Analysis
- max time kernel
148s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 20:50
Behavioral task
behavioral1
Sample
2026-08-10_1c0aac91a9808d069e7d3293ddcdd31c_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_1c0aac91a9808d069e7d3293ddcdd31c_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-10_1c0aac91a9808d069e7d3293ddcdd31c_elex_wannacry.exe
- Size 320KB
- Sample260810-zmp9psyapc
- SHA256 8f6a8c90c6ba8c96fb6a015f2d67b8f30991aeb7668a794de48bb5cca8711efd
- MD5 1c0aac91a9808d069e7d3293ddcdd31c
- SHA1 b5e4278cc8790f2c95913ff6fecf29591656f746
- SHA512 1087501a7705507f27b33027ba20345ce444ff208f13eb94a58cc8c0468ac348cadaee0a5670b25be7d70aeda38fd0a124359fccd1ea0057546b8e3e15175870
- SSDEEP 3072:dY56nRE59GL64NTwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:dqIWzOTV/Ah1G/AcQ///NR5fn
- TLSH T1DD64401A267009EACEED1FB5EC1249D89181E9F414F5E13E6127EFDCD8E4DA2E805F81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpphcf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmicee32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppclej32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpmajdig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Filailgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Maicmgoc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aogije32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mfnojh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ncplekbq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ioebdomd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjokpm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gfcebf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kleajegi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dfcjoa32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jcmkehcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nmenmgab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lqcjqcnp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfjnch32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Baldmiom.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdmfebnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Elnoifjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iiigqdfd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qdldgg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aogbpo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjafha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lgccccec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phajgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hpkkhc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jefpahoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ahbacq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dfjpppbh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Djhifnho.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oanfodmk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phajgf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfnqdale.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Diclff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Enkmpe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fqnbgpmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fihnhc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdmfebnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bcddlhgo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aokkknbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phfjmlhh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ncgiolkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cfjnch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cimckcoe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ffkpadga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ihbdja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kqkeoama.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dfcjoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dkokma32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jcanfakf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkggfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Omegdebp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckphamkp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dafpjf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Biadoeib.