Analysis
- max time kernel
149s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 11:58
Behavioral task
behavioral1
Sample
2026-09-30_421466347d09e2e1c23ac71981e9e4f2_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_421466347d09e2e1c23ac71981e9e4f2_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-09-30_421466347d09e2e1c23ac71981e9e4f2_elex_wannacry.exe
- Size 429KB
- Sample260930-n5ltfsvhrf
- SHA256 61d82c2c3c82ffcb4f1ebbc88d091ed260771428c204796cddf121efe487253f
- MD5 421466347d09e2e1c23ac71981e9e4f2
- SHA1 b2cfeae703ff93a511c17f4f7baa8e0544303119
- SHA512 fddb464540c0c6b0b945783b2282628c3534da3ac2ef40a628e82b0e36d33668bef17aa528624119a23381aa5eb87576579adc519a0a9dd2a8e6b81698f16ffc
- SSDEEP 6144:F9hpf2ReV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:F9hpfg/NcZ7/N
- TLSH T186947025AB3419EADDEE6BB5AC1249E88081E9B504F1F13E6673DFDCC9E4D61CC04B81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Omdpio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pnfiia32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpfcpcam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gbnhhp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eimlpc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mfkcbhii.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjblcj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fniiabfd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amkhfegn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fkpcdbko.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jejbba32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Omqeobjo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpngcinp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bihhbocn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nmdgbamf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmgmonma.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kiphcdkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Llggeobk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmbgnabc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pkklkn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ngdmcmej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oafald32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mfchehla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gnohgk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofmjlj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ginega32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ombhqpdf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oilekqhg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Koodka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ekoniian.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lebiddfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Henjoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hebcjdkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Afkijo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fgamjgna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Llhnpe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nqmfnp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhdmpapp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhglcm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mhqmflif.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgblhmag.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njhglelp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fgoadi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abcgdm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Odfjno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eekjoe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjlkom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lqjqab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Opiipkfb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hdmceo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eeodjeha.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iqomkh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmkpbegc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhlckm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amnlfk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eqgmgq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pjlcclfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qjalok32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iekpfmpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pkcopi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bejhajil.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Diopoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Flhobcgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Glmhnb32.exe - Executes dropped EXE 64 IoCs
