Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/08/2026, 23:19
Behavioral task
behavioral1
Sample
2026-08-29_f711c1bce083973c317ac5f9c09915a2_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-29_f711c1bce083973c317ac5f9c09915a2_elex_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-29_f711c1bce083973c317ac5f9c09915a2_elex_wannacry.exe
- Size 429KB
- Sample260830-3baxessamd
- SHA256 3cb0756cd34d059532852efc34b6ab62f9018c5a12f87d068486b3a247a8dfba
- MD5 f711c1bce083973c317ac5f9c09915a2
- SHA1 800f4c9e8c97d71b6d183f9259703be4e17e6996
- SHA512 f4aefca595fe00303ed86fc52a5ab1fb9f6e6dbbef6219c568a187ddf69e59a419013fe08ad43dc862d6a0c3a8820ceee88562b3090772c641add81c3dc2d633
- SSDEEP 6144:FuyD9HV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:F0/NcZ7/N
- TLSH T188946E296B3019E6DDEE6BB5AC1249D89081E4B114F1F13E6633DFDCD8E6DA2D805F80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odhman32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qjiaak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fhablf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmcjiagf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hlkmfkli.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akkfop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nnmojj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ehocjo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idfaolpb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mflbdibj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Opqdbhlb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mchpibng.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjdifibo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijadljdg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pjaciafc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkqebg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hbppaopp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Odhipp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdkbgj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eoaianan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eopbghnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lfjjqg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bjnmib32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmenmgab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Onicbi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebdcejpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ehlpjikd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjkipdpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oemephgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Akffjkme.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jcphkhad.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgpaqbcf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bddcocff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Klgqmfpj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lbabpn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hbhjqp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Akkfop32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cadllq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Djcfee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pmiidnko.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgphjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oapljmgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ekggijge.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajckbp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddgpfgil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nnojad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fneohd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fnjhccnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ilafcomm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjhbah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fhljpcfk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hkkhjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qjjhla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lhkghofb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lnohemjm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Maggggaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bdagidhi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dolmijef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qfaiabnp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhihnihm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aqhcid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cpihmmdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Peahpa32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pnaalghe.exe - Executes dropped EXE 64 IoCs
