Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 22:08
Behavioral task
behavioral1
Sample
2026-08-11_e2bb1dbb78fb441629a15609259b6d5b_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_e2bb1dbb78fb441629a15609259b6d5b_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-11_e2bb1dbb78fb441629a15609259b6d5b_elex_wannacry.exe
- Size 376KB
- Sample260811-12ft9adr21
- SHA256 386189502ee0e8593083e1eb35c7a1073d0bce1ebab295aa772486830d90bc14
- MD5 e2bb1dbb78fb441629a15609259b6d5b
- SHA1 d25e0a2862ae91e7250fc85b72a356ee8af64386
- SHA512 6bfd09fd53b3cb35999770af81c083eeec97c9b1e99e7a87914ac3543e04e788ff6d41d7aa45eb36229fc4032f6da79b1198e345d081ab9d02d1357b3b63abaf
- SSDEEP 6144:08bvLWC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:08DN50I2mi4lCzb0IF4X
- TLSH T15384282DEE768A82C45910FF01A392B4A178D77D0DF58FB5BFD0F6492A252C3E81B194
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://crutop.ru/index.php
-
http://mazafaka.ru/index.php
-
http://color-bank.ru/index.php
-
http://asechka.ru/index.php
-
http://trojan.ru/index.php
-
http://fuck.ru/index.php
-
http://goldensand.ru/index.php
-
http://filesearch.ru/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://lovingod.host.sk/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://mazafaka.ru/index.htm
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
-
http://fethard.biz/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phfjmlhh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Modgnn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljmfdp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oobfhh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Plkpmlfi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hlkmfkli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mokmnm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gkgeipah.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igdnkhoe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pdfeandd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gihgoq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mfnhpblk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Macdgn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbbaaapj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ahgjnpna.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkmebh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lcejmeol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lcdcbokq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hbchnfei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aodejohd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfojmn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aihaifam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Afghgkdl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ehaieh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hbldinjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Idoknmfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bllbkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ekdolcbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nhpbpepo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cilmpmki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Apmhbf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ihpcbdba.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkhkfhnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ckbnlfeb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Acfoep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aobieq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Djqbeonf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ohkkanbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Enkmpe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Adccnpqm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fqkogiki.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afghgkdl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijcaaibe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gdglfqjd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpniaool.