:\Windows\system32\Oeffip32.exe94⤵PID:4960
-
C:\Windows\SysWOW64\Oplkgi32.exeC:\Windows\system32\Oplkgi32.exe95⤵PID:5772
-
C:\Windows\SysWOW64\Ogfccchd.exeC:\Windows\system32\Ogfccchd.exe96⤵PID:4768
-
C:\Windows\SysWOW64\Olcklj32.exeC:\Windows\system32\Olcklj32.exe97⤵PID:1560
-
C:\Windows\SysWOW64\Ocmchdmh.exeC:\Windows\system32\Ocmchdmh.exe98⤵PID:1224
-
C:\Windows\SysWOW64\Oiglen32.exeC:\Windows\system32\Oiglen32.exe99⤵PID:704
-
C:\Windows\SysWOW64\Oocdme32.exeC:\Windows\system32\Oocdme32.exe100⤵PID:4292
-
C:\Windows\SysWOW64\Oenljoji.exeC:\Windows\system32\Oenljoji.exe101⤵PID:4612
-
C:\Windows\SysWOW64\Opcqgh32.exeC:\Windows\system32\Opcqgh32.exe102⤵
- Modifies registry class
PID:1204 -
C:\Windows\SysWOW64\Ojkepmqp.exeC:\Windows\system32\Ojkepmqp.exe103⤵PID:6172
-
C:\Windows\SysWOW64\Pohnhdog.exeC:\Windows\system32\Pohnhdog.exe104⤵PID:6256
-
C:\Windows\SysWOW64\Phqbaj32.exeC:\Windows\system32\Phqbaj32.exe105⤵
- System Location Discovery: System Language Discovery
PID:6296 -
C:\Windows\SysWOW64\Pgaboa32.exeC:\Windows\system32\Pgaboa32.exe106⤵PID:6336
-
C:\Windows\SysWOW64\Ppjghgdg.exeC:\Windows\system32\Ppjghgdg.exe107⤵PID:6376
-
C:\Windows\SysWOW64\Pfgopnbo.exeC:\Windows\system32\Pfgopnbo.exe108⤵PID:6416
-
C:\Windows\SysWOW64\Plagmh32.exeC:\Windows\system32\Plagmh32.exe109⤵
- System Location Discovery: System Language Discovery
PID:6456 -
C:\Windows\SysWOW64\Pckpja32.exeC:\Windows\system32\Pckpja32.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:6496 -
C:\Windows\SysWOW64\Phhhbi32.exeC:\Windows\system32\Phhhbi32.exe111⤵
- Drops file in System32 directory
PID:6540 -
C:\Windows\SysWOW64\Pgihppgo.exeC:\Windows\system32\Pgihppgo.exe112⤵PID:6580
-
C:\Windows\SysWOW64\Qhjegh32.exeC:\Windows\system32\Qhjegh32.exe113⤵PID:6620
-
C:\Windows\SysWOW64\Qodmdb32.exeC:\Windows\system32\Qodmdb32.exe114⤵PID:6660
-
C:\Windows\SysWOW64\Qjiaak32.exeC:\Windows\system32\Qjiaak32.exe115⤵PID:6704
-
C:\Windows\SysWOW64\Qofjjb32.exeC:\Windows\system32\Qofjjb32.exe116⤵PID:6744
-
C:\Windows\SysWOW64\Qfpbfljd.exeC:\Windows\system32\Qfpbfljd.exe117⤵
- System Location Discovery: System Language Discovery
PID:6784 -
C:\Windows\SysWOW64\Aqffdejj.exeC:\Windows\system32\Aqffdejj.exe118⤵PID:6824
-
C:\Windows\SysWOW64\Agpoqoaf.exeC:\Windows\system32\Agpoqoaf.exe119⤵
- System Location Discovery: System Language Discovery
PID:6864 -
C:\Windows\SysWOW64\Aqhcid32.exeC:\Windows\system32\Aqhcid32.exe120⤵PID:6904
-
C:\Windows\SysWOW64\Agbkfood.exeC:\Windows\system32\Agbkfood.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-