pid Process 4220 Imbaobmp.exe 4892 Ibojgikg.exe 5332 Jabgkpad.exe 2324 Jmihpa32.exe 4672 Jjmhie32.exe 3316 Jplmglbf.exe 4240 Jkaadebl.exe 5228 Kbocng32.exe 2276 Kapclned.exe 4300 Kkkdjcjb.exe 6124 Kdcicipb.exe 2936 Kkmapc32.exe 260 Lajfbmmi.exe 4512 Lckbje32.exe 1224 Lcpledob.exe 4644 Lacihleo.exe 5908 Mgpaqbcf.exe 5620 Mknjgajl.exe 3920 Mahbck32.exe 3796 Mciokcgg.exe 5408 Mkpglqgj.exe 3120 Majoikof.exe 4656 Mcklac32.exe 1448 Mnapnl32.exe 2808 Mdkhkflh.exe 5428 Mkepgp32.exe 5264 Nqaipgal.exe 1676 Nglala32.exe 5000 Njjmil32.exe 1200 Ndpafe32.exe 2468 Nkijbooo.exe 5816 Nacboi32.exe 5232 Ncenga32.exe 2716 Njogdldg.exe 4464 Nqioqf32.exe 5360 Ngbgmpcq.exe 6032 Nnmojj32.exe 1980 Ncihbaie.exe 1276 Njcpok32.exe 5892 Oqmhlego.exe 5388 Oggqho32.exe 2964 Onaieifh.exe 2816 Ocnampdp.exe 1176 Ojhijjll.exe 960 Oboakhmo.exe 5520 Ocqncp32.exe 1552 Ojjfpjjj.exe 6000 Oqdnld32.exe 3572 Ognginic.exe 1816 Onhoehpp.exe 5796 Odbgbb32.exe 5460 Ojopki32.exe 5996 Pqihgcma.exe 3240 Pgcpdn32.exe 4284 Pnmhqh32.exe 4312 Pegqmbch.exe 4012 Pjdifibo.exe 4780 Panabc32.exe 4428 Pghiomqi.exe 4568 Pnaalghe.exe 4388 Peljha32.exe 4592 Pjhbah32.exe 108 Pengna32.exe 240 Pkhokkel.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Klahof32.exe Kfgpblda.exe File created C:\Windows\SysWOW64\Njogdldg.exe Ncenga32.exe File created C:\Windows\SysWOW64\Eefhcimp.exe Elncjc32.exe File created C:\Windows\SysWOW64\Knfkfg32.dll Pdkolm32.exe File created C:\Windows\SysWOW64\Aefjbo32.exe Aolbedeh.exe File opened for modification C:\Windows\SysWOW64\Dojgnpke.exe Ddecpgko.exe File created C:\Windows\SysWOW64\Dndnjllg.exe Dkfanqmd.exe File created C:\Windows\SysWOW64\Pilapm32.dll Fbplgbbb.exe File created C:\Windows\SysWOW64\Jaepgm32.dll Fenhcnaf.exe File created C:\Windows\SysWOW64\Nagbcg32.dll Bjkhme32.exe File created C:\Windows\SysWOW64\Moijhl32.dll Mgfqgkib.exe File opened for modification C:\Windows\SysWOW64\Badipiae.exe Bfoebq32.exe File opened for modification C:\Windows\SysWOW64\Bjnmib32.exe Bcddlhgo.exe File created C:\Windows\SysWOW64\Pnaalghe.exe Pghiomqi.exe File created C:\Windows\SysWOW64\Bjddinbn.exe Bmpcpjcd.exe File created C:\Windows\SysWOW64\Onohgh32.dll Cilmpmki.exe File created C:\Windows\SysWOW64\Oaqbdc32.exe Oobfhh32.exe File opened for modification C:\Windows\SysWOW64\Mflbdibj.exe Mobjho32.exe File created C:\Windows\SysWOW64\Jkaadebl.exe Jplmglbf.exe File opened for modification C:\Windows\SysWOW64\Nphhfp32.exe Njnpie32.exe File created C:\Windows\SysWOW64\Hqpnmlqd.dll Pckpja32.exe File created C:\Windows\SysWOW64\Naaqhlmg.exe Nldhpeop.exe File created C:\Windows\SysWOW64\Leipbg32.exe Lnohemjm.exe File opened for modification C:\Windows\SysWOW64\Nlcaeo32.exe Neiiiecg.exe File created C:\Windows\SysWOW64\Djgbgjdl.dll Ojbamj32.exe File opened for modification C:\Windows\SysWOW64\Calmcg32.exe Conagl32.exe File created C:\Windows\SysWOW64\Fcbdhkme.dll Nqioqf32.exe File created C:\Windows\SysWOW64\Pllggbje.exe Peaokh32.exe File opened for modification C:\Windows\SysWOW64\Eilomd32.exe Ebbfpjbn.exe File opened for modification C:\Windows\SysWOW64\Ncihbaie.exe Nnmojj32.exe File created C:\Windows\SysWOW64\Oiglen32.exe Oghpib32.exe File opened for modification C:\Windows\SysWOW64\Mjpbkc32.exe Mecjbl32.exe File created C:\Windows\SysWOW64\Jehejalg.dll Dbqqeahl.exe File opened for modification C:\Windows\SysWOW64\Leipbg32.exe Lnohemjm.exe File created C:\Windows\SysWOW64\Nflkkf32.exe Nqpccp32.exe File created C:\Windows\SysWOW64\Nggnjl32.dll Aokkknbl.exe File created C:\Windows\SysWOW64\Mcklac32.exe Majoikof.exe File opened for modification C:\Windows\SysWOW64\Mdkhkflh.exe