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iojbid32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njkklk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fldnoo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bigbgehl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ciihcbhg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cmaikcmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cggnhlml.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhmmchpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ljmfdp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mnhdae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cbhifj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ggilbb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmhcda32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cknlln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ipbahb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kdgapp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oehldi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kedcml32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Haefqjeo.exe - Executes dropped EXE 64 IoCs
pid Process 5980 Pjbkal32.exe 6080 Pgfljqia.exe 5368 Plcdbghi.exe 2640 Qodmdb32.exe 4404 Qcbfjqkp.exe 4552 Acfoep32.exe 4652 Aichng32.exe 932 Aompjamo.exe 4188 Afghgkdl.exe 1416 Amaqde32.exe 4368 Aggean32.exe 5832 Aihaifam.exe 4488 Aobieq32.exe 3204 Aflabj32.exe 2204 Bqafpc32.exe 5144 Bgknlmgi.exe 5204 Bimkde32.exe 5064 Bcboan32.exe 1564 Bjlgnh32.exe 5156 Bqfokblg.exe 3144 Bgpggm32.exe 2656 Bmmppc32.exe 2928 Bcghlnih.exe 3140 Bidqddgp.exe 804 Bpniaool.exe 5176 Cfhani32.exe 4984 Cmaikcmf.exe 2316 Cggnhlml.exe 4752 Cihjpd32.exe 2440 Cpbbln32.exe 3744 Cflkihbd.exe 472 Cmfcfb32.exe 5960 Cglgck32.exe 4520 Cimckcoe.exe 5132 Cpglgmfa.exe 2580 Cjmpeffh.exe 6032 Cafhap32.exe 5056 Dgqqnjea.exe 5812 Dmmifaci.exe 4756 Dcgackke.exe 1596 Didjkbim.exe 3456 Dpnbhl32.exe 5236 Dfhjefhf.exe 4660 Dannbogl.exe 1400 Dhgfoioi.exe 1064 Dmdogpmq.exe 4580 Ddngdj32.exe 3064 Djhpqdlj.exe 3464 Dpehikja.exe 2184 Ejklfd32.exe 3460 Eaddcnad.exe 3668 Efamkepl.exe 1540 Emkeho32.exe 6076 Ehaieh32.exe 1244 Eibfmp32.exe 2384 Edhjji32.exe 2880 Eidbbp32.exe 6044 Epokojbg.exe 3344 Ekdolcbm.exe 4316 Fpagdj32.exe 3040 Ffkpadga.exe 4868 Fapdomgg.exe 3496 Fhjlkg32.exe 2632 Fmgecn32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Abcghg32.dll Idfhibdn.exe File created C:\Windows\SysWOW64\Lnfmno32.dll Dkbomgde.exe File opened for modification C:\Windows\SysWOW64\Gbmigm32.exe Gmpqof32.exe File opened for modification C:\Windows\SysWOW64\Gpeclq32.exe Gkhkdjli.exe File opened for modification C:\Windows\SysWOW64\Fapdomgg.exe Ffkpadga.exe File opened for modification C:\Windows\SysWOW64\Hpkcafjg.exe Hgboiq32.exe File created C:\Windows\SysWOW64\Agkmki32.dll Nmenmgab.exe File created C:\Windows\SysWOW64\Ibcadcgf.exe Ipeehhhb.exe File created C:\Windows\SysWOW64\Fkamfl32.dll Lnendhol.exe File opened for modification C:\Windows\SysWOW64\Mggecl32.exe Lqmmgb32.exe File opened for modification C:\Windows\SysWOW64\Iaaflh32.exe Hjhaeklb.exe File created C:\Windows\SysWOW64\Laiikdog.dll Gghdkg32.exe File created C:\Windows\SysWOW64\Jflnia32.dll Hbldinjb.exe File created C:\Windows\SysWOW64\Qpnegbpo.exe Qjalok32.exe File created C:\Windows\SysWOW64\Fgedmq32.dll Qjalok32.exe File created C:\Windows\SysWOW64\Pgpjde32.dll Idoknmfj.exe File created C:\Windows\SysWOW64\Idhdieal.dll Ofaeffpa.exe File created C:\Windows\SysWOW64\Ebiffc32.exe Ehpamnaj.exe File created C:\Windows\SysWOW64\Ihbphcpo.exe Ioikon32.exe File opened for modification C:\Windows\SysWOW64\Njdlfbgm.exe Malgmm32.exe File created C:\Windows\SysWOW64\Qhhlbobk.dll Enfceefi.exe File created C:\Windows\SysWOW64\Dcdiahme.exe Dildibfd.exe File created C:\Windows\SysWOW64\Dinanb32.exe Dcdiahme.exe File opened for modification C:\Windows\SysWOW64\Allpnplb.exe Aohpek32.exe File created C:\Windows\SysWOW64\Nmipnp32.exe Ncplekbq.exe File created C:\Windows\SysWOW64\Fepehm32.exe Foclpf32.exe File created C:\Windows\SysWOW64\Kbikghkc.dll Kdgapp32.exe File created C:\Windows\SysWOW64\Kfbeee32.dll Bmliem32.exe File created C:\Windows\SysWOW64\Omnknefi.dll Gmafjp32.exe File opened for modification C:\Windows\SysWOW64\Mledgm32.exe Mcmongoj.exe File created C:\Windows\SysWOW64\Hldbfp32.dll Koodka32.exe File created C:\Windows\SysWOW64\Connnnid.dll Iogoinka.exe File created C:\Windows\SysWOW64\Ljbfiegb.exe