pid Process 4292 Jidpblik.exe 4264 Jleicg32.exe 4924 Jofaeb32.exe 6084 Jngbcj32.exe 3432 Jcdjka32.exe 5912 Kjnbhkqp.exe 5024 Kokkqbog.exe 3308 Knlknigf.exe 2632 Kchdfpen.exe 1864 Kjblcj32.exe 4948 Koodka32.exe 2100 Kjeiij32.exe 2580 Koaaaaip.exe 3776 Kjgenjhe.exe 2740 Kodnfqgm.exe 3844 Lfnfck32.exe 4748 Llhnpe32.exe 4544 Lcbfmomc.exe 3128 Ljloii32.exe 1020 Lqfgfclm.exe 4956 Lfbpnjjd.exe 4376 Lqhdlc32.exe 1840 Lgblhmag.exe 3304 Lqjqab32.exe 4900 Lgdinmod.exe 6100 Lmaafcml.exe 1620 Lckicnei.exe 2836 Mjeaph32.exe 3520 Mobjho32.exe 1140 Mflbdibj.exe 3980 Mmfkac32.exe 3060 Mgkoolil.exe 2152 Mnegkf32.exe 5996 Mogccnfg.exe 4164 Mjlhpgfn.exe 6000 Mqfpma32.exe 5740 Mfchehla.exe 200 Mqhmbqlh.exe 5992 Ngbeok32.exe 1300 Nnmmleja.exe 5596 Ncifdlii.exe 4044 Njcnafpe.exe 3412 Nqmfnp32.exe 4384 Nfjofg32.exe 4792 Nmdgbamf.exe 4640 Ncnook32.exe 2016 Njhglelp.exe 5904 Nabpiocm.exe 3024 Nfohafad.exe 5016 Nmipnp32.exe 3524 Ocbhjjqn.exe 6044 Ojmqgd32.exe 2448 Opiipkfb.exe 5568 Ojommdfh.exe 2520 Oaifin32.exe 4236 Offnae32.exe 3420 Oakbonkb.exe 4724 Ogeklh32.exe 5796 Oanodnip.exe 3720 Ofjgmdgg.exe 3300 Omdpio32.exe 4936 Phjdggoj.exe 2868 Pmgmonma.exe 3492 Pdqelh32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Lfbpnjjd.exe Lqfgfclm.exe File created C:\Windows\SysWOW64\Mknfldgn.dll Ncifdlii.exe File created C:\Windows\SysWOW64\Jcbmgfnn.dll Ciljbh32.exe File created C:\Windows\SysWOW64\Jjcqplpj.exe Jfehjm32.exe File created C:\Windows\SysWOW64\Pbolkada.dll Edklljnp.exe File created C:\Windows\SysWOW64\Adjcck32.dll Gcnnebhe.exe File created C:\Windows\SysWOW64\Qkablmdj.exe Qokagl32.exe File created C:\Windows\SysWOW64\Dlkpealn.exe Deagig32.exe File opened for modification C:\Windows\SysWOW64\Gjpbmq32.exe Gojnoh32.exe File created C:\Windows\SysWOW64\Mfkcbhii.exe Mdlgflje.exe File created C:\Windows\SysWOW64\Mdpaai32.exe Mldmlf32.exe File created C:\Windows\SysWOW64\Eoadmoig.dll Dkndbkop.exe File created C:\Windows\SysWOW64\Mflbdibj.exe Mobjho32.exe File created C:\Windows\SysWOW64\Bpfkiepp.exe Baanhi32.exe File created C:\Windows\SysWOW64\Foapkfco.exe Felkmnci.exe File created C:\Windows\SysWOW64\Objnfe32.dll Nodijffl.exe File created C:\Windows\SysWOW64\Kpoqcf32.dll Ekgqnccj.exe File opened for modification C:\Windows\SysWOW64\Kadfhk32.exe Kjknkann.exe File opened for modification C:\Windows\SysWOW64\Eocohkcg.exe Eekjoe32.exe File created C:\Windows\SysWOW64\Ohhlnidl.exe Ombhqpdf.exe File created C:\Windows\SysWOW64\Dngimo32.dll Ekljic32.exe File opened for modification C:\Windows\SysWOW64\Mdbnfh32.exe Mdpaai32.exe File created C:\Windows\SysWOW64\Nonajj32.exe Nhdimplm.exe File created C:\Windows\SysWOW64\Hagbfkpp.dll Dfljgjpi.exe File created C:\Windows\SysWOW64\Iklpcimi.dll Jefpahoi.exe File opened for modification C:\Windows\SysWOW64\Amkhfegn.exe Afapjk32.exe File created C:\Windows\SysWOW64\Aiabap32.exe Apimhjbe.exe File created C:\Windows\SysWOW64\Egigmb32.dll Iqaiag32.exe File created C:\Windows\SysWOW64\Ogeklh32.exe Oakbonkb.exe File opened for modification C:\Windows\SysWOW64\Fkajoiok.exe Edgbbo32.exe File opened for modification C:\Windows\SysWOW64\Kbeild32.exe Klkaojhl.exe File created C:\Windows\SysWOW64\Flhobcgj.exe Eghanoih.exe File created C:\Windows\SysWOW64\Lhogkc32.exe Lmicnj32.exe File created C:\Windows\SysWOW64\Ofeebpmn.dll Dhdmpapp.exe File created C:\Windows\SysWOW64\Faebbm32.dll Kajfmqda.exe File opened for modification C:\Windows\SysWOW64\Mmfkac32.exe Mflbdibj.exe File opened for modification C:\Windows\SysWOW64\Neakpk32.exe Mklfcb32.exe File opened for modification C:\Windows\SysWOW64\Oacdgdle.exe Ognpilmp.exe