Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 09:27
Behavioral task
behavioral1
Sample
2026-09-30_95b09965176a1983cb3d13f6b22e61a1_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_95b09965176a1983cb3d13f6b22e61a1_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-09-30_95b09965176a1983cb3d13f6b22e61a1_elex_wannacry.exe
- Size 429KB
- Sample260930-lew6dstsd1
- SHA256 0a4dbdf858511cb6c43f0501b0da257c7071b3ed28412f47709ca514106bc34a
- MD5 95b09965176a1983cb3d13f6b22e61a1
- SHA1 c42271e265b5536f2f2d6dede6f3da8ecae084da
- SHA512 d4fdd8e340653cb8e2f891b1bc4fc76c070986d90d5cc96669de88f1c36faba782baa8b58c91f95e72b5df2d1ef44c1eef19509e7cffb0be916a76fe9c6d9768
- SSDEEP 6144:WmXr7fcV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:XF/NcZ7/N
- TLSH T19A9460656A311AE6DDEE6BB5AC1249D98182E9B104F1F23E5633DFDCC8E4DA1CC05F80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mnanpfdo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dbgnobpg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Goepgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hefneq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ppeikjle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Felkmnci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gbofmmmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Doanno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hfaaddlo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Holfhfij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pnkbdqpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hchickeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nladpo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Alnfiifd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fnipliip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ichkpb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lcbfmomc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Knlbipjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ndaboafl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfkmdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Holfhfij.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jlqohhja.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oclkqihc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Adoamfhn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bkgekock.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jlmfomcp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oeehdcij.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Domdcpib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kckqlpck.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Njjdae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ofcale32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhdaao32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Elienf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fdnipbbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hmicee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Inlibb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dmjole32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emoanbll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jenmlmll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oclkqihc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Emknmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jpdhdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Knoonphp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lnadkmhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oagpne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bnhegp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glgckl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jekqgnno.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ingpgcmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Idahcm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onkphi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dbicjlji.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Doanno32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eeelge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jgfcfajg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjmjnb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 2026-09-30_95b09965176a1983cb3d13f6b22e61a1_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ddjmkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fechhcal.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngeaej32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmpoemef.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afpjoaeo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdjqienq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdfpdc32.exe - Executes dropped EXE 64 IoCs