Liqibm32.exe File opened for modification C:\Windows\SysWOW64\Okgabpgg.exe Oaomij32.exe File created C:\Windows\SysWOW64\Pmkopgep.exe Pfagcm32.exe File created C:\Windows\SysWOW64\Ekdolcbm.exe Epokojbg.exe File opened for modification C:\Windows\SysWOW64\Poggnnkk.exe Phnoac32.exe File created C:\Windows\SysWOW64\Cfqmjajc.exe Cofemg32.exe File created C:\Windows\SysWOW64\Llnado32.dll Gdglfqjd.exe File created C:\Windows\SysWOW64\Phfjmlhh.exe Palbpb32.exe File opened for modification C:\Windows\SysWOW64\Cakghn32.exe Ckaolcol.exe File created C:\Windows\SysWOW64\Paaaeg32.exe Pflmhnbi.exe File created C:\Windows\SysWOW64\Fmhdcm32.dll Dpehikja.exe File opened for modification C:\Windows\SysWOW64\Poajdlcq.exe Phgagb32.exe File created C:\Windows\SysWOW64\Ipeehhhb.exe Iepako32.exe File created C:\Windows\SysWOW64\Bddcocff.exe Bogkgmho.exe File created C:\Windows\SysWOW64\Ckbnlfeb.exe Cbhifj32.exe File created C:\Windows\SysWOW64\Famffa32.dll Inhgaipf.exe File created C:\Windows\SysWOW64\Ckdcli32.exe Cjbfdakf.exe File opened for modification C:\Windows\SysWOW64\Ndaboafl.exe Nndjgjhe.exe File created C:\Windows\SysWOW64\Oaigckee.dll Dmcabd32.exe File created C:\Windows\SysWOW64\Moleah32.dll Ildibc32.exe File opened for modification C:\Windows\SysWOW64\Mohingqi.exe Mjlafqbb.exe File created C:\Windows\SysWOW64\Oamoef32.dll Obebla32.exe File created C:\Windows\SysWOW64\Fafjdb32.dll Gbmigm32.exe File opened for modification C:\Windows\SysWOW64\Bogkgmho.exe Bhmbjb32.exe File opened for modification C:\Windows\SysWOW64\Paaaeg32.exe Pflmhnbi.exe File opened for modification C:\Windows\SysWOW64\Noijmp32.exe Nhpbpepo.exe File created C:\Windows\SysWOW64\Ejpkqc32.dll Ocdnedkp.exe File created C:\Windows\SysWOW64\Hhlpkkmk.dll Pibdff32.exe File opened for modification C:\Windows\SysWOW64\Hgfaij32.exe Hlqmla32.exe File opened for modification C:\Windows\SysWOW64\Bdndik32.exe Boqlqd32.exe File created C:\Windows\SysWOW64\Ibnaonhp.exe Ildibc32.exe File opened for modification C:\Windows\SysWOW64\Ojdnbj32.exe Oaliidon.exe - Program crash 1 IoCs
pid pid_target Process procid_target 7556 13216 WerFault.exe 777 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Olgnlb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Difpflco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbhplnca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Menimfnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Feoomd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iiipfnch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npbcollj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhmbjb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bmmppc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Plkpmlfi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aachaa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hekgppma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ildibc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibnaonhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iihilhol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qfhmcl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkbkna32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lfgiii32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fqkogiki.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Didjkbim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pchljlpo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cakghn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bpodhf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hhfplejl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Laachfbe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nfihkq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmmleg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bkjpek32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dpehikja.