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Alqjiohm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldpmlh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkjnop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Njkklk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mfnojh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igbhpned.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phpkgc32.exe - Executes dropped EXE 64 IoCs
pid Process 2928 Ohlifj32.exe 1752 Phqbaj32.exe 2644 Ppjghgdg.exe 5840 Pplcnf32.exe 4808 Qleahgff.exe 1396 Ahakhg32.exe 3664 Acilkp32.exe 5492 Aifdcgcp.exe 1612 Bjgncihp.exe 1668 Bodfkpfg.exe 1924 Bmkcjd32.exe 2668 Biadoeib.exe 5092 Bqkifb32.exe 5500 Cfjnch32.exe 4688 Capbaacl.exe 1316 Cimckcoe.exe 5204 Ccbhhl32.exe 3676 Dfcqjg32.exe 3408 Dmmifaci.exe 3160 Dcgackke.exe 4644 Dclknkfp.exe 4180 Dhjcdimf.exe 5364 Dabhmo32.exe 1884 Efamkepl.exe 6056 Eagahnob.exe 2636 Ejofacfb.exe 4316 Efhcld32.exe 2172 Eangimij.exe 4664 Ffkpadga.exe 2288 Fmehnn32.exe 1840 Fdcjfg32.exe 3140 Fkmbbajb.exe 5768 Fajgekol.exe 4636 Ghdoae32.exe 3496 Gmqgjl32.exe 1204 Gkgeipah.exe 4588 Gpcmagpo.exe 2632 Ghmbhd32.exe 2880 Haefqjeo.exe 4784 Hpkcafjg.exe 3944 Hnodkjhq.exe 4196 Hhdhhchf.exe 5312 Halmaiog.exe 5872 Hpaibe32.exe 2116 Hglaookl.exe 4204 Ikijenab.exe 4264 Idbonc32.exe 3516 Injcginc.exe 1972 Igbhpned.exe 3292 Ihbdja32.exe 4520 Ibjibg32.exe 2108 Jjfngi32.exe 2624 Jhgneqha.exe 2088 Jdnnjane.exe 5372 Jkggfl32.exe 4940 Jqdoob32.exe 4600 Jnhphg32.exe 3588 Jqihjbod.exe 4608 Kqkeoama.exe 1572 Kkaimj32.exe 5804 Keinepch.exe 2104 Kjhccf32.exe 4552 Kjkpif32.exe 3116 Kepdfo32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Gjmgajhd.dll Lnjgpgkf.exe File created C:\Windows\SysWOW64\Mpqfhc32.dll Boenam32.exe File created C:\Windows\SysWOW64\Ppmmcbgi.dll Cgiflnoa.exe File created C:\Windows\SysWOW64\Cocjbkna.exe Cdmfebnk.exe File created C:\Windows\SysWOW64\Ebapednb.exe Eglkhk32.exe File created C:\Windows\SysWOW64\Eqkfapoe.exe Egcaij32.exe File created C:\Windows\SysWOW64\Eangimij.exe Efhcld32.exe File opened for modification C:\Windows\SysWOW64\Aepklffh.exe Qkjgomgb.exe File created C:\Windows\SysWOW64\Ohghhn32.dll Hkdjph32.exe File created C:\Windows\SysWOW64\Jjlmmbfo.exe Jlhlcnge.exe File created C:\Windows\SysWOW64\Aogije32.exe Adbdml32.exe File created C:\Windows\SysWOW64\Lgmbmn32.exe Lqcjqcnp.exe File created C:\Windows\SysWOW64\Jjoplkfh.dll Aagkaj32.exe File created C:\Windows\SysWOW64\Klqbimkc.dll Kkaimj32.exe File created C:\Windows\SysWOW64\Bdndik32.exe Bncllqhm.exe File created C:\Windows\SysWOW64\Pkihhq32.dll Fenhcnaf.exe File created C:\Windows\SysWOW64\Igmcbplc.dll Iecclhak.exe File created C:\Windows\SysWOW64\Anqdigmo.dll Oefpoi32.exe File created C:\Windows\SysWOW64\Ckjbbbga.exe Cfmijkhj.exe File created C:\Windows\SysWOW64\Jeidan32.exe Iibclmkn.exe File created C:\Windows\SysWOW64\Ofbmbgnj.dll Nppfimnm.exe File created C:\Windows\SysWOW64\Egjobl32.exe Dbmfje32.exe File created C:\Windows\SysWOW64\Amkeijml.dll Hecjej32.exe File created C:\Windows\SysWOW64\Hpaibe32.exe Halmaiog.exe File created C:\Windows\SysWOW64\Nfdmag32.dll Hmicee32.exe File created C:\Windows\SysWOW64\Lgephccp.exe Lmpkkjcj.exe File created C:\Windows\SysWOW64\Fhpkja32.dll Fihnhc32.exe File created C:\Windows\SysWOW64\Ojmfcpgm.dll Ihkigd32.exe File created C:\Windows\SysWOW64\Mlflog32.exe Lelcbmcc.exe File created C:\Windows\SysWOW64\Pjljnoam.dll Mkjnop32.exe File created C:\Windows\SysWOW64\Dbnmek32.exe Dmqdmd32.exe File opened for modification C:\Windows\SysWOW64\Bjgncihp.exe Aifdcgcp.exe File opened for modification C:\Windows\SysWOW64\Dpphcf32.exe Dblgja32.exe File created C:\Windows\SysWOW64\Odmpdm32.dll Diclff32.exe File opened for modification C:\Windows\SysWOW64\Ncgiolkk.exe Mnjqfeld.exe File created C:\Windows\SysWOW64\Bnnkflee.dll Pojccmii.exe File created C:\Windows\SysWOW64\Fnkcchff.dll Phbhlcpi.exe File created C:\Windows\SysWOW64\Akqfef32.exe Adfnhlfa.exe File created C:\Windows\SysWOW64\Cgnogmkl.exe