File created C:\Windows\SysWOW64\Mqhmbqlh.exe Mfchehla.exe File opened for modification C:\Windows\SysWOW64\Oolnkhgj.exe Odfjno32.exe File opened for modification C:\Windows\SysWOW64\Hhlenlmb.exe Hcomfeok.exe File created C:\Windows\SysWOW64\Kcehop32.exe Kmkpbegc.exe File opened for modification C:\Windows\SysWOW64\Lfnfck32.exe Kodnfqgm.exe File created C:\Windows\SysWOW64\Fkajoiok.exe Edgbbo32.exe File created C:\Windows\SysWOW64\Pmcbdb32.exe Pbnngi32.exe File opened for modification C:\Windows\SysWOW64\Djegoanj.exe Dpmcfk32.exe File created C:\Windows\SysWOW64\Ceehhk32.dll Djegoanj.exe File created C:\Windows\SysWOW64\Nhephfpi.exe Nkapnbqo.exe File created C:\Windows\SysWOW64\Igchnabi.dll Dpjofefp.exe File created C:\Windows\SysWOW64\Cmblfm32.dll Ankgiqed.exe File created C:\Windows\SysWOW64\Cjnqoc32.dll Mfkcbhii.exe File created C:\Windows\SysWOW64\Lfbpnjjd.exe Lqfgfclm.exe File opened for modification C:\Windows\SysWOW64\Amikae32.exe Abcgdm32.exe File created C:\Windows\SysWOW64\Cdjbel32.exe Cienhc32.exe File created C:\Windows\SysWOW64\Lkiage32.exe Lbnlbc32.exe File created C:\Windows\SysWOW64\Hmainl32.dll Dinanb32.exe File created C:\Windows\SysWOW64\Nbacjh32.dll Pmeoja32.exe File created C:\Windows\SysWOW64\Apfela32.dll Phgojm32.exe File created C:\Windows\SysWOW64\Onkbebpi.dll Pfcchmlq.exe File created C:\Windows\SysWOW64\Ioikon32.exe Iaekfjje.exe File opened for modification C:\Windows\SysWOW64\Oakbonkb.exe Offnae32.exe File opened for modification C:\Windows\SysWOW64\Pmfedhie.exe Pcnalbce.exe File opened for modification C:\Windows\SysWOW64\Ekgqnccj.exe Eaolen32.exe File created C:\Windows\SysWOW64\Kobbap32.dll Kfdkeaap.exe - Program crash 1 IoCs
pid pid_target Process procid_target 11284 6148 WerFault.exe 695 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgimepmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hnnlcpcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hcomfeok.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pnmojp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llggeobk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Modpch32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lbnlbc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ohcmid32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qdgbem32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kiphcdkb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pcnalbce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Baephacf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lmicnj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lqhdlc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lodfmnjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kokkqbog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dpmcfk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbppaedo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhihejhi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bnppdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgamjgna.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iejqeiif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlbindfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ldfhpd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iqcffg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nfihkq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkjfkacd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hjhfbl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kcgedpln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lfmgaj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mpocblpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qjdpoacp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnffam32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Amneleek.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddfikaeq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Leplndhk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dpbief32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aghlfh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dlicpanq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gckckf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Midfcd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibnaonhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eqhbaj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkpcdbko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aelcjbig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oacdgdle.