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oobfhh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bjlgnh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dgqqnjea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llabchoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mbbaaapj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fngcfikb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgkijp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bkhkfhnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cjbfdakf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iloimopp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljmfdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cpbbln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdhlhd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Inhgaipf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Laqhao32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ecefjckj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mofmhhcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keinepch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Inecac32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ffiblg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aihaifam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjoibadl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mfnhpblk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qoboofnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Apmhbf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekekcjih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Omjfij32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Baephacf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkjfkacd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpkcafjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djelqo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Palbpb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dnkkcmdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qpnegbpo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ecdbhe32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jppnjpji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jnelha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ffkpadga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anqdigmo.dll" Okbhgq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Elkbcf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jcphkhad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbhhoobc.dll" Ckaolcol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojonogkn.dll" Jgigfg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obqclgoc.dll" Kfimhkbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fkbpjbil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Okgabpgg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Peaokh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jjlmmbfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecipbbbk.dll" Kkgicccd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aapeakij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Enfceefi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcndda32.dll" Fbkblb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dhgfoioi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibdmph32.dll" Milinkgf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jjoibadl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afknipda.dll" Mlohjpoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kimnnbaj.dll" Ogqaqigd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iejqeiif.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Onochbjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mlcgam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnddfh32.dll" Mfnhpblk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpbglkge.dll" Cbfmpj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jgjnpm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Llcoihmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojilnl32.dll" Kddnpj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nmenmgab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dqpffaib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cpjmjn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Emkeho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecobcfhi.dll" Fimonh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pjbkal32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Njdlfbgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Poggnnkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hldbfp32.dll" Koodka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qiimdlje.dll" Llabchoe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hpkcafjg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cocamaam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pdcaahbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ggfgegho.