Cocjbkna.exe File created C:\Windows\SysWOW64\Dbbcmdai.dll Egnhnkmj.exe File opened for modification C:\Windows\SysWOW64\Ffkpadga.exe Eangimij.exe File created C:\Windows\SysWOW64\Mjokpm32.exe Maggggaf.exe File created C:\Windows\SysWOW64\Lmopop32.dll Bdndik32.exe File created C:\Windows\SysWOW64\Gckghp32.dll Cnokhonp.exe File created C:\Windows\SysWOW64\Lijdfcgg.dll Iohede32.exe File created C:\Windows\SysWOW64\Lmaafcml.exe Lfgiii32.exe File created C:\Windows\SysWOW64\Mnjqfeld.exe Mcdlil32.exe File created C:\Windows\SysWOW64\Bpbnelgn.dll Ejjelnfl.exe File created C:\Windows\SysWOW64\Nmenmgab.exe Nlcaeo32.exe File created C:\Windows\SysWOW64\Dodeamcl.dll Hfcnicjl.exe File created C:\Windows\SysWOW64\Ndoihadd.dll Ckphamkp.exe File created C:\Windows\SysWOW64\Hlmfhd32.dll Cponodge.exe File opened for modification C:\Windows\SysWOW64\Ikijenab.exe Hglaookl.exe File opened for modification C:\Windows\SysWOW64\Dkmogbeo.exe Ddbfkh32.exe File created C:\Windows\SysWOW64\Obhmpl32.dll Gnqflhcg.exe File created C:\Windows\SysWOW64\Ogajnn32.dll Himqjpme.exe File created C:\Windows\SysWOW64\Llhcag32.dll Iliihipi.exe File created C:\Windows\SysWOW64\Ibmlfo32.dll Giqjdk32.exe File created C:\Windows\SysWOW64\Jkcnnd32.dll Ghdoae32.exe File created C:\Windows\SysWOW64\Icalij32.exe Iiigqdfd.exe File created C:\Windows\SysWOW64\Dabjjipm.dll Dmqdmd32.exe File opened for modification C:\Windows\SysWOW64\Ompfnoci.exe Offnae32.exe File created C:\Windows\SysWOW64\Fkmbbajb.exe Fdcjfg32.exe File created C:\Windows\SysWOW64\Liqoco32.dll Polpim32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3080 4980 WerFault.exe 563 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlknqd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ohceqo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckeigc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebdcejpk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fimhcbkh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aepklffh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpcffalc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hbjonepq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Agfpoqog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpcmagpo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kdigkjpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmdcpoid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ielmki32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pojccmii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Egcaij32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnadkmhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jlclnhho.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Njcnafpe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmkfjn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Enhpje32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ilnlhb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bodfkpfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ejjelnfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmmifaci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efamkepl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Boeelcmm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnqflhcg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kokkqbog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milinkgf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kdmqfi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnahmo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npnjcm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckphamkp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Egnhnkmj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkmbbajb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghdoae32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahbacq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bjnmib32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahkdhk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npgmjl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kqkeoama.