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fplnhmbo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aabafkgh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojljmn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oqfbihll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkbpjbil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cpifoh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iekpfmpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ijpkcnpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ehikmohb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iioplg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljfmgocq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhogkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnoepg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pbocbb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bejhajil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epbkbnjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjeiij32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mqhmbqlh.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Olgbidbj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ijcocd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mgkjmnme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfpiffmb.dll" Hbfddh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Llkjfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oojaeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bgjace32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Njbgfp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehkkpb32.dll" Glmhnb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jipbjd32.dll" Ijcocd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Miajbmbe.dll" Qhpbpl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fchmfipg.dll" Qojjmfkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abibbnjl.dll" Offnae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pfdjccol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmhedgff.dll" Paioplob.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cncnhh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Njpjap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Egnacd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Omqeobjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Anfmna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phhocg32.dll" Bichli32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kjblcj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mogccnfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kopcld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pmeoja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnnnac32.dll" Nfomng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahfnojmd.dll" Nkmede32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okdaeocb.dll" Kokkqbog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Modpch32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eqhbaj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Agleagbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmfnamhl.dll" Fgcjoglo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kimlnemd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Amikae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Diopoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlccgnmi.dll" Fnfmlchf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nokfcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjmhaelm.dll" Cpifoh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bbnikn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lckicnei.