pid Process 3356 Cjbfdakf.exe 4548 Cihcen32.exe 5704 Cbphncfo.exe 108 Cmflkl32.exe 5168 Cjjlep32.exe 3488 Cbeaib32.exe 4868 Dkmebh32.exe 1820 Dbgnobpg.exe 5104 Dkpbgh32.exe 2436 Dpphcf32.exe 3596 Dflmep32.exe 5512 Elienf32.exe 2412 Elkbcf32.exe 5272 Ebejpp32.exe 1056 Emknmi32.exe 3312 Ebggep32.exe 3700 Eiaobjia.exe 3564 Ebjckppa.exe 2184 Elbhde32.exe 3044 Efhlan32.exe 1940 Fldeie32.exe 3724 Fjfegl32.exe 4968 Fdnipbbo.exe 5944 Fikbhiaf.exe 4420 Fdqffaql.exe 4220 Fimonh32.exe 5060 Fpggkbfq.exe 6068 Fjmkhkff.exe 5300 Fdepaa32.exe 5772 Gmndjf32.exe 1276 Gbjlbm32.exe 2668 Glbakchp.exe 2304 Gmbmefob.exe 848 Gbofmmmj.exe 4876 Gmdjjemp.exe 5216 Gbabblkg.exe 2832 Gljgkb32.exe 4492 Hgokikan.exe 2016 Hmicee32.exe 1360 Hdclbopg.exe 4424 Hlnqfanb.exe 4024 Hchickeo.exe 2776 Hmnmqdee.exe 4664 Hdhemn32.exe 6120 Hkbmjhdo.exe 4604 Hpofbobf.exe 2800 Hkdjph32.exe 5544 Hlefgphj.exe 6116 Igkkdigp.exe 3004 Ilhcmpeg.exe 1816 Icalij32.exe 4572 Ingpgcmj.exe 4304 Idahcm32.exe 1128 Injmlbkh.exe 6104 Igbaeh32.exe 5436 Inlibb32.exe 4892 Igdnkhoe.exe 4068 Innfgb32.exe 5728 Jdhndlno.exe 3336 Jjeflc32.exe 5116 Jpooimdc.exe 1204 Jkdcffci.exe 5620 Jpalomaq.exe 5504 Jkgpleaf.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Nhheepbk.exe Nmbaggce.exe File created C:\Windows\SysWOW64\Ogedcm32.dll Cfkmdl32.exe File opened for modification C:\Windows\SysWOW64\Aabafkgh.exe Adoamfhn.exe File created C:\Windows\SysWOW64\Pbfkdhnj.dll Cnaachha.exe File created C:\Windows\SysWOW64\Ifabik32.dll Oeehdcij.exe File created C:\Windows\SysWOW64\Blgiphni.exe Bemqcngl.exe File opened for modification C:\Windows\SysWOW64\Kkbohc32.exe Kdigkjpl.exe File created C:\Windows\SysWOW64\Mpjpaeha.dll Mminaikp.exe File created C:\Windows\SysWOW64\Ancbnhae.dll Ohkkanbe.exe File created C:\Windows\SysWOW64\Ohfkehcl.dll Anobaa32.exe File created C:\Windows\SysWOW64\Oclkqihc.exe Onochbjl.exe File opened for modification C:\Windows\SysWOW64\Kcpqafba.exe Kmfhelke.exe File opened for modification C:\Windows\SysWOW64\Dmjole32.exe Dfpfokfg.exe File created C:\Windows\SysWOW64\Diclff32.exe Dbicjlji.exe File created C:\Windows\SysWOW64\Fechhcal.exe Fnipliip.exe File created C:\Windows\SysWOW64\Hbgdnn32.dll Ofcale32.exe File created C:\Windows\SysWOW64\Abibbnjl.dll Ogcnfheb.exe File created C:\Windows\SysWOW64\Ehndhn32.exe Ebdlkdlp.exe File opened for modification C:\Windows\SysWOW64\Mnanpfdo.exe Lmaafcml.exe File created C:\Windows\SysWOW64\Fdepaa32.exe Fjmkhkff.exe File created C:\Windows\SysWOW64\Knioij32.exe Johnkbaj.exe File created C:\Windows\SysWOW64\Efgofpbf.dll Npbcollj.exe File opened for modification C:\Windows\SysWOW64\Dflmep32.exe Dpphcf32.exe File opened for modification C:\Windows\SysWOW64\Fdepaa32.exe Fjmkhkff.exe File created C:\Windows\SysWOW64\Chbcphph.exe Bnmobopb.exe File opened for modification C:\Windows\SysWOW64\Ddjmkg32.exe Domdcpib.exe File created C:\Windows\SysWOW64\Fnacqc32.exe Fiekhm32.exe File opened for modification C:\Windows\SysWOW64\Oloaamqf.exe Oeehdcij.exe File created C:\Windows\SysWOW64\Ohkkanbe.exe Oaqbdc32.exe File opened for modification C:\Windows\SysWOW64\Emjgcc32.exe Efpofi32.exe File created C:\Windows\SysWOW64\Pnkbdqpo.exe Pdenghpi.exe File opened for modification C:\Windows\SysWOW64\Emknmi32.exe Ebejpp32.exe File created C:\Windows\SysWOW64\Afknipda.dll Nnmdfknm.exe File created C:\Windows\SysWOW64\Qaalkamf.exe Qkgcog32.exe File created C:\Windows\SysWOW64\Bbhppf32.dll Glbjpmdd.exe File opened for modification C:\Windows\SysWOW64\Llmhkd32.exe Lfbpnjjd.exe File created C:\Windows\SysWOW64\Elidlmdb.dll Ehndhn32.exe File opened for modification C:\Windows\SysWOW64\Cbphncfo.exe Cihcen32.exe File created C:\Windows\SysWOW64\Cmflkl32.exe Cbphncfo.exe File opened for modification C:\Windows\SysWOW64\Fimonh32.exe