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpofbobf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cgiflnoa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ohlifj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efepln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aogije32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lfgiii32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eangimij.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfjpppbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkbohc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hlipal32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gebanm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gohfkemf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dclknkfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ffkpadga.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkgeipah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghmbhd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpaibe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onhmhc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aagkaj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hhmmffbg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojmhaklf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdleap32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hmicee32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjkadiif.dll" Adiknkco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bqhioabk.dll" Hbjonepq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ohceqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqqnqo32.dll" Pmoijcje.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Phfjmlhh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cnahmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dockak32.dll" Foclpf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhfhkiqh.dll" Mlflog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hodgdijp.dll" Cmflkl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dpphcf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Glbakchp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jjlmmbfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmopop32.dll" Bdndik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dfcjoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ejjelnfl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gifadggi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghnikdhc.dll" Lgccccec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nabfcegi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Onkphi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beaekmic.dll" Phfjmlhh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Chbcphph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Efepln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfdmeo32.dll" Plhcglil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocgjkboq.dll" Aogije32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Adiknkco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hiomppkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofbmbgnj.dll" Nppfimnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Phddbbnf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bhldio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaepea32.dll" Cmabpmjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dpknhfoq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kqphpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ildnhceg.dll" Qkgcog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cdnmphag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ljfodd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbfkhg32.dll" Ahbacq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ackbfioj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ffobbmpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Blieeglf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Beajnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fbpcah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qoplop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geifpj32.dll" Jkggfl