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fdmahgnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hojmqm32.dll" Keinepch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qocfjlan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehgjinca.dll" Gmdjjemp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jncobabm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afnhan32.dll" Coohbbeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipffjg32.dll" Ojfcmc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olhgka32.dll" Phgagb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifjeojlk.dll" Bdndik32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cfkmdl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dkndbkop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qemoff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnngkkmo.dll" Cbphncfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hfekoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hnnlcpcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ildibc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Omjfij32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bqfokblg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcjfha32.dll" Kggcgeop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kggfmplj.dll" Lankloml.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3236 wrote to memory of 5980 3236 2026-08-11_e2bb1dbb78fb441629a15609259b6d5b_elex_wannacry.exe 88 PID 5980 wrote to memory of 6080 5980 Pjbkal32.exe 89 PID 6080 wrote to memory of 5368 6080 Pgfljqia.exe 90 PID 5368 wrote to memory of 2640 5368 Plcdbghi.exe 91 PID 2640 wrote to memory of 4404 2640 Qodmdb32.exe 92 PID 4404 wrote to memory of 4552 4404 Qcbfjqkp.exe 93 PID 4552 wrote to memory of 4652 4552 Acfoep32.exe 94 PID 4652 wrote to memory of 932 4652 Aichng32.exe 95 PID 932 wrote to memory of 4188 932 Aompjamo.exe 96 PID 4188 wrote to memory of 1416 4188 Afghgkdl.exe 97 PID 1416 wrote to memory of 4368 1416 Amaqde32.exe 98 PID 4368 wrote to memory of 5832 4368 Aggean32.exe 99 PID 5832 wrote to memory of 4488 5832 Aihaifam.exe 100 PID 4488 wrote to memory of 3204 4488 Aobieq32.exe 101 PID 3204 wrote to memory of 2204 3204 Aflabj32.exe 102 PID 2204 wrote to memory of 5144 2204 Bqafpc32.exe 103 PID 5144 wrote to memory of 5204 5144 Bgknlmgi.exe 104 PID 5204 wrote to memory of 5064 5204 Bimkde32.exe 105 PID 5064 wrote to memory of 1564 5064 Bcboan32.exe 106 PID 1564 wrote to memory of 5156 1564 Bjlgnh32.exe 107 PID 5156 wrote to memory of 3144 5156 Bqfokblg.exe 108 PID 3144 wrote to memory of 2656 3144 Bgpggm32.exe 109 PID 2656 wrote to memory of 2928 2656 Bmmppc32.exe 110 PID 2928 wrote to memory of 3140 2928 Bcghlnih.exe 111 PID 3140 wrote to memory of 804 3140 Bidqddgp.exe 112 PID 804 wrote to memory of 5176 804 Bpniaool.exe 113 PID 5176 wrote to memory of 4984 5176 Cfhani32.exe 114 PID 4984 wrote to memory of 2316 4984 Cmaikcmf.exe 115 PID 2316 wrote to memory of 4752 2316 Cggnhlml.exe 116 PID 4752 wrote to memory of 2440 4752 Cihjpd32.exe 117 PID 2440 wrote to memory of 3744 2440 Cpbbln32.exe 118 PID 3744 wrote to memory of 472 3744 Cflkihbd.exe 119 PID 472 wrote to memory of 5960 472 Cmfcfb32.exe 120 PID 5960 wrote to memory of 4520 5960 Cglgck32.exe 121 PID 4520 wrote to memory of 5132 4520 Cimckcoe.exe 122 PID 5132 wrote to memory of 2580 5132 Cpglgmfa.exe 123 PID 2580 wrote to memory of 6032 2580 Cjmpeffh.exe 124 PID 6032 wrote to memory of 5056 6032 Cafhap32.exe 125 PID 5056 wrote to memory of 5812 5056 Dgqqnjea.exe 126 PID 5812 wrote to memory of 4756 5812 Dmmifaci.exe 127 PID 4756 wrote to memory of 1596 4756 Dcgackke.exe 128 PID 1596 wrote to memory of 3456 1596 Didjkbim.exe 129 PID 3456 wrote to memory of 5236 3456 Dpnbhl32.exe 130 PID 5236 wrote to memory of 4660 5236 Dfhjefhf.exe 131 PID 4660 wrote to memory of 1400 4660 Dannbogl.exe 132 PID 1400 wrote to memory of 1064 