Fdqffaql.exe File opened for modification C:\Windows\SysWOW64\Hchickeo.exe Hlnqfanb.exe File created C:\Windows\SysWOW64\Dfpppj32.dll Jnhinq32.exe File created C:\Windows\SysWOW64\Agkejbik.dll Lnjnjn32.exe File created C:\Windows\SysWOW64\Hpohkn32.dll Lgblhmag.exe File opened for modification C:\Windows\SysWOW64\Nfjofg32.exe Nmajmaoi.exe File opened for modification C:\Windows\SysWOW64\Lcejmeol.exe Ljmfdp32.exe File opened for modification C:\Windows\SysWOW64\Ndcoeq32.exe Nmighf32.exe File opened for modification C:\Windows\SysWOW64\Ekhncp32.exe Eenfff32.exe File opened for modification C:\Windows\SysWOW64\Fihnhc32.exe Fnbjkj32.exe File created C:\Windows\SysWOW64\Eppaheep.dll Nflkkf32.exe File created C:\Windows\SysWOW64\Oakbonkb.exe Ogcnfheb.exe File created C:\Windows\SysWOW64\Cbphncfo.exe Cihcen32.exe File created C:\Windows\SysWOW64\Kgbjlf32.exe Jlmfomcp.exe File created C:\Windows\SysWOW64\Lclpmdhd.exe Lnohemjm.exe File created C:\Windows\SysWOW64\Cngjlj32.dll Bnhegp32.exe File created C:\Windows\SysWOW64\Qmnpoa32.dll Glgckl32.exe File created C:\Windows\SysWOW64\Pmeimo32.dll Jepjbm32.exe File created C:\Windows\SysWOW64\Kflink32.exe Kpoaed32.exe File created C:\Windows\SysWOW64\Mmkdlbea.exe Mogccnfg.exe File opened for modification C:\Windows\SysWOW64\Eiaobjia.exe Ebggep32.exe File created C:\Windows\SysWOW64\Femcdp32.dll Fdqffaql.exe File created C:\Windows\SysWOW64\Ohfffg32.dll Chbcphph.exe File created C:\Windows\SysWOW64\Cfjehfda.dll Enkdjkep.exe File opened for modification C:\Windows\SysWOW64\Ffgegh32.exe Fnpmej32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 9976 9816 WerFault.exe 444 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lmaafcml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lcjchd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Komhfa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bkgekock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckphamkp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Foclpf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkbohc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lcggbd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhheepbk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oloaamqf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Paelpcgc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ipbhch32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chibfa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Egcaij32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ingpgcmj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jlmfomcp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnohemjm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnadkmhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Domdcpib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hlipal32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iepako32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ppeikjle.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cjbfdakf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chglkg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Glgckl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgfcfajg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oapljmgm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ehndhn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnacqc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oakbonkb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkbmjhdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Peokkbao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckclacmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekoddodi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnpmej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qpahghbg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dnkkcmdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Himqjpme.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ogcnfheb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dgeegled.