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pmoijcje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dbnmek32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aapeakij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iimcgg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hglaookl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Elnoifjg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fpbmpc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jdaajkfd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lqikfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eicemccc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amkeijml.dll" Hecjej32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hnkonpeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oefpoi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jjlmmbfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmbiae32.dll" Bpcnceab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lbinkb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jflfei32.dll" Hlpfak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bndjnmej.dll" Fkajoiok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jkggfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Inlibb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Odjeepna.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5324 wrote to memory of 2928 5324 2026-08-10_1c0aac91a9808d069e7d3293ddcdd31c_elex_wannacry.exe 88 PID 2928 wrote to memory of 1752 2928 Ohlifj32.exe 89 PID 1752 wrote to memory of 2644 1752 Phqbaj32.exe 90 PID 2644 wrote to memory of 5840 2644 Ppjghgdg.exe 91 PID 5840 wrote to memory of 4808 5840 Pplcnf32.exe 92 PID 4808 wrote to memory of 1396 4808 Qleahgff.exe 93 PID 1396 wrote to memory of 3664 1396 Ahakhg32.exe 94 PID 3664 wrote to memory of 5492 3664 Acilkp32.exe 95 PID 5492 wrote to memory of 1612 5492 Aifdcgcp.exe 96 PID 1612 wrote to memory of 1668 1612 Bjgncihp.exe 97 PID 1668 wrote to memory of 1924 1668 Bodfkpfg.exe 98 PID 1924 wrote to memory of 2668 1924 Bmkcjd32.exe 99 PID 2668 wrote to memory of 5092 2668 Biadoeib.exe 100 PID 5092 wrote to memory of 5500 5092 Bqkifb32.exe 101 PID 5500 wrote to memory of 4688 5500 Cfjnch32.exe 102 PID 4688 wrote to memory of 1316 4688 Capbaacl.exe 103 PID 1316 wrote to memory of 5204 1316 Cimckcoe.exe 104 PID 5204 wrote to memory of 3676 5204 Ccbhhl32.exe 105 PID 3676 wrote to memory of 3408 3676 Dfcqjg32.exe 106 PID 3408 wrote to memory of 3160 3408 Dmmifaci.exe 107 PID 3160 wrote to memory of 4644 3160 Dcgackke.exe 108 PID 4644 wrote to memory of 4180 4644 Dclknkfp.exe 109 PID 4180 wrote to memory of 5364 4180 Dhjcdimf.exe 110 PID 5364 wrote to memory of 1884 5364 Dabhmo32.exe 111 PID 1884 wrote to memory of 6056 1884 Efamkepl.exe 112 PID 6056 wrote to memory of 2636 6056 Eagahnob.exe 113 PID 2636 wrote to memory of 4316 2636 Ejofacfb.exe 114 PID 4316 wrote to memory of 2172 4316 Efhcld32.exe 115 PID 2172 wrote to memory of 4664 2172 Eangimij.exe 116 PID 4664 wrote to memory of 2288 4664 Ffkpadga.exe 117 PID 2288 wrote to memory of 1840 2288 Fmehnn32.exe 118 PID 1840 wrote to memory of 3140 1840 Fdcjfg32.exe 119 PID 3140 wrote to memory of 5768 3140 Fkmbbajb.exe 120 PID 5768 wrote to memory of 4636 5768 Fajgekol.exe 121 PID 4636 wrote to memory of 3496 4636 Ghdoae32.exe 122 PID 3496 wrote to memory of 1204 3496 Gmqgjl32.exe 123 PID 1204 wrote to memory of 4588 1204 Gkgeipah.exe 124 PID 4588 wrote to memory of 2632 4588 Gpcmagpo.exe 125 PID 2632 wrote to memory of 2880 2632 Ghmbhd32.exe 126 PID 2880 wrote to memory of 4784 2880 Haefqjeo.exe 127 PID 4784 wrote to memory of 3944 4784 Hpkcafjg.exe 128 PID 3944 wrote to memory of 4196 3944 Hnodkjhq.exe 129 PID 4196 wrote to memory of 5312 4196 Hhdhhchf.exe 130 PID 5312 wrote to memory of 5872 5312 Halmaiog.exe 131 PID 5872 wrote to memory of 2116 5872 Hpaibe32.exe 132 PID 2116 wrote to memory of 4204 2116 Hglaookl.exe 133 PID 4204 wrote to memory of 4264 4204 Ikijenab.exe 134 PID 4264 wrote to memory of 3516 4264 Idbonc32.exe 135 PID 3516 wrote to memory of 1972 3516 Injcginc.exe 136 PID 1972 wrote to memory of 3292 1972 Igbhpned.exe 137 PID 