1400 Dhgfoioi.exe 133 PID 1064 wrote to memory of 4580 1064 Dmdogpmq.exe 134 PID 4580 wrote to memory of 3064 4580 Ddngdj32.exe 135 PID 3064 wrote to memory of 3464 3064 Djhpqdlj.exe 136 PID 3464 wrote to memory of 2184 3464 Dpehikja.exe 137 PID 2184 wrote to memory of 3460 2184 Ejklfd32.exe 138 PID 3460 wrote to memory of 3668 3460 Eaddcnad.exe 139 PID 3668 wrote to memory of 1540 3668 Efamkepl.exe 140 PID 1540 wrote to memory of 6076 1540 Emkeho32.exe 141 PID 6076 wrote to memory of 1244 6076 Ehaieh32.exe 142 PID 1244 wrote to memory of 2384 1244 Eibfmp32.exe 143 PID 2384 wrote to memory of 2880 2384 Edhjji32.exe 144 PID 2880 wrote to memory of 6044 2880 Eidbbp32.exe 145 PID 6044 wrote to memory of 3344 6044 Epokojbg.exe 146 PID 3344 wrote to memory of 4316 3344 Ekdolcbm.exe 147 PID 4316 wrote to memory of 3040 4316 Fpagdj32.exe 148 PID 3040 wrote to memory of 4868 3040 Ffkpadga.exe 149 PID 4868 wrote to memory of 3496 4868 Fapdomgg.exe 150 PID 3496 wrote to memory of 2632 3496 Fhjlkg32.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_e2bb1dbb78fb441629a15609259b6d5b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_e2bb1dbb78fb441629a15609259b6d5b_elex_wannacry.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\Pjbkal32.exeC:\Windows\system32\Pjbkal32.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\SysWOW64\Pgfljqia.exeC:\Windows\system32\Pgfljqia.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Windows\SysWOW64\Plcdbghi.exeC:\Windows\system32\Plcdbghi.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Windows\SysWOW64\Qodmdb32.exeC:\Windows\system32\Qodmdb32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\Qcbfjqkp.exeC:\Windows\system32\Qcbfjqkp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\Acfoep32.exeC:\Windows\system32\Acfoep32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\Aichng32.exeC:\Windows\system32\Aichng32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\Aompjamo.exeC:\Windows\system32\Aompjamo.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\Afghgkdl.exeC:\Windows\system32\Afghgkdl.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\Amaqde32.exeC:\Windows\system32\Amaqde32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\Aggean32.exeC:\Windows\system32\Aggean32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\Aihaifam.exeC:\Windows\system32\Aihaifam.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\Aobieq32.exeC:\Windows\system32\Aobieq32.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\Aflabj32.exeC:\Windows\system32\Aflabj32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\Bqafpc32.exeC:\Windows\system32\Bqafpc32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\Bgknlmgi.exeC:\Windows\system32\Bgknlmgi.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\SysWOW64\Bimkde32.exeC:\Windows\system32\Bimkde32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Windows\SysWOW64\Bcboan32.exeC:\Windows\system32\Bcboan32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\Bjlgnh32.exeC:\Windows\system32\Bjlgnh32.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\Bqfokblg.exeC:\Windows\system32\Bqfokblg.exe21⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Windows\SysWOW64\Bgpggm32.exeC:\Windows\system32\Bgpggm32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\Bmmppc32.exeC:\Windows\system32\Bmmppc32.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\Bcghlnih.exeC:\Windows\system32\Bcghlnih.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\Bidqddgp.exeC:\Windows\system32\Bidqddgp.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\Bpniaool.exeC:\Windows\system32\Bpniaool.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\Cfhani32.exeC:\Windows\system32\Cfhani32.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Windows\SysWOW64\Cmaikcmf.exeC:\Windows\system32\Cmaikcmf.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\Cggnhlml.exeC:\Windows\system32\Cggnhlml.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\Cihjpd32.exeC:\Windows\system32\Cihjpd32.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\Cpbbln32.exeC:\Windows\system32\Cpbbln32.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\Cflkihbd.exeC:\Windows\system32\Cflkihbd.