Mnapnl32.exe File opened for modification C:\Windows\SysWOW64\Njjmil32.exe Nglala32.exe File created C:\Windows\SysWOW64\Pjhbah32.exe Peljha32.exe File opened for modification C:\Windows\SysWOW64\Bagmpoco.exe Blkdgheg.exe File created C:\Windows\SysWOW64\Pklcmpbo.dll Dffmogji.exe File created C:\Windows\SysWOW64\Fhlkkb32.dll Ilafcomm.exe File created C:\Windows\SysWOW64\Omnqcfig.exe Ohahkojp.exe File created C:\Windows\SysWOW64\Ekngqqol.exe Deanhj32.exe File opened for modification C:\Windows\SysWOW64\Idpbhc32.exe Inejlibi.exe File created C:\Windows\SysWOW64\Fnihfnfi.dll Dfiiejnl.exe File created C:\Windows\SysWOW64\Eeelge32.exe Ebgpkj32.exe File created C:\Windows\SysWOW64\Fimhcbkh.exe Fbbpgh32.exe File opened for modification C:\Windows\SysWOW64\Gikdep32.exe Gpbplkhh.exe File created C:\Windows\SysWOW64\Ogeklh32.exe Oakbonkb.exe File created C:\Windows\SysWOW64\Dhgogojd.exe Dnajjfjo.exe File created C:\Windows\SysWOW64\Mkdjpbad.dll Cbgbpp32.exe File created C:\Windows\SysWOW64\Dchnan32.dll Dalhgfmk.exe File opened for modification C:\Windows\SysWOW64\Phhhbi32.exe Pckpja32.exe File created C:\Windows\SysWOW64\Pcejlj32.dll Kjkpif32.exe File created C:\Windows\SysWOW64\Himafm32.dll Emphhhoh.exe File created C:\Windows\SysWOW64\Dalhcnfl.dll Aamkgpbi.exe File created C:\Windows\SysWOW64\Pmdgahkj.dll Ekekcjih.exe File created C:\Windows\SysWOW64\Mfoclflo.exe Moglkikl.exe File opened for modification C:\Windows\SysWOW64\Mfejme32.exe Mplapkoj.exe File created C:\Windows\SysWOW64\Dmenne32.dll Nlihek32.exe File opened for modification C:\Windows\SysWOW64\Plbmhadm.exe Plpqba32.exe File opened for modification C:\Windows\SysWOW64\Jggjpgmc.exe Ilafcomm.exe - Program crash 1 IoCs
pid pid_target Process procid_target 10248 10432 WerFault.exe 1094 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojcidelf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikokkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lblakh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Acilkp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bkgleegf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajfhhp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmcilgco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cpihmmdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knaldo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edplapnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkaedk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgpggm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dnkkcmdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmpfla32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hlqmla32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aphngglp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pdmpck32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdolbijg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iempingp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jeaidn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Khmjga32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hglaookl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nejpckgc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmobdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eoaianan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mchhamcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Njploeoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Inkjao32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epdaneff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmomga32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fojenfeg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knpeii32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dddlfa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pqihgcma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mljficpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddgpfgil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpimflqb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hoglmg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajoagadf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phhhbi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnhadnpe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnokhonp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kckqlpck.