3292 wrote to memory of 4520 3292 Ihbdja32.exe 138 PID 4520 wrote to memory of 2108 4520 Ibjibg32.exe 139 PID 2108 wrote to memory of 2624 2108 Jjfngi32.exe 140 PID 2624 wrote to memory of 2088 2624 Jhgneqha.exe 141 PID 2088 wrote to memory of 5372 2088 Jdnnjane.exe 142 PID 5372 wrote to memory of 4940 5372 Jkggfl32.exe 143 PID 4940 wrote to memory of 4600 4940 Jqdoob32.exe 144 PID 4600 wrote to memory of 3588 4600 Jnhphg32.exe 145 PID 3588 wrote to memory of 4608 3588 Jqihjbod.exe 146 PID 4608 wrote to memory of 1572 4608 Kqkeoama.exe 147 PID 1572 wrote to memory of 5804 1572 Kkaimj32.exe 148 PID 5804 wrote to memory of 2104 5804 Keinepch.exe 149 PID 2104 wrote to memory of 4552 2104 Kjhccf32.exe 150 PID 4552 wrote to memory of 3116 4552 Kjkpif32.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_1c0aac91a9808d069e7d3293ddcdd31c_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_1c0aac91a9808d069e7d3293ddcdd31c_elex_wannacry.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Windows\SysWOW64\Ohlifj32.exeC:\Windows\system32\Ohlifj32.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\Phqbaj32.exeC:\Windows\system32\Phqbaj32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\Ppjghgdg.exeC:\Windows\system32\Ppjghgdg.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\Pplcnf32.exeC:\Windows\system32\Pplcnf32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\SysWOW64\Qleahgff.exeC:\Windows\system32\Qleahgff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\Ahakhg32.exeC:\Windows\system32\Ahakhg32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\Acilkp32.exeC:\Windows\system32\Acilkp32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\Aifdcgcp.exeC:\Windows\system32\Aifdcgcp.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Windows\SysWOW64\Bjgncihp.exeC:\Windows\system32\Bjgncihp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\Bodfkpfg.exeC:\Windows\system32\Bodfkpfg.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\Bmkcjd32.exeC:\Windows\system32\Bmkcjd32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\Biadoeib.exeC:\Windows\system32\Biadoeib.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\Bqkifb32.exeC:\Windows\system32\Bqkifb32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\Cfjnch32.exeC:\Windows\system32\Cfjnch32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\SysWOW64\Capbaacl.exeC:\Windows\system32\Capbaacl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\Cimckcoe.exeC:\Windows\system32\Cimckcoe.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\Ccbhhl32.exeC:\Windows\system32\Ccbhhl32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Windows\SysWOW64\Dfcqjg32.exeC:\Windows\system32\Dfcqjg32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\Dmmifaci.exeC:\Windows\system32\Dmmifaci.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\Dcgackke.exeC:\Windows\system32\Dcgackke.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\Dclknkfp.exeC:\Windows\system32\Dclknkfp.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\Dhjcdimf.exeC:\Windows\system32\Dhjcdimf.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\Dabhmo32.exeC:\Windows\system32\Dabhmo32.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Windows\SysWOW64\Efamkepl.exeC:\Windows\system32\Efamkepl.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\Eagahnob.exeC:\Windows\system32\Eagahnob.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Windows\SysWOW64\Ejofacfb.exeC:\Windows\system32\Ejofacfb.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\Efhcld32.exeC:\Windows\system32\Efhcld32.exe28⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\Eangimij.exeC:\Windows\system32\Eangimij.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\Ffkpadga.exeC:\Windows\system32\Ffkpadga.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\Fmehnn32.exeC:\Windows\system32\Fmehnn32.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\Fdcjfg32.exeC:\Windows\system32\Fdcjfg32.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\Fkmbbajb.exeC:\Windows\system32\Fkmbbajb.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\Fajgekol.exeC:\Windows\system32\Fajgekol.