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fiekhm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekhncp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cbeaib32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebjckppa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knfeoobh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aonokdce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bohbackj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmpoemef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qjfmda32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbgnobpg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hlnqfanb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ompmie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cofnba32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmancbji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cneknh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gljgkb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oagpne32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pecefa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chbcphph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cbmdnmdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jenmlmll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjblcj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Neglceej.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ndaboafl.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkjnib32.dll" Adiknkco.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nfjofg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpdjlm32.dll" Onochbjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmamgp32.dll" Hkbmjhdo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fmancbji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjnklh32.dll" Gppcfk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Njjdae32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eoagdi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehqfcf32.dll" Emknmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mjhepnno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hljhbd32.dll" Bllbkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djjmpi32.dll" Dbnmek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Glbjpmdd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gifjjacn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlijdbin.dll" Nfjofg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Chibfa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jjeflc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jklkea32.dll" Lcejmeol.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aonokdce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okdaeocb.dll" Kokkqbog.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cneknh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eomgkc32.dll" Dahmoefm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fgenoj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hchickeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dkcehaof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkbldhic.dll" Knlknigf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pjhpccnn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bhnidi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfbphcke.dll" Aahblp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lidqbadl.dll" Jocepc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcfcjdfi.dll" Knioij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkelbl32.dll" Njjdae32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bdjqienq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cnaachha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Almblpfa.dll" Lcggbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ekoddodi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hifcqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ibohid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pflfmdog.dll" Lqjqab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jqofjd32.dll" Oakbonkb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bpcnceab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ingpgcmj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mnhkklbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Colklb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ckeigc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nnmmleja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpbdjgcj.dll" Akpojpic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cihcen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kkbohc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ekhncp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Emoanbll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihfnho32.dll" Hlipal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hbchnfei.