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qjjhla32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pchcdbck.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Inlibb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnjhccnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkqebg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kggcgeop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kgacaopj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ofijifbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oomnmfid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cadllq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mphoob32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Codhgg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chkokq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bopgdcnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hoobnf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klahof32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oondhocf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajkgmd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eiobmjkd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdnmphag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mcklac32.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 6492 Iempingp.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Digjeg32.dll" Bonjnc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cclhbcho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnjpgeka.dll" Jngjmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Emphhhoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Momjmoid.dll" Onicbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cpmajdig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gciagdlp.dll" Aanjiqki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocimikpg.dll" Bagmpoco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dkbgeb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmhihbcg.dll" Fooecl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfjino32.dll" Gbdgpfni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcfchp32.dll" Ghnpmqef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ammnclcj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Caebfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bfabhppm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpalcgai.dll" Dmdogpmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gngnjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgagcn32.dll" Ckdcli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekcqji32.dll" Neqoidmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ojbamj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pkpmnh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bhpfjh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eefhcimp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mjpbkc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfpmgnmk.dll" Ebdcejpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hehkjpod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abibbnjl.dll" Offnae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fglalp32.dll" Bddcocff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mdjapphl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dhfacp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ppjghgdg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aqmldddb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdhpfleg.dll" Gighom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hakdcjep.dll" Polpim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plfdmnqa.dll" Icdhojka.