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\SysWOW64\Ghdoae32.exeC:\Windows\system32\Ghdoae32.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\Gmqgjl32.exeC:\Windows\system32\Gmqgjl32.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\Gkgeipah.exeC:\Windows\system32\Gkgeipah.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\Gpcmagpo.exeC:\Windows\system32\Gpcmagpo.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\Ghmbhd32.exeC:\Windows\system32\Ghmbhd32.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\Haefqjeo.exeC:\Windows\system32\Haefqjeo.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\Hpkcafjg.exeC:\Windows\system32\Hpkcafjg.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\Hnodkjhq.exeC:\Windows\system32\Hnodkjhq.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\Hhdhhchf.exeC:\Windows\system32\Hhdhhchf.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\Halmaiog.exeC:\Windows\system32\Halmaiog.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\Hpaibe32.exeC:\Windows\system32\Hpaibe32.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\Hglaookl.exeC:\Windows\system32\Hglaookl.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\Ikijenab.exeC:\Windows\system32\Ikijenab.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\Idbonc32.exeC:\Windows\system32\Idbonc32.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\Injcginc.exeC:\Windows\system32\Injcginc.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\Igbhpned.exeC:\Windows\system32\Igbhpned.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\Ihbdja32.exeC:\Windows\system32\Ihbdja32.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\Ibjibg32.exeC:\Windows\system32\Ibjibg32.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\Jjfngi32.exeC:\Windows\system32\Jjfngi32.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\Jhgneqha.exeC:\Windows\system32\Jhgneqha.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\Jdnnjane.exeC:\Windows\system32\Jdnnjane.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\Jkggfl32.exeC:\Windows\system32\Jkggfl32.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Windows\SysWOW64\Jqdoob32.exeC:\Windows\system32\Jqdoob32.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\Jnhphg32.exeC:\Windows\system32\Jnhphg32.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\Jqihjbod.exeC:\Windows\system32\Jqihjbod.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\Kqkeoama.exeC:\Windows\system32\Kqkeoama.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\Kkaimj32.exeC:\Windows\system32\Kkaimj32.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\Keinepch.exeC:\Windows\system32\Keinepch.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\SysWOW64\Kjhccf32.exeC:\Windows\system32\Kjhccf32.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\Kjkpif32.exeC:\Windows\system32\Kjkpif32.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\Kepdfo32.exeC:\Windows\system32\Kepdfo32.exe65⤵
- Executes dropped EXE
PID:3116 -
C:\Windows\SysWOW64\Lnihod32.exeC:\Windows\system32\Lnihod32.exe66⤵PID:3248
-
C:\Windows\SysWOW64\Linmlm32.exeC:\Windows\system32\Linmlm32.exe67⤵PID:4804
-
C:\Windows\SysWOW64\Lnkedd32.exeC:\Windows\system32\Lnkedd32.exe68⤵PID:2520
-
C:\Windows\SysWOW64\Llofnh32.exeC:\Windows\system32\Llofnh32.exe69⤵PID:3156
-
C:\Windows\SysWOW64\Lbinkb32.exeC:\Windows\system32\Lbinkb32.exe70⤵
- Modifies registry class
PID:5796 -
C:\Windows\SysWOW64\Ljdboe32.exeC:\Windows\system32\Ljdboe32.exe71⤵PID:2584
-
C:\Windows\SysWOW64\Ljfodd32.exeC:\Windows\system32\Ljfodd32.exe72⤵
- Modifies registry class
PID:1360 -
C:\Windows\SysWOW64\Lelcbmcc.exeC:\Windows\system32\Lelcbmcc.exe73⤵
- Drops file in System32 directory
PID:3584 -
C:\Windows\SysWOW64\Mlflog32.exeC:\Windows\system32\Mlflog32.exe74⤵
- Modifies registry class
PID:4680 -
C:\Windows\SysWOW64\Mhmmchpd.exeC:\Windows\system32\Mhmmchpd.exe75⤵PID:5116
-
C:\Windows\SysWOW64\Milinkgf.exeC:\Windows\system32\Milinkgf.exe76⤵
- System Location Discovery: System Language Discovery
PID:904 -
C:\Windows\SysWOW64\Mbenfq32.exeC:\Windows\system32\Mbenfq32.exe77⤵PID:724