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Holfhfij.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Igomeb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fdqffaql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hkbmjhdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Igkkdigp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahcmje32.dll" Meepne32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Poimigfm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fpbfem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Himqjpme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgmejc32.dll" Kjblcj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cjbfdakf.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5572 wrote to memory of 3356 5572 2026-09-30_95b09965176a1983cb3d13f6b22e61a1_elex_wannacry.exe 87 PID 3356 wrote to memory of 4548 3356 Cjbfdakf.exe 89 PID 4548 wrote to memory of 5704 4548 Cihcen32.exe 90 PID 5704 wrote to memory of 108 5704 Cbphncfo.exe 91 PID 108 wrote to memory of 5168 108 Cmflkl32.exe 92 PID 5168 wrote to memory of 3488 5168 Cjjlep32.exe 93 PID 3488 wrote to memory of 4868 3488 Cbeaib32.exe 94 PID 4868 wrote to memory of 1820 4868 Dkmebh32.exe 95 PID 1820 wrote to memory of 5104 1820 Dbgnobpg.exe 96 PID 5104 wrote to memory of 2436 5104 Dkpbgh32.exe 97 PID 2436 wrote to memory of 3596 2436 Dpphcf32.exe 98 PID 3596 wrote to memory of 5512 3596 Dflmep32.exe 99 PID 5512 wrote to memory of 2412 5512 Elienf32.exe 100 PID 2412 wrote to memory of 5272 2412 Elkbcf32.exe 101 PID 5272 wrote to memory of 1056 5272 Ebejpp32.exe 102 PID 1056 wrote to memory of 3312 1056 Emknmi32.exe 103 PID 3312 wrote to memory of 3700 3312 Ebggep32.exe 104 PID 3700 wrote to memory of 3564 3700 Eiaobjia.exe 105 PID 3564 wrote to memory of 2184 3564 Ebjckppa.exe 106 PID 2184 wrote to memory of 3044 2184 Elbhde32.exe 107 PID 3044 wrote to memory of 1940 3044 Efhlan32.exe 108 PID 1940 wrote to memory of 3724 1940 Fldeie32.exe 109 PID 3724 wrote to memory of 4968 3724 Fjfegl32.exe 110 PID 4968 wrote to memory of 5944 4968 Fdnipbbo.exe 111 PID 5944 wrote to memory of 4420 5944 Fikbhiaf.exe 112 PID 4420 wrote to memory of 4220 4420 Fdqffaql.exe 113 PID 4220 wrote to memory of 5060 4220 Fimonh32.exe 114 PID 5060 wrote to memory of 6068 5060 Fpggkbfq.exe 115 PID 6068 wrote to memory of 5300 6068 Fjmkhkff.exe 116 PID 5300 wrote to memory of 5772 5300 Fdepaa32.exe 117 PID 5772 wrote to memory of 1276 5772 Gmndjf32.exe 118 PID 1276 wrote to memory of 2668 1276 Gbjlbm32.exe 119 PID 2668 wrote to memory of 2304 2668 Glbakchp.exe 120 PID 2304 wrote to memory of 848 2304 Gmbmefob.exe 121 PID 848 wrote to memory of 4876 848 Gbofmmmj.exe 122 PID 4876 wrote to memory of 5216 4876 Gmdjjemp.exe 123 PID 5216 wrote to memory of 2832 5216 Gbabblkg.exe 124 PID 2832 wrote to memory of 4492 2832 Gljgkb32.exe 125 PID 4492 wrote to memory of 2016 4492 Hgokikan.exe 126 PID 2016 wrote to memory of 1360 2016 Hmicee32.exe 127 PID 1360 wrote to memory of 4424 1360 Hdclbopg.exe 128 PID 4424 wrote to memory of 4024 4424 Hlnqfanb.exe 129 PID 4024 wrote to memory of 2776 4024 Hchickeo.exe 130 PID 2776 wrote to memory of 4664 2776 Hmnmqdee.exe 131 PID 4664 wrote to memory of 6120 4664 Hdhemn32.exe 132 PID 6120 wrote to memory of 4604 6120 Hkbmjhdo.exe 133 PID 4604 wrote to memory of 2800 4604 Hpofbobf.exe 134 PID 2800 wrote to memory of 5544 2800 Hkdjph32.exe 135 PID 5544 wrote to memory of 6116 5544 Hlefgphj.exe 136 PID 6116 wrote to memory of 3004 6116 Igkkdigp.exe 137 PID 3004 wrote to memory of 1816 3004 Ilhcmpeg.exe 138 PID 1816 wrote to memory of 4572 1816 Icalij32.exe 139 PID 4572 wrote to memory of 4304 4572 Ingpgcmj.exe 140 PID 4304 wrote to memory of 1128 4304 Idahcm32.exe 141 PID 1128 wrote to memory of 6104 1128 Injmlbkh.exe 142 PID 6104 wrote to memory of 5436 6104 Igbaeh32.exe 143 PID 5436 wrote to memory of 4892 5436 Inlibb32.exe 144 PID 4892 wrote to memory of 4068 4892 Igdnkhoe.exe 145 PID 4068 wrote to memory of 5728 4068 Innfgb32.exe 146 PID 5728 wrote to memory of 3336 5728 Jdhndlno.exe 147 PID 3336 wrote to memory of 5116 3336 Jjeflc32.exe 148 PID 5116 wrote to memory of 1204 5116 Jpooimdc.exe 149 PID 1204 wrote to memory of 5620 1204 Jkdcffci.exe 150 PID 5620 wrote to memory of 5504 5620 Jpalomaq.