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Klahof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nldafk32.dll" Imakdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Faemjl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aokkknbl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dabhmo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jjmcghjj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qoecol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ffclml32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bkgleegf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klgmbenp.dll" Hkaedk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jpgmaf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oqfdgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eephkk32.dll" Nedjdp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cbbnim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckifpg32.dll" Cdpjeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paceoa32.dll" Akblpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpibnjck.dll" Dnajjfjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jndmgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Epgndedc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fldnoo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ilnbch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jikfbkbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihbcjk32.dll" Conagl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cncnhh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Imdgjlgb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qfaiabnp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jgonfcnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhcfhnnp.dll" Qodmdb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fgbfbc32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5392 wrote to memory of 4220 5392 2026-08-29_f711c1bce083973c317ac5f9c09915a2_elex_wannacry.exe 89 PID 4220 wrote to memory of 4892 4220 Imbaobmp.exe 90 PID 4892 wrote to memory of 5332 4892 Ibojgikg.exe 91 PID 5332 wrote to memory of 2324 5332 Jabgkpad.exe 92 PID 2324 wrote to memory of 4672 2324 Jmihpa32.exe 93 PID 4672 wrote to memory of 3316 4672 Jjmhie32.exe 94 PID 3316 wrote to memory of 4240 3316 Jplmglbf.exe 95 PID 4240 wrote to memory of 5228 4240 Jkaadebl.exe 96 PID 5228 wrote to memory of 2276 5228 Kbocng32.exe 97 PID 2276 wrote to memory of 4300 2276 Kapclned.exe 98 PID 4300 wrote to memory of 6124 4300 Kkkdjcjb.exe 99 PID 6124 wrote to memory of 2936 6124 Kdcicipb.exe 100 PID 2936 wrote to memory of 260 2936 Kkmapc32.exe 101 PID 260 wrote to memory of 4512 260 Lajfbmmi.exe 102 PID 4512 wrote to memory of 1224 4512 Lckbje32.exe 103 PID 1224 wrote to memory of 4644 1224 Lcpledob.exe 104 PID 4644 wrote to memory of 5908 4644 Lacihleo.exe 105 PID 5908 wrote to memory of 5620 5908 Mgpaqbcf.exe 106 PID 5620 wrote to memory of 3920 5620 Mknjgajl.exe 107 PID 3920 wrote to memory of 3796 3920 Mahbck32.exe 108 PID 3796 wrote to memory of 5408 3796 Mciokcgg.exe 109 PID 5408 wrote to memory of 3120 5408 Mkpglqgj.exe 110 PID 3120 wrote to memory of 4656 3120 Majoikof.exe 111 PID 4656 wrote to memory of 1448 4656 Mcklac32.exe 112 PID 1448 wrote to memory of 2808 1448 Mnapnl32.exe 113 PID 2808 wrote to memory of 5428 2808 Mdkhkflh.exe 114 PID 5428 wrote to memory of 5264 5428 Mkepgp32.exe 115 PID 5264 wrote to memory of 1676 5264 Nqaipgal.exe 116 PID 1676 wrote to memory of 5000 1676 Nglala32.exe 117 PID 5000 wrote to memory of 1200 5000 Njjmil32.exe 118 PID 1200 wrote to memory of 2468 1200 Ndpafe32.exe 119 PID 2468 wrote to memory of 5816 2468 Nkijbooo.exe 120 PID 5816 wrote to memory of 5232 5816 Nacboi32.exe 121 PID 5232 wrote to memory of 2716 5232 Ncenga32.exe 122 PID 2716 wrote to memory of 4464 2716 Njogdldg.exe 123 PID 4464 wrote to memory of 5360 4464 Nqioqf32.exe 124 PID 5360 wrote to memory of 6032 5360 Ngbgmpcq.exe 125 PID 6032 wrote to memory of 1980 6032 Nnmojj32.exe 126 PID 1980 wrote to memory of 1276 1980 Ncihbaie.exe 127 PID 1276 wrote to memory of 5892 1276 Njcpok32.exe 128 PID 5892 wrote to memory of 5388 5892 Oqmhlego.exe 129 PID 5388 wrote to memory of 2964 5388 Oggqho32.exe 130 PID 2964 wrote to memory of 2816 2964 Onaieifh.exe 131 PID 2816 wrote to memory of 1176 2816 Ocnampdp.exe 132 PID 1176 wrote to memory of 960 1176 Ojhijjll.exe 133 PID 960 wrote to memory of 5520 960 Oboakhmo.exe 134 PID 5520 wrote to memory of 1552 5520 