-
C:\Windows\SysWOW64\Mbgjlq32.exeC:\Windows\system32\Mbgjlq32.exe78⤵PID:920
-
C:\Windows\SysWOW64\Miabik32.exeC:\Windows\system32\Miabik32.exe79⤵PID:200
-
C:\Windows\SysWOW64\Niconj32.exeC:\Windows\system32\Niconj32.exe80⤵PID:5484
-
C:\Windows\SysWOW64\Nhhlog32.exeC:\Windows\system32\Nhhlog32.exe81⤵PID:2240
-
C:\Windows\SysWOW64\Nbnpmp32.exeC:\Windows\system32\Nbnpmp32.exe82⤵PID:5308
-
C:\Windows\SysWOW64\Nhmejf32.exeC:\Windows\system32\Nhmejf32.exe83⤵PID:3356
-
C:\Windows\SysWOW64\Nlknqd32.exeC:\Windows\system32\Nlknqd32.exe84⤵
- System Location Discovery: System Language Discovery
PID:6108 -
C:\Windows\SysWOW64\Oeccijoh.exeC:\Windows\system32\Oeccijoh.exe85⤵PID:2800
-
C:\Windows\SysWOW64\Oefpoi32.exeC:\Windows\system32\Oefpoi32.exe86⤵
- Drops file in System32 directory
- Modifies registry class
PID:6092 -
C:\Windows\SysWOW64\Oehldi32.exeC:\Windows\system32\Oehldi32.exe87⤵PID:2848
-
C:\Windows\SysWOW64\Oldagc32.exeC:\Windows\system32\Oldagc32.exe88⤵PID:832
-
C:\Windows\SysWOW64\Oemephgn.exeC:\Windows\system32\Oemephgn.exe89⤵PID:5668
-
C:\Windows\SysWOW64\Ooejhn32.exeC:\Windows\system32\Ooejhn32.exe90⤵PID:4372
-
C:\Windows\SysWOW64\Phnoac32.exeC:\Windows\system32\Phnoac32.exe91⤵PID:4652
-
C:\Windows\SysWOW64\Poggnnkk.exeC:\Windows\system32\Poggnnkk.exe92⤵PID:5284
-
C:\Windows\SysWOW64\Phpkgc32.exeC:\Windows\system32\Phpkgc32.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1464 -
C:\Windows\SysWOW64\Pojccmii.exeC:\Windows\system32\Pojccmii.exe94⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4192 -
C:\Windows\SysWOW64\Phbhlcpi.exeC:\Windows\system32\Phbhlcpi.exe95⤵
- Drops file in System32 directory
PID:2564 -
C:\Windows\SysWOW64\Polpim32.exeC:\Windows\system32\Polpim32.exe96⤵
- Drops file in System32 directory
PID:5384 -
C:\Windows\SysWOW64\Phddbbnf.exeC:\Windows\system32\Phddbbnf.exe97⤵
- Modifies registry class
PID:2356 -
C:\Windows\SysWOW64\Pcjioknl.exeC:\Windows\system32\Pcjioknl.exe98⤵PID:1484
-
C:\Windows\SysWOW64\Pidaleei.exeC:\Windows\system32\Pidaleei.exe99⤵PID:4480
-
C:\Windows\SysWOW64\Poajdlcq.exeC:\Windows\system32\Poajdlcq.exe100⤵PID:3204
-
C:\Windows\SysWOW64\Qifnaecf.exeC:\Windows\system32\Qifnaecf.exe101⤵PID:3152
-
C:\Windows\SysWOW64\Qkhjim32.exeC:\Windows\system32\Qkhjim32.exe102⤵PID:4132
-
C:\Windows\SysWOW64\Qemoff32.exeC:\Windows\system32\Qemoff32.exe103⤵PID:2756
-
C:\Windows\SysWOW64\Qkjgomgb.exeC:\Windows\system32\Qkjgomgb.exe104⤵
- Drops file in System32 directory
PID:5628 -
C:\Windows\SysWOW64\Aepklffh.exeC:\Windows\system32\Aepklffh.exe105⤵
- System Location Discovery: System Language Discovery
PID:1264 -
C:\Windows\SysWOW64\Aljcip32.exeC:\Windows\system32\Aljcip32.exe106⤵PID:4912
-
C:\Windows\SysWOW64\Aebhaede.exeC:\Windows\system32\Aebhaede.exe107⤵PID:5448
-
C:\Windows\SysWOW64\Akoqjl32.exeC:\Windows\system32\Akoqjl32.exe108⤵PID:1520
-
C:\Windows\SysWOW64\Ahbacq32.exeC:\Windows\system32\Ahbacq32.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4220 -
C:\Windows\SysWOW64\Aakelfhg.exeC:\Windows\system32\Aakelfhg.exe110⤵PID:3428
-
C:\Windows\SysWOW64\Alqjiohm.exeC:\Windows\system32\Alqjiohm.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1440 -
C:\Windows\SysWOW64\Ackbfioj.exeC:\Windows\system32\Ackbfioj.exe112⤵
- Modifies registry class
PID:5468 -
C:\Windows\SysWOW64\Alcfoo32.exeC:\Windows\system32\Alcfoo32.exe113⤵PID:5932
-
C:\Windows\SysWOW64\Bhjgdplo.exeC:\Windows\system32\Bhjgdplo.exe114⤵PID:1964
-
C:\Windows\SysWOW64\Bcokah32.exeC:\Windows\system32\Bcokah32.exe115⤵PID:5240
-
C:\Windows\SysWOW64\Bhldio32.exeC:\Windows\system32\Bhldio32.exe116⤵
- Modifies registry class
PID:2376 -
C:\Windows\SysWOW64\Bcahgh32.exeC:\Windows\system32\Bcahgh32.exe117⤵PID:2864
-
C:\Windows\SysWOW64\Bhnqoo32.exeC:\Windows\system32\Bhnqoo32.exe118⤵PID:5152
-
C:\Windows\SysWOW64\Bcddlhgo.exeC:\Windows\system32\Bcddlhgo.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4304 -
C:\Windows\SysWOW64\Bjnmib32.exeC:\Windows\system32\Bjnmib32.exe120⤵
- System Location Discovery: System Language Discovery
PID:4300 -
C:\Windows\SysWOW64\Bokeai32.exeC:\Windows\system32\Bokeai32.exe121⤵PID:2264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-