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\Cmfcfb32.exeC:\Windows\system32\Cmfcfb32.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\Cglgck32.exeC:\Windows\system32\Cglgck32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\SysWOW64\Cimckcoe.exeC:\Windows\system32\Cimckcoe.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\Cpglgmfa.exeC:\Windows\system32\Cpglgmfa.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Windows\SysWOW64\Cjmpeffh.exeC:\Windows\system32\Cjmpeffh.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\Cafhap32.exeC:\Windows\system32\Cafhap32.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\Dgqqnjea.exeC:\Windows\system32\Dgqqnjea.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\Dmmifaci.exeC:\Windows\system32\Dmmifaci.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Windows\SysWOW64\Dcgackke.exeC:\Windows\system32\Dcgackke.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\Didjkbim.exeC:\Windows\system32\Didjkbim.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\Dpnbhl32.exeC:\Windows\system32\Dpnbhl32.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\Dfhjefhf.exeC:\Windows\system32\Dfhjefhf.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Windows\SysWOW64\Dannbogl.exeC:\Windows\system32\Dannbogl.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\Dhgfoioi.exeC:\Windows\system32\Dhgfoioi.exe46⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\Dmdogpmq.exeC:\Windows\system32\Dmdogpmq.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\Ddngdj32.exeC:\Windows\system32\Ddngdj32.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\Djhpqdlj.exeC:\Windows\system32\Djhpqdlj.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\Dpehikja.exeC:\Windows\system32\Dpehikja.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\Ejklfd32.exeC:\Windows\system32\Ejklfd32.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\Eaddcnad.exeC:\Windows\system32\Eaddcnad.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\Efamkepl.exeC:\Windows\system32\Efamkepl.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\Emkeho32.exeC:\Windows\system32\Emkeho32.exe54⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\Ehaieh32.exeC:\Windows\system32\Ehaieh32.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\Eibfmp32.exeC:\Windows\system32\Eibfmp32.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\Edhjji32.exeC:\Windows\system32\Edhjji32.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\Eidbbp32.exeC:\Windows\system32\Eidbbp32.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\Epokojbg.exeC:\Windows\system32\Epokojbg.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\Ekdolcbm.exeC:\Windows\system32\Ekdolcbm.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\Fpagdj32.exeC:\Windows\system32\Fpagdj32.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\Ffkpadga.exeC:\Windows\system32\Ffkpadga.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\Fapdomgg.exeC:\Windows\system32\Fapdomgg.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\Fhjlkg32.exeC:\Windows\system32\Fhjlkg32.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\Fmgecn32.exeC:\Windows\system32\Fmgecn32.exe65⤵
- Executes dropped EXE
PID:2632 -
C:\Windows\SysWOW64\Fhmiqfma.exeC:\Windows\system32\Fhmiqfma.exe66⤵PID:3136
-
C:\Windows\SysWOW64\Fmiaimki.exeC:\Windows\system32\Fmiaimki.exe67⤵PID:5148
-
C:\Windows\SysWOW64\Fdcjfg32.exeC:\Windows\system32\Fdcjfg32.exe68⤵PID:3920
-
C:\Windows\SysWOW64\Fipbnn32.exeC:\Windows\system32\Fipbnn32.exe69⤵PID:3428
-
C:\Windows\SysWOW64\Fdffkgpc.exeC:\Windows\system32\Fdffkgpc.exe70⤵PID:5128
-
C:\Windows\SysWOW64\Fibocnnj.exeC:\Windows\system32\Fibocnnj.exe71⤵PID:464
-
C:\Windows\SysWOW64\Gpmgph32.exeC:\Windows\system32\Gpmgph32.exe72⤵PID:2452
-
C:\Windows\SysWOW64\Gkbkna32.exeC:\Windows\system32\Gkbkna32.exe73⤵
- System Location Discovery: System Language Discovery
PID:252 -
C:\Windows\SysWOW64\Gpodfh32.exeC:\Windows\system32\Gpodfh32.exe74⤵PID:1776
-
C:\Windows\SysWOW64\Ggilbb32.exeC:\Windows\system32\Ggilbb32.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5824 -
C:\Windows\SysWOW64\Ganppk32.exeC:\Windows\system32\Ganppk32.exe76⤵PID:2660
-
C:\Windows\SysWOW64\Gkgeipah.exeC:\Windows\system32\Gkgeipah.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4632 -