Ocqncp32.exe 135 PID 1552 wrote to memory of 6000 1552 Ojjfpjjj.exe 136 PID 6000 wrote to memory of 3572 6000 Oqdnld32.exe 137 PID 3572 wrote to memory of 1816 3572 Ognginic.exe 138 PID 1816 wrote to memory of 5796 1816 Onhoehpp.exe 139 PID 5796 wrote to memory of 5460 5796 Odbgbb32.exe 140 PID 5460 wrote to memory of 5996 5460 Ojopki32.exe 141 PID 5996 wrote to memory of 3240 5996 Pqihgcma.exe 142 PID 3240 wrote to memory of 4284 3240 Pgcpdn32.exe 143 PID 4284 wrote to memory of 4312 4284 Pnmhqh32.exe 144 PID 4312 wrote to memory of 4012 4312 Pegqmbch.exe 145 PID 4012 wrote to memory of 4780 4012 Pjdifibo.exe 146 PID 4780 wrote to memory of 4428 4780 Panabc32.exe 147 PID 4428 wrote to memory of 4568 4428 Pghiomqi.exe 148 PID 4568 wrote to memory of 4388 4568 Pnaalghe.exe 149 PID 4388 wrote to memory of 4592 4388 Peljha32.exe 150 PID 4592 wrote to memory of 108 4592 Pjhbah32.exe 151 PID 108 wrote to memory of 240 108 Pengna32.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-29_f711c1bce083973c317ac5f9c09915a2_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-29_f711c1bce083973c317ac5f9c09915a2_elex_wannacry.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SysWOW64\Imbaobmp.exeC:\Windows\system32\Imbaobmp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\Ibojgikg.exeC:\Windows\system32\Ibojgikg.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\Jabgkpad.exeC:\Windows\system32\Jabgkpad.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Windows\SysWOW64\Jmihpa32.exeC:\Windows\system32\Jmihpa32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\Jjmhie32.exeC:\Windows\system32\Jjmhie32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\Jplmglbf.exeC:\Windows\system32\Jplmglbf.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\Jkaadebl.exeC:\Windows\system32\Jkaadebl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\Kbocng32.exeC:\Windows\system32\Kbocng32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Windows\SysWOW64\Kapclned.exeC:\Windows\system32\Kapclned.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\Kkkdjcjb.exeC:\Windows\system32\Kkkdjcjb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\Kdcicipb.exeC:\Windows\system32\Kdcicipb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\SysWOW64\Kkmapc32.exeC:\Windows\system32\Kkmapc32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\Lajfbmmi.exeC:\Windows\system32\Lajfbmmi.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\Lckbje32.exeC:\Windows\system32\Lckbje32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\Lcpledob.exeC:\Windows\system32\Lcpledob.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\Lacihleo.exeC:\Windows\system32\Lacihleo.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\Mgpaqbcf.exeC:\Windows\system32\Mgpaqbcf.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Windows\SysWOW64\Mknjgajl.exeC:\Windows\system32\Mknjgajl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\SysWOW64\Mahbck32.exeC:\Windows\system32\Mahbck32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\Mciokcgg.exeC:\Windows\system32\Mciokcgg.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\Mkpglqgj.exeC:\Windows\system32\Mkpglqgj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\SysWOW64\Majoikof.exeC:\Windows\system32\Majoikof.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\Mcklac32.exeC:\Windows\system32\Mcklac32.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\Mnapnl32.exeC:\Windows\system32\Mnapnl32.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\Mdkhkflh.exeC:\Windows\system32\Mdkhkflh.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\Mkepgp32.exeC:\Windows\system32\Mkepgp32.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Windows\SysWOW64\Nqaipgal.exeC:\Windows\system32\Nqaipgal.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Windows\SysWOW64\Nglala32.exeC:\Windows\system32\Nglala32.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\Njjmil32.exeC:\Windows\system32\Njjmil32.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\Ndpafe32.exeC:\Windows\system32\Ndpafe32.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\Nkijbooo.exeC:\Windows\system32\Nkijbooo.