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Koggqlmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ojqchnpj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idfqajkm.dll" Gdiadecm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhkkcfnf.dll" Lgdinmod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fenhcnaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cpplpgnk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Glmhnb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihdegddo.dll" Oafald32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nqmfnp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dklhmlac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mfbaka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jghhcf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gnohgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oacdgdle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jcdjka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kakcenoh.dll" Icpmgi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cpfcobbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffnhai32.dll" Dgakmp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ngdmcmej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gckckf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ioikon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pcnalbce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lgblhmag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qjdpoacp.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4988 wrote to memory of 4292 4988 2026-09-30_421466347d09e2e1c23ac71981e9e4f2_elex_wannacry.exe 88 PID 4292 wrote to memory of 4264 4292 Jidpblik.exe 89 PID 4264 wrote to memory of 4924 4264 Jleicg32.exe 90 PID 4924 wrote to memory of 6084 4924 Jofaeb32.exe 91 PID 6084 wrote to memory of 3432 6084 Jngbcj32.exe 92 PID 3432 wrote to memory of 5912 3432 Jcdjka32.exe 93 PID 5912 wrote to memory of 5024 5912 Kjnbhkqp.exe 94 PID 5024 wrote to memory of 3308 5024 Kokkqbog.exe 95 PID 3308 wrote to memory of 2632 3308 Knlknigf.exe 96 PID 2632 wrote to memory of 1864 2632 Kchdfpen.exe 97 PID 1864 wrote to memory of 4948 1864 Kjblcj32.exe 98 PID 4948 wrote to memory of 2100 4948 Koodka32.exe 99 PID 2100 wrote to memory of 2580 2100 Kjeiij32.exe 100 PID 2580 wrote to memory of 3776 2580 Koaaaaip.exe 101 PID 3776 wrote to memory of 2740 3776 Kjgenjhe.exe 102 PID 2740 wrote to memory of 3844 2740 Kodnfqgm.exe 103 PID 3844 wrote to memory of 4748 3844 Lfnfck32.exe 104 PID 4748 wrote to memory of 4544 4748 Llhnpe32.exe 105 PID 4544 wrote to memory of 3128 4544 Lcbfmomc.exe 106 PID 3128 wrote to memory of 1020 3128 Ljloii32.exe 107 PID 1020 wrote to memory of 4956 1020 Lqfgfclm.exe 108 PID 4956 wrote to memory of 4376 4956 Lfbpnjjd.exe 109 PID 4376 wrote to memory of 1840 4376 Lqhdlc32.exe 110 PID 1840 wrote to memory of 3304 1840 Lgblhmag.exe 111 PID 3304 wrote to memory of 4900 3304 Lqjqab32.exe 112 PID 4900 wrote to memory of 6100 4900 Lgdinmod.exe 113 PID 6100 wrote to memory of 1620 6100 Lmaafcml.exe 114 PID 1620 wrote to memory of 2836 1620 Lckicnei.exe 115 PID 2836 wrote to memory of 3520 2836 Mjeaph32.exe 116 PID 3520 wrote to memory of 1140 3520 Mobjho32.exe 117 PID 1140 wrote to memory of 3980 1140 Mflbdibj.exe 118 PID 3980 wrote to memory of 3060 3980 Mmfkac32.exe 119 PID 3060 wrote to memory of 2152 3060 Mgkoolil.exe 120 PID 2152 wrote to memory of 5996 2152 Mnegkf32.exe 121 PID 5996 wrote to memory of 4164 5996 Mogccnfg.exe 122 PID 4164 wrote to memory of 6000 4164 Mjlhpgfn.exe 123 PID 6000 wrote to memory of 5740 6000 Mqfpma32.exe 124 PID 5740 wrote to memory of 200 5740 Mfchehla.exe 125 PID 200 wrote to memory of 5992 200 Mqhmbqlh.exe 126 PID 5992 wrote to memory of 1300 5992 Ngbeok32.exe 127 PID 1300 wrote to memory of 5596 1300 Nnmmleja.exe 128 PID 5596 wrote to memory of 4044 5596 Ncifdlii.exe 129 PID 4044 wrote to memory of 3412 4044 Njcnafpe.exe 130 PID 3412 wrote to memory of 4384 3412 Nqmfnp32.exe 131 PID 4384 wrote to memory of 4792 4384 Nfjofg32.exe 132 PID 4792 wrote to memory of 4640 4792 Nmdgbamf.exe 133 PID 4640 wrote to memory of 2016 4640 Ncnook32.exe 134 PID 2016 wrote to memory of 5904 2016 Njhglelp.exe 135 PID 5904 wrote to memory of 3024 5904 Nabpiocm.exe 136 PID 3024 wrote to memory of 5016 3024 