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_95b09965176a1983cb3d13f6b22e61a1_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_95b09965176a1983cb3d13f6b22e61a1_elex_wannacry.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Windows\SysWOW64\Cjbfdakf.exeC:\Windows\system32\Cjbfdakf.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\Cihcen32.exeC:\Windows\system32\Cihcen32.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\Cbphncfo.exeC:\Windows\system32\Cbphncfo.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\SysWOW64\Cmflkl32.exeC:\Windows\system32\Cmflkl32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\Cjjlep32.exeC:\Windows\system32\Cjjlep32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Windows\SysWOW64\Cbeaib32.exeC:\Windows\system32\Cbeaib32.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\Dkmebh32.exeC:\Windows\system32\Dkmebh32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\Dbgnobpg.exeC:\Windows\system32\Dbgnobpg.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\Dkpbgh32.exeC:\Windows\system32\Dkpbgh32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\Dpphcf32.exeC:\Windows\system32\Dpphcf32.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\Dflmep32.exeC:\Windows\system32\Dflmep32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\Elienf32.exeC:\Windows\system32\Elienf32.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Windows\SysWOW64\Elkbcf32.exeC:\Windows\system32\Elkbcf32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\Ebejpp32.exeC:\Windows\system32\Ebejpp32.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Windows\SysWOW64\Emknmi32.exeC:\Windows\system32\Emknmi32.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\Ebggep32.exeC:\Windows\system32\Ebggep32.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\Eiaobjia.exeC:\Windows\system32\Eiaobjia.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\Ebjckppa.exeC:\Windows\system32\Ebjckppa.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\Elbhde32.exeC:\Windows\system32\Elbhde32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\Efhlan32.exeC:\Windows\system32\Efhlan32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\Fldeie32.exeC:\Windows\system32\Fldeie32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\Fjfegl32.exeC:\Windows\system32\Fjfegl32.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\Fdnipbbo.exeC:\Windows\system32\Fdnipbbo.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\Fikbhiaf.exeC:\Windows\system32\Fikbhiaf.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\SysWOW64\Fdqffaql.exeC:\Windows\system32\Fdqffaql.exe26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\Fimonh32.exeC:\Windows\system32\Fimonh32.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\Fpggkbfq.exeC:\Windows\system32\Fpggkbfq.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\Fjmkhkff.exeC:\Windows\system32\Fjmkhkff.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Windows\SysWOW64\Fdepaa32.exeC:\Windows\system32\Fdepaa32.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Windows\SysWOW64\Gmndjf32.exeC:\Windows\system32\Gmndjf32.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Windows\SysWOW64\Gbjlbm32.exeC:\Windows\system32\Gbjlbm32.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\Glbakchp.exeC:\Windows\system32\Glbakchp.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\Gmbmefob.exeC:\Windows\system32\Gmbmefob.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\Gbofmmmj.exeC:\Windows\system32\Gbofmmmj.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\Gmdjjemp.exeC:\Windows\system32\Gmdjjemp.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\Gbabblkg.exeC:\Windows\system32\Gbabblkg.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Windows\SysWOW64\Gljgkb32.exeC:\Windows\system32\Gljgkb32.