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\Nacboi32.exeC:\Windows\system32\Nacboi32.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\Ncenga32.exeC:\Windows\system32\Ncenga32.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Windows\SysWOW64\Njogdldg.exeC:\Windows\system32\Njogdldg.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\Nqioqf32.exeC:\Windows\system32\Nqioqf32.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\Ngbgmpcq.exeC:\Windows\system32\Ngbgmpcq.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Windows\SysWOW64\Nnmojj32.exeC:\Windows\system32\Nnmojj32.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\Ncihbaie.exeC:\Windows\system32\Ncihbaie.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\Njcpok32.exeC:\Windows\system32\Njcpok32.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\Oqmhlego.exeC:\Windows\system32\Oqmhlego.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Windows\SysWOW64\Oggqho32.exeC:\Windows\system32\Oggqho32.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Windows\SysWOW64\Onaieifh.exeC:\Windows\system32\Onaieifh.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\Ocnampdp.exeC:\Windows\system32\Ocnampdp.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\Ojhijjll.exeC:\Windows\system32\Ojhijjll.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\Oboakhmo.exeC:\Windows\system32\Oboakhmo.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\Ocqncp32.exeC:\Windows\system32\Ocqncp32.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Windows\SysWOW64\Ojjfpjjj.exeC:\Windows\system32\Ojjfpjjj.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\Oqdnld32.exeC:\Windows\system32\Oqdnld32.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\Ognginic.exeC:\Windows\system32\Ognginic.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\Onhoehpp.exeC:\Windows\system32\Onhoehpp.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\Odbgbb32.exeC:\Windows\system32\Odbgbb32.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Windows\SysWOW64\Ojopki32.exeC:\Windows\system32\Ojopki32.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Windows\SysWOW64\Pqihgcma.exeC:\Windows\system32\Pqihgcma.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\Pgcpdn32.exeC:\Windows\system32\Pgcpdn32.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\Pnmhqh32.exeC:\Windows\system32\Pnmhqh32.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\Pegqmbch.exeC:\Windows\system32\Pegqmbch.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\Pjdifibo.exeC:\Windows\system32\Pjdifibo.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\SysWOW64\Panabc32.exeC:\Windows\system32\Panabc32.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\Pghiomqi.exeC:\Windows\system32\Pghiomqi.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\Pnaalghe.exeC:\Windows\system32\Pnaalghe.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\Peljha32.exeC:\Windows\system32\Peljha32.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\Pjhbah32.exeC:\Windows\system32\Pjhbah32.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\Pengna32.exeC:\Windows\system32\Pengna32.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\Pkhokkel.exeC:\Windows\system32\Pkhokkel.exe65⤵
- Executes dropped EXE
PID:240 -
C:\Windows\SysWOW64\Qbbggeli.exeC:\Windows\system32\Qbbggeli.exe66⤵PID:5972
-
C:\Windows\SysWOW64\Qcccom32.exeC:\Windows\system32\Qcccom32.exe67⤵PID:1540
-
C:\Windows\SysWOW64\Qnihlf32.exeC:\Windows\system32\Qnihlf32.exe68⤵PID:6008
-
C:\Windows\SysWOW64\Qebpipij.exeC:\Windows\system32\Qebpipij.exe69⤵PID:1388
-
C:\Windows\SysWOW64\Qlmhfj32.exeC:\Windows\system32\Qlmhfj32.exe70⤵PID:3044
-
C:\Windows\SysWOW64\Abfqbdhd.exeC:\Windows\system32\Abfqbdhd.exe71⤵PID:3404
-
C:\Windows\SysWOW64\Agcikk32.exeC:\Windows\system32\Agcikk32.exe72⤵PID:1092
-
C:\Windows\SysWOW64\Aanjiqki.exeC:\Windows\system32\Aanjiqki.exe73⤵
- Modifies registry class
PID:5792 -
C:\Windows\SysWOW64\Ahhbfkbf.exeC:\Windows\system32\Ahhbfkbf.exe74⤵PID:3128
-
C:\Windows\SysWOW64\Anbkbe32.exeC:\Windows\system32\Anbkbe32.exe75⤵PID:3304
-
C:\Windows\SysWOW64\Ajikhfpg.exeC:\Windows\system32\Ajikhfpg.exe76⤵PID:1720