Nfohafad.exe 137 PID 5016 wrote to memory of 3524 5016 Nmipnp32.exe 138 PID 3524 wrote to memory of 6044 3524 Ocbhjjqn.exe 139 PID 6044 wrote to memory of 2448 6044 Ojmqgd32.exe 140 PID 2448 wrote to memory of 5568 2448 Opiipkfb.exe 141 PID 5568 wrote to memory of 2520 5568 Ojommdfh.exe 142 PID 2520 wrote to memory of 4236 2520 Oaifin32.exe 143 PID 4236 wrote to memory of 3420 4236 Offnae32.exe 144 PID 3420 wrote to memory of 4724 3420 Oakbonkb.exe 145 PID 4724 wrote to memory of 5796 4724 Ogeklh32.exe 146 PID 5796 wrote to memory of 3720 5796 Oanodnip.exe 147 PID 3720 wrote to memory of 3300 3720 Ofjgmdgg.exe 148 PID 3300 wrote to memory of 4936 3300 Omdpio32.exe 149 PID 4936 wrote to memory of 2868 4936 Phjdggoj.exe 150 PID 2868 wrote to memory of 3492 2868 Pmgmonma.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_421466347d09e2e1c23ac71981e9e4f2_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_421466347d09e2e1c23ac71981e9e4f2_elex_wannacry.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\Jidpblik.exeC:\Windows\system32\Jidpblik.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\Jleicg32.exeC:\Windows\system32\Jleicg32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\Jofaeb32.exeC:\Windows\system32\Jofaeb32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\Jngbcj32.exeC:\Windows\system32\Jngbcj32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\SysWOW64\Jcdjka32.exeC:\Windows\system32\Jcdjka32.exe6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\Kjnbhkqp.exeC:\Windows\system32\Kjnbhkqp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\Kokkqbog.exeC:\Windows\system32\Kokkqbog.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\Knlknigf.exeC:\Windows\system32\Knlknigf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\Kchdfpen.exeC:\Windows\system32\Kchdfpen.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\Kjblcj32.exeC:\Windows\system32\Kjblcj32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\Koodka32.exeC:\Windows\system32\Koodka32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\Kjeiij32.exeC:\Windows\system32\Kjeiij32.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\Koaaaaip.exeC:\Windows\system32\Koaaaaip.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\Kjgenjhe.exeC:\Windows\system32\Kjgenjhe.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\Kodnfqgm.exeC:\Windows\system32\Kodnfqgm.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\Lfnfck32.exeC:\Windows\system32\Lfnfck32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\Llhnpe32.exeC:\Windows\system32\Llhnpe32.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\Lcbfmomc.exeC:\Windows\system32\Lcbfmomc.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\Ljloii32.exeC:\Windows\system32\Ljloii32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\Lqfgfclm.exeC:\Windows\system32\Lqfgfclm.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\Lfbpnjjd.exeC:\Windows\system32\Lfbpnjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\Lqhdlc32.exeC:\Windows\system32\Lqhdlc32.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\Lgblhmag.exeC:\Windows\system32\Lgblhmag.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\Lqjqab32.exeC:\Windows\system32\Lqjqab32.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\Lgdinmod.exeC:\Windows\system32\Lgdinmod.exe26⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\Lmaafcml.exeC:\Windows\system32\Lmaafcml.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\Lckicnei.exeC:\Windows\system32\Lckicnei.exe28⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\Mjeaph32.exeC:\Windows\system32\Mjeaph32.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\Mobjho32.exeC:\Windows\system32\Mobjho32.exe30⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\Mflbdibj.exeC:\Windows\system32\Mflbdibj.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\Mmfkac32.exeC:\Windows\system32\Mmfkac32.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\Mgkoolil.exeC:\Windows\system32\Mgkoolil.