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\Hgokikan.exeC:\Windows\system32\Hgokikan.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\Hmicee32.exeC:\Windows\system32\Hmicee32.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\Hdclbopg.exeC:\Windows\system32\Hdclbopg.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\Hlnqfanb.exeC:\Windows\system32\Hlnqfanb.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\Hchickeo.exeC:\Windows\system32\Hchickeo.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\Hmnmqdee.exeC:\Windows\system32\Hmnmqdee.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\Hdhemn32.exeC:\Windows\system32\Hdhemn32.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\Hkbmjhdo.exeC:\Windows\system32\Hkbmjhdo.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\Hpofbobf.exeC:\Windows\system32\Hpofbobf.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\Hkdjph32.exeC:\Windows\system32\Hkdjph32.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\Hlefgphj.exeC:\Windows\system32\Hlefgphj.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Windows\SysWOW64\Igkkdigp.exeC:\Windows\system32\Igkkdigp.exe50⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Windows\SysWOW64\Ilhcmpeg.exeC:\Windows\system32\Ilhcmpeg.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\Icalij32.exeC:\Windows\system32\Icalij32.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\Ingpgcmj.exeC:\Windows\system32\Ingpgcmj.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\Idahcm32.exeC:\Windows\system32\Idahcm32.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\Injmlbkh.exeC:\Windows\system32\Injmlbkh.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\Igbaeh32.exeC:\Windows\system32\Igbaeh32.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Windows\SysWOW64\Inlibb32.exeC:\Windows\system32\Inlibb32.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\SysWOW64\Igdnkhoe.exeC:\Windows\system32\Igdnkhoe.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\Innfgb32.exeC:\Windows\system32\Innfgb32.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\Jdhndlno.exeC:\Windows\system32\Jdhndlno.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Windows\SysWOW64\Jjeflc32.exeC:\Windows\system32\Jjeflc32.exe61⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\Jpooimdc.exeC:\Windows\system32\Jpooimdc.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\Jkdcffci.exeC:\Windows\system32\Jkdcffci.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\Jpalomaq.exeC:\Windows\system32\Jpalomaq.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\SysWOW64\Jkgpleaf.exeC:\Windows\system32\Jkgpleaf.exe65⤵
- Executes dropped EXE
PID:5504 -
C:\Windows\SysWOW64\Jpdhdl32.exeC:\Windows\system32\Jpdhdl32.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5068 -
C:\Windows\SysWOW64\Jgnqafgk.exeC:\Windows\system32\Jgnqafgk.exe67⤵PID:2640
-
C:\Windows\SysWOW64\Jnhinq32.exeC:\Windows\system32\Jnhinq32.exe68⤵
- Drops file in System32 directory
PID:5036 -
C:\Windows\SysWOW64\Jcdafg32.exeC:\Windows\system32\Jcdafg32.exe69⤵PID:5680
-
C:\Windows\SysWOW64\Jlmfomcp.exeC:\Windows\system32\Jlmfomcp.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4464 -
C:\Windows\SysWOW64\Kgbjlf32.exeC:\Windows\system32\Kgbjlf32.exe71⤵PID:2324
-
C:\Windows\SysWOW64\Knlbipjb.exeC:\Windows\system32\Knlbipjb.exe72⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6052 -
C:\Windows\SysWOW64\Kcikagij.exeC:\Windows\system32\Kcikagij.exe73⤵PID:1784
-
C:\Windows\SysWOW64\Knoonphp.exeC:\Windows\system32\Knoonphp.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1624 -
C:\Windows\SysWOW64\Kdigkjpl.exeC:\Windows\system32\Kdigkjpl.exe75⤵
- Drops file in System32 directory
PID:5164 -
C:\Windows\SysWOW64\Kkbohc32.exeC:\Windows\system32\Kkbohc32.exe76⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5220 -
C:\Windows\SysWOW64\Kmdlolmg.exeC:\Windows\system32\Kmdlolmg.exe77⤵PID:3124
-
C:\Windows\SysWOW64\Kgipmdmn.exeC:\Windows\system32\Kgipmdmn.exe78⤵PID:720
-
C:\Windows\SysWOW64\Kmfhelke.exeC:\Windows\system32\Kmfhelke.exe79⤵
- Drops file in System32 directory
PID:1920 -
C:\Windows\SysWOW64\Kcpqafba.exeC:\Windows\system32\Kcpqafba.exe80⤵PID:4648
-