C:\Windows\SysWOW64\Ghmbhd32.exeC:\Windows\system32\Ghmbhd32.exe78⤵PID:5004
-
C:\Windows\SysWOW64\Haefqjeo.exeC:\Windows\system32\Haefqjeo.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4832 -
C:\Windows\SysWOW64\Hgboiq32.exeC:\Windows\system32\Hgboiq32.exe80⤵
- Drops file in System32 directory
PID:1040 -
C:\Windows\SysWOW64\Hpkcafjg.exeC:\Windows\system32\Hpkcafjg.exe81⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4084 -
C:\Windows\SysWOW64\Hnodkjhq.exeC:\Windows\system32\Hnodkjhq.exe82⤵PID:1300
-
C:\Windows\SysWOW64\Hdhlhd32.exeC:\Windows\system32\Hdhlhd32.exe83⤵
- System Location Discovery: System Language Discovery
PID:3216 -
C:\Windows\SysWOW64\Hhfenc32.exeC:\Windows\system32\Hhfenc32.exe84⤵PID:4120
-
C:\Windows\SysWOW64\Hjhaeklb.exeC:\Windows\system32\Hjhaeklb.exe85⤵
- Drops file in System32 directory
PID:1988 -
C:\Windows\SysWOW64\Iaaflh32.exeC:\Windows\system32\Iaaflh32.exe86⤵PID:2752
-
C:\Windows\SysWOW64\Inhgaipf.exeC:\Windows\system32\Inhgaipf.exe87⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1620 -
C:\Windows\SysWOW64\Ihnkobpl.exeC:\Windows\system32\Ihnkobpl.exe88⤵PID:4548
-
C:\Windows\SysWOW64\Ikndpm32.exeC:\Windows\system32\Ikndpm32.exe89⤵PID:4472
-
C:\Windows\SysWOW64\Idfhibdn.exeC:\Windows\system32\Idfhibdn.exe90⤵
- Drops file in System32 directory
PID:1696 -
C:\Windows\SysWOW64\Ijcaaibe.exeC:\Windows\system32\Ijcaaibe.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3640 -
C:\Windows\SysWOW64\Iggakn32.exeC:\Windows\system32\Iggakn32.exe92⤵PID:1136
-
C:\Windows\SysWOW64\Jgjnpm32.exeC:\Windows\system32\Jgjnpm32.exe93⤵
- Modifies registry class
PID:3396 -
C:\Windows\SysWOW64\Jbobnf32.exeC:\Windows\system32\Jbobnf32.exe94⤵PID:3028
-
C:\Windows\SysWOW64\Jjjgbhlm.exeC:\Windows\system32\Jjjgbhlm.exe95⤵PID:1900
-
C:\Windows\SysWOW64\Jdpkoalc.exeC:\Windows\system32\Jdpkoalc.exe96⤵PID:5724
-
C:\Windows\SysWOW64\Jjmcghjj.exeC:\Windows\system32\Jjmcghjj.exe97⤵PID:1288
-
C:\Windows\SysWOW64\Jgqdal32.exeC:\Windows\system32\Jgqdal32.exe98⤵PID:3268
-
C:\Windows\SysWOW64\Jqihjbod.exeC:\Windows\system32\Jqihjbod.exe99⤵PID:240
-
C:\Windows\SysWOW64\Knmicfnn.exeC:\Windows\system32\Knmicfnn.exe100⤵PID:6052
-
C:\Windows\SysWOW64\Kdgapp32.exeC:\Windows\system32\Kdgapp32.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3768 -
C:\Windows\SysWOW64\Kkaimj32.exeC:\Windows\system32\Kkaimj32.exe102⤵PID:1260
-
C:\Windows\SysWOW64\Keinepch.exeC:\Windows\system32\Keinepch.exe103⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3184 -
C:\Windows\SysWOW64\Knabne32.exeC:\Windows\system32\Knabne32.exe104⤵PID:2568
-
C:\Windows\SysWOW64\Kelkkpae.exeC:\Windows\system32\Kelkkpae.exe105⤵PID:4228
-
C:\Windows\SysWOW64\Kjhccf32.exeC:\Windows\system32\Kjhccf32.exe106⤵PID:1344
-
C:\Windows\SysWOW64\Kengqo32.exeC:\Windows\system32\Kengqo32.exe107⤵PID:3572
-
C:\Windows\SysWOW64\Knfliefc.exeC:\Windows\system32\Knfliefc.exe108⤵PID:2472
-
C:\Windows\SysWOW64\Kgopbj32.exeC:\Windows\system32\Kgopbj32.exe109⤵PID:1688
-
C:\Windows\SysWOW64\Lbddpclj.exeC:\Windows\system32\Lbddpclj.exe110⤵PID:4768
-
C:\Windows\SysWOW64\Lgamhjja.exeC:\Windows\system32\Lgamhjja.exe111⤵PID:2260
-
C:\Windows\SysWOW64\Liqibm32.exeC:\Windows\system32\Liqibm32.exe112⤵
- Drops file in System32 directory
PID:5116 -
C:\Windows\SysWOW64\Ljbfiegb.exeC:\Windows\system32\Ljbfiegb.exe113⤵PID:5648
-
C:\Windows\SysWOW64\Legjgn32.exeC:\Windows\system32\Legjgn32.exe114⤵PID:5388
-
C:\Windows\SysWOW64\Llabchoe.exeC:\Windows\system32\Llabchoe.exe115⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5320 -
C:\Windows\SysWOW64\Lankloml.exeC:\Windows\system32\Lankloml.exe116⤵
- Modifies registry class
PID:4264 -
C:\Windows\SysWOW64\Llcoihmb.exeC:\Windows\system32\Llcoihmb.exe117⤵
- Modifies registry class
PID:5264 -
C:\Windows\SysWOW64\Laqhao32.exeC:\Windows\system32\Laqhao32.exe118⤵
- System Location Discovery: System Language Discovery
PID:4888 -
C:\Windows\SysWOW64\Mlflog32.exeC:\Windows\system32\Mlflog32.exe119⤵PID:5580
-
C:\Windows\SysWOW64\Macdgn32.exeC:\Windows\system32\Macdgn32.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3076 -
C:\Windows\SysWOW64\Mhmmchpd.exeC:\Windows\system32\Mhmmchpd.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-