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\Mnegkf32.exeC:\Windows\system32\Mnegkf32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\Mogccnfg.exeC:\Windows\system32\Mogccnfg.exe35⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\Mjlhpgfn.exeC:\Windows\system32\Mjlhpgfn.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\Mqfpma32.exeC:\Windows\system32\Mqfpma32.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\Mfchehla.exeC:\Windows\system32\Mfchehla.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\SysWOW64\Mqhmbqlh.exeC:\Windows\system32\Mqhmbqlh.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Windows\SysWOW64\Ngbeok32.exeC:\Windows\system32\Ngbeok32.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Windows\SysWOW64\Nnmmleja.exeC:\Windows\system32\Nnmmleja.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\Ncifdlii.exeC:\Windows\system32\Ncifdlii.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Windows\SysWOW64\Njcnafpe.exeC:\Windows\system32\Njcnafpe.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\Nqmfnp32.exeC:\Windows\system32\Nqmfnp32.exe44⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\Nfjofg32.exeC:\Windows\system32\Nfjofg32.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\Nmdgbamf.exeC:\Windows\system32\Nmdgbamf.exe46⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\Ncnook32.exeC:\Windows\system32\Ncnook32.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\Njhglelp.exeC:\Windows\system32\Njhglelp.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\Nabpiocm.exeC:\Windows\system32\Nabpiocm.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\SysWOW64\Nfohafad.exeC:\Windows\system32\Nfohafad.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\Nmipnp32.exeC:\Windows\system32\Nmipnp32.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\Ocbhjjqn.exeC:\Windows\system32\Ocbhjjqn.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\Ojmqgd32.exeC:\Windows\system32\Ojmqgd32.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\Opiipkfb.exeC:\Windows\system32\Opiipkfb.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\Ojommdfh.exeC:\Windows\system32\Ojommdfh.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Windows\SysWOW64\Oaifin32.exeC:\Windows\system32\Oaifin32.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\Offnae32.exeC:\Windows\system32\Offnae32.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\Oakbonkb.exeC:\Windows\system32\Oakbonkb.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\Ogeklh32.exeC:\Windows\system32\Ogeklh32.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\Oanodnip.exeC:\Windows\system32\Oanodnip.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Windows\SysWOW64\Ofjgmdgg.exeC:\Windows\system32\Ofjgmdgg.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\Omdpio32.exeC:\Windows\system32\Omdpio32.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\Phjdggoj.exeC:\Windows\system32\Phjdggoj.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\Pmgmonma.exeC:\Windows\system32\Pmgmonma.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\Pdqelh32.exeC:\Windows\system32\Pdqelh32.exe65⤵
- Executes dropped EXE
PID:3492 -
C:\Windows\SysWOW64\Pnfiia32.exeC:\Windows\system32\Pnfiia32.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4516 -
C:\Windows\SysWOW64\Ppgeqijb.exeC:\Windows\system32\Ppgeqijb.exe67⤵PID:5428
-
C:\Windows\SysWOW64\Pfanmcao.exeC:\Windows\system32\Pfanmcao.exe68⤵PID:1432
-
C:\Windows\SysWOW64\Pagbklae.exeC:\Windows\system32\Pagbklae.exe69⤵PID:4720
-
C:\Windows\SysWOW64\Pfdjccol.exeC:\Windows\system32\Pfdjccol.exe70⤵
- Modifies registry class
PID:5728 -
C:\Windows\SysWOW64\Paioplob.exeC:\Windows\system32\Paioplob.exe71⤵
- Modifies registry class
PID:4684 -
C:\Windows\SysWOW64\Phcgmffo.exeC:\Windows\system32\Phcgmffo.exe72⤵PID:2076
-
C:\Windows\SysWOW64\Pnmojp32.exeC:\Windows\system32\Pnmojp32.exe73⤵
- System Location Discovery: System Language Discovery
PID:2524 -
C:\Windows\SysWOW64\Qdjgbg32.exeC:\Windows\system32\Qdjgbg32.exe74⤵PID:2916
-
C:\Windows\SysWOW64\Qjdpoacp.exeC:\Windows\system32\Qjdpoacp.exe75⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1040 -
C:\Windows\SysWOW64\Qpahghbg.exeC:\Windows\system32\Qpahghbg.exe76⤵PID:5836
-
C:\Windows\SysWOW64\Qfkqcb32.exeC:\Windows\system32\Qfkqcb32.exe77⤵PID:4260