C:\Windows\SysWOW64\Knfeoobh.exeC:\Windows\system32\Knfeoobh.exe81⤵
- System Location Discovery: System Language Discovery
PID:4488 -
C:\Windows\SysWOW64\Ldpmlh32.exeC:\Windows\system32\Ldpmlh32.exe82⤵PID:2036
-
C:\Windows\SysWOW64\Ljmfdp32.exeC:\Windows\system32\Ljmfdp32.exe83⤵
- Drops file in System32 directory
PID:2580 -
C:\Windows\SysWOW64\Lcejmeol.exeC:\Windows\system32\Lcejmeol.exe84⤵
- Modifies registry class
PID:2616 -
C:\Windows\SysWOW64\Lnjnjn32.exeC:\Windows\system32\Lnjnjn32.exe85⤵
- Drops file in System32 directory
PID:1856 -
C:\Windows\SysWOW64\Lcggbd32.exeC:\Windows\system32\Lcggbd32.exe86⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3180 -
C:\Windows\SysWOW64\Lnmkpm32.exeC:\Windows\system32\Lnmkpm32.exe87⤵PID:3400
-
C:\Windows\SysWOW64\Lcjchd32.exeC:\Windows\system32\Lcjchd32.exe88⤵
- System Location Discovery: System Language Discovery
PID:5948 -
C:\Windows\SysWOW64\Lnohemjm.exeC:\Windows\system32\Lnohemjm.exe89⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1092 -
C:\Windows\SysWOW64\Lclpmdhd.exeC:\Windows\system32\Lclpmdhd.exe90⤵PID:1336
-
C:\Windows\SysWOW64\Lnadkmhj.exeC:\Windows\system32\Lnadkmhj.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2828 -
C:\Windows\SysWOW64\Mcnmccfa.exeC:\Windows\system32\Mcnmccfa.exe92⤵PID:5540
-
C:\Windows\SysWOW64\Mjhepnno.exeC:\Windows\system32\Mjhepnno.exe93⤵
- Modifies registry class
PID:3232 -
C:\Windows\SysWOW64\Menimfnd.exeC:\Windows\system32\Menimfnd.exe94⤵PID:5012
-
C:\Windows\SysWOW64\Mkhajq32.exeC:\Windows\system32\Mkhajq32.exe95⤵PID:2752
-
C:\Windows\SysWOW64\Mminaikp.exeC:\Windows\system32\Mminaikp.exe96⤵
- Drops file in System32 directory
PID:6180 -
C:\Windows\SysWOW64\Mgoboake.exeC:\Windows\system32\Mgoboake.exe97⤵PID:6220
-
C:\Windows\SysWOW64\Mnhkklbb.exeC:\Windows\system32\Mnhkklbb.exe98⤵
- Modifies registry class
PID:6260 -
C:\Windows\SysWOW64\Mceccbpj.exeC:\Windows\system32\Mceccbpj.exe99⤵PID:6300
-
C:\Windows\SysWOW64\Mjokpm32.exeC:\Windows\system32\Mjokpm32.exe100⤵PID:6340
-
C:\Windows\SysWOW64\Meepne32.exeC:\Windows\system32\Meepne32.exe101⤵
- Modifies registry class
PID:6380 -
C:\Windows\SysWOW64\Nnmdfknm.exeC:\Windows\system32\Nnmdfknm.exe102⤵
- Drops file in System32 directory
PID:6420 -
C:\Windows\SysWOW64\Neglceej.exeC:\Windows\system32\Neglceej.exe103⤵
- System Location Discovery: System Language Discovery
PID:6460 -
C:\Windows\SysWOW64\Nladpo32.exeC:\Windows\system32\Nladpo32.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6500 -
C:\Windows\SysWOW64\Nmbaggce.exeC:\Windows\system32\Nmbaggce.exe105⤵
- Drops file in System32 directory
PID:6548 -
C:\Windows\SysWOW64\Nhheepbk.exeC:\Windows\system32\Nhheepbk.exe106⤵
- System Location Discovery: System Language Discovery
PID:6584 -
C:\Windows\SysWOW64\Napjnfik.exeC:\Windows\system32\Napjnfik.exe107⤵PID:6624
-
C:\Windows\SysWOW64\Nlfnkoia.exeC:\Windows\system32\Nlfnkoia.exe108⤵PID:6664
-
C:\Windows\SysWOW64\Nmgjbg32.exeC:\Windows\system32\Nmgjbg32.exe109⤵PID:6704
-
C:\Windows\SysWOW64\Ndaboafl.exeC:\Windows\system32\Ndaboafl.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:6744 -
C:\Windows\SysWOW64\Nlhkqngo.exeC:\Windows\system32\Nlhkqngo.exe111⤵PID:6784
-
C:\Windows\SysWOW64\Nmighf32.exeC:\Windows\system32\Nmighf32.exe112⤵
- Drops file in System32 directory
PID:6824 -
C:\Windows\SysWOW64\Ndcoeq32.exeC:\Windows\system32\Ndcoeq32.exe113⤵PID:6864
-
C:\Windows\SysWOW64\Ojmhaklf.exeC:\Windows\system32\Ojmhaklf.exe114⤵PID:6904
-
C:\Windows\SysWOW64\Oagpne32.exeC:\Windows\system32\Oagpne32.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:6944 -
C:\Windows\SysWOW64\Ohahkojp.exeC:\Windows\system32\Ohahkojp.exe116⤵PID:6984
-
C:\Windows\SysWOW64\Onkphi32.exeC:\Windows\system32\Onkphi32.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7024 -
C:\Windows\SysWOW64\Oeehdcij.exeC:\Windows\system32\Oeehdcij.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:7064 -
C:\Windows\SysWOW64\Oloaamqf.exeC:\Windows\system32\Oloaamqf.exe119⤵
- System Location Discovery: System Language Discovery
PID:7104 -
C:\Windows\SysWOW64\Ompmie32.exeC:\Windows\system32\Ompmie32.exe120⤵
- System Location Discovery: System Language Discovery
PID:7144 -
C:\Windows\SysWOW64\Odjeepna.exeC:\Windows\system32\Odjeepna.exe121⤵PID:6168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-