-
C:\Windows\SysWOW64\Bjkhme32.exeC:\Windows\system32\Bjkhme32.exe77⤵
- Drops file in System32 directory
PID:2556 -
C:\Windows\SysWOW64\Blkdgheg.exeC:\Windows\system32\Blkdgheg.exe78⤵
- Drops file in System32 directory
PID:5852 -
C:\Windows\SysWOW64\Bagmpoco.exeC:\Windows\system32\Bagmpoco.exe79⤵
- Modifies registry class
PID:2876 -
C:\Windows\SysWOW64\Bjpaheio.exeC:\Windows\system32\Bjpaheio.exe80⤵PID:1736
-
C:\Windows\SysWOW64\Bonjnc32.exeC:\Windows\system32\Bonjnc32.exe81⤵
- Modifies registry class
PID:1408 -
C:\Windows\SysWOW64\Bdkbgj32.exeC:\Windows\system32\Bdkbgj32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5028 -
C:\Windows\SysWOW64\Bopgdcnc.exeC:\Windows\system32\Bopgdcnc.exe83⤵
- System Location Discovery: System Language Discovery
PID:4620 -
C:\Windows\SysWOW64\Cdolbijg.exeC:\Windows\system32\Cdolbijg.exe84⤵
- System Location Discovery: System Language Discovery
PID:2388 -
C:\Windows\SysWOW64\Ceoillaj.exeC:\Windows\system32\Ceoillaj.exe85⤵PID:3984
-
C:\Windows\SysWOW64\Cogmdb32.exeC:\Windows\system32\Cogmdb32.exe86⤵PID:4320
-
C:\Windows\SysWOW64\Cbefkp32.exeC:\Windows\system32\Cbefkp32.exe87⤵PID:4900
-
C:\Windows\SysWOW64\Chbncg32.exeC:\Windows\system32\Chbncg32.exe88⤵PID:3892
-
C:\Windows\SysWOW64\Cbgbpp32.exeC:\Windows\system32\Cbgbpp32.exe89⤵
- Drops file in System32 directory
PID:5180 -
C:\Windows\SysWOW64\Dkbgeb32.exeC:\Windows\system32\Dkbgeb32.exe90⤵
- Modifies registry class
PID:5056 -
C:\Windows\SysWOW64\Dehkbkip.exeC:\Windows\system32\Dehkbkip.exe91⤵PID:4896
-
C:\Windows\SysWOW64\Dkedjbgg.exeC:\Windows\system32\Dkedjbgg.exe92⤵PID:6036
-
C:\Windows\SysWOW64\Daolgl32.exeC:\Windows\system32\Daolgl32.exe93⤵PID:4424
-
C:\Windows\SysWOW64\Dldpde32.exeC:\Windows\system32\Dldpde32.exe94⤵PID:4516
-
C:\Windows\SysWOW64\Ddpeigle.exeC:\Windows\system32\Ddpeigle.exe95⤵PID:4968
-
C:\Windows\SysWOW64\Dkjmea32.exeC:\Windows\system32\Dkjmea32.exe96⤵PID:5448
-
C:\Windows\SysWOW64\Dacebkko.exeC:\Windows\system32\Dacebkko.exe97⤵PID:5100
-
C:\Windows\SysWOW64\Dlijodjd.exeC:\Windows\system32\Dlijodjd.exe98⤵PID:5076
-
C:\Windows\SysWOW64\Deanhj32.exeC:\Windows\system32\Deanhj32.exe99⤵
- Drops file in System32 directory
PID:4432 -
C:\Windows\SysWOW64\Ekngqqol.exeC:\Windows\system32\Ekngqqol.exe100⤵PID:3252
-
C:\Windows\SysWOW64\Eedkniob.exeC:\Windows\system32\Eedkniob.exe101⤵PID:2988
-
C:\Windows\SysWOW64\Elncjc32.exeC:\Windows\system32\Elncjc32.exe102⤵
- Drops file in System32 directory
PID:2972 -
C:\Windows\SysWOW64\Eefhcimp.exeC:\Windows\system32\Eefhcimp.exe103⤵
- Modifies registry class
PID:5784 -
C:\Windows\SysWOW64\Eoollocp.exeC:\Windows\system32\Eoollocp.exe104⤵PID:4556
-
C:\Windows\SysWOW64\Eehdii32.exeC:\Windows\system32\Eehdii32.exe105⤵PID:2260
-
C:\Windows\SysWOW64\Eoaianan.exeC:\Windows\system32\Eoaianan.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:5492 -
C:\Windows\SysWOW64\Ednajepe.exeC:\Windows\system32\Ednajepe.exe107⤵PID:1444
-
C:\Windows\SysWOW64\Eocegn32.exeC:\Windows\system32\Eocegn32.exe108⤵PID:5368
-
C:\Windows\SysWOW64\Fhljpcfk.exeC:\Windows\system32\Fhljpcfk.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3116 -
C:\Windows\SysWOW64\Fcanmlea.exeC:\Windows\system32\Fcanmlea.exe110⤵PID:3544
-
C:\Windows\SysWOW64\Fljcfa32.exeC:\Windows\system32\Fljcfa32.exe111⤵PID:4352
-
C:\Windows\SysWOW64\Fafkoiji.exeC:\Windows\system32\Fafkoiji.exe112⤵PID:5352
-
C:\Windows\SysWOW64\Fllplajo.exeC:\Windows\system32\Fllplajo.exe113⤵PID:5624
-
C:\Windows\SysWOW64\Fcfhhk32.exeC:\Windows\system32\Fcfhhk32.exe114⤵PID:6132
-
C:\Windows\SysWOW64\Fhbpqb32.exeC:\Windows\system32\Fhbpqb32.exe115⤵PID:4436
-
C:\Windows\SysWOW64\Fchdnkpi.exeC:\Windows\system32\Fchdnkpi.exe116⤵PID:4972
-
C:\Windows\SysWOW64\Fhemfbnq.exeC:\Windows\system32\Fhemfbnq.exe117⤵PID:4244
-
C:\Windows\SysWOW64\Fooecl32.exeC:\Windows\system32\Fooecl32.exe118⤵
- Modifies registry class
PID:4692 -
C:\Windows\SysWOW64\Gfimpfmj.exeC:\Windows\system32\Gfimpfmj.exe119⤵PID:4488
-
C:\Windows\SysWOW64\Goabhl32.exeC:\Windows\system32\Goabhl32.exe120⤵PID:5872
-
C:\Windows\SysWOW64\Gdnjabab.exeC:\Windows\system32\Gdnjabab.exe121⤵PID:4768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-