-
C:\Windows\SysWOW64\Aapeakij.exeC:\Windows\system32\Aapeakij.exe78⤵PID:972
-
C:\Windows\SysWOW64\Afmmibga.exeC:\Windows\system32\Afmmibga.exe79⤵PID:5244
-
C:\Windows\SysWOW64\Aabafkgh.exeC:\Windows\system32\Aabafkgh.exe80⤵
- System Location Discovery: System Language Discovery
PID:700 -
C:\Windows\SysWOW64\Afpjoaeo.exeC:\Windows\system32\Afpjoaeo.exe81⤵PID:760
-
C:\Windows\SysWOW64\Amnlfk32.exeC:\Windows\system32\Amnlfk32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3372 -
C:\Windows\SysWOW64\Bgimepmd.exeC:\Windows\system32\Bgimepmd.exe83⤵
- System Location Discovery: System Language Discovery
PID:3676 -
C:\Windows\SysWOW64\Bkgekock.exeC:\Windows\system32\Bkgekock.exe84⤵PID:5756
-
C:\Windows\SysWOW64\Baanhi32.exeC:\Windows\system32\Baanhi32.exe85⤵
- Drops file in System32 directory
PID:356 -
C:\Windows\SysWOW64\Bpfkiepp.exeC:\Windows\system32\Bpfkiepp.exe86⤵PID:424
-
C:\Windows\SysWOW64\Bkkofn32.exeC:\Windows\system32\Bkkofn32.exe87⤵PID:4912
-
C:\Windows\SysWOW64\Cknlln32.exeC:\Windows\system32\Cknlln32.exe88⤵PID:2568
-
C:\Windows\SysWOW64\Cdfpdc32.exeC:\Windows\system32\Cdfpdc32.exe89⤵PID:696
-
C:\Windows\SysWOW64\Cnodmijd.exeC:\Windows\system32\Cnodmijd.exe90⤵PID:5944
-
C:\Windows\SysWOW64\Ckbegmin.exeC:\Windows\system32\Ckbegmin.exe91⤵PID:4420
-
C:\Windows\SysWOW64\Cdkipb32.exeC:\Windows\system32\Cdkipb32.exe92⤵PID:3364
-
C:\Windows\SysWOW64\Cncnhh32.exeC:\Windows\system32\Cncnhh32.exe93⤵
- Modifies registry class
PID:5208 -
C:\Windows\SysWOW64\Cocjbkna.exeC:\Windows\system32\Cocjbkna.exe94⤵PID:1948
-
C:\Windows\SysWOW64\Cpdgjc32.exeC:\Windows\system32\Cpdgjc32.exe95⤵PID:1584
-
C:\Windows\SysWOW64\Doeghk32.exeC:\Windows\system32\Doeghk32.exe96⤵PID:2484
-
C:\Windows\SysWOW64\Dpfcpcam.exeC:\Windows\system32\Dpfcpcam.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2500 -
C:\Windows\SysWOW64\Dklhmlac.exeC:\Windows\system32\Dklhmlac.exe98⤵
- Modifies registry class
PID:2392 -
C:\Windows\SysWOW64\Dqipeboj.exeC:\Windows\system32\Dqipeboj.exe99⤵PID:5960
-
C:\Windows\SysWOW64\Dkndbkop.exeC:\Windows\system32\Dkndbkop.exe100⤵
- Drops file in System32 directory
PID:976 -
C:\Windows\SysWOW64\Ddfikaeq.exeC:\Windows\system32\Ddfikaeq.exe101⤵
- System Location Discovery: System Language Discovery
PID:1624 -
C:\Windows\SysWOW64\Dolmijef.exeC:\Windows\system32\Dolmijef.exe102⤵PID:4296
-
C:\Windows\SysWOW64\Ddifaqcn.exeC:\Windows\system32\Ddifaqcn.exe103⤵PID:3292
-
C:\Windows\SysWOW64\Doojni32.exeC:\Windows\system32\Doojni32.exe104⤵PID:1764
-
C:\Windows\SysWOW64\Dqpffaib.exeC:\Windows\system32\Dqpffaib.exe105⤵PID:3660
-
C:\Windows\SysWOW64\Encgofhl.exeC:\Windows\system32\Encgofhl.exe106⤵PID:4008
-
C:\Windows\SysWOW64\Ehikmohb.exeC:\Windows\system32\Ehikmohb.exe107⤵
- System Location Discovery: System Language Discovery
PID:2388 -
C:\Windows\SysWOW64\Enfceefi.exeC:\Windows\system32\Enfceefi.exe108⤵PID:1088
-
C:\Windows\SysWOW64\Edplapnf.exeC:\Windows\system32\Edplapnf.exe109⤵PID:4784
-
C:\Windows\SysWOW64\Eqgmgq32.exeC:\Windows\system32\Eqgmgq32.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1236 -
C:\Windows\SysWOW64\Egqeckkg.exeC:\Windows\system32\Egqeckkg.exe111⤵PID:2224
-
C:\Windows\SysWOW64\Ebfiqcjm.exeC:\Windows\system32\Ebfiqcjm.exe112⤵PID:3104
-
C:\Windows\SysWOW64\Ekoniian.exeC:\Windows\system32\Ekoniian.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2872 -
C:\Windows\SysWOW64\Edgbbo32.exeC:\Windows\system32\Edgbbo32.exe114⤵
- Drops file in System32 directory
PID:1056 -
C:\Windows\SysWOW64\Fkajoiok.exeC:\Windows\system32\Fkajoiok.exe115⤵PID:1756
-
C:\Windows\SysWOW64\Fdiohnek.exeC:\Windows\system32\Fdiohnek.exe116⤵PID:4608
-
C:\Windows\SysWOW64\Fnacqc32.exeC:\Windows\system32\Fnacqc32.exe117⤵PID:2752
-
C:\Windows\SysWOW64\Felkmnci.exeC:\Windows\system32\Felkmnci.exe118⤵
- Drops file in System32 directory
PID:2960 -
C:\Windows\SysWOW64\Foapkfco.exeC:\Windows\system32\Foapkfco.exe119⤵PID:1544
-
C:\Windows\SysWOW64\Fenhcnaf.exeC:\Windows\system32\Fenhcnaf.exe120⤵
- Modifies registry class
PID:860 -
C:\Windows\SysWOW64\Fnfmlchf.exeC:\Windows\system32\Fnfmlchf.exe121⤵
- Modifies registry class
PID:3448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-