Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 16:03
Behavioral task
behavioral1
Sample
2026-10-11_90c3f3744bdfb5e3c2fd10dad9bafc58_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-11_90c3f3744bdfb5e3c2fd10dad9bafc58_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-10-11_90c3f3744bdfb5e3c2fd10dad9bafc58_elex_wannacry.exe
- Size 412KB
- Sample261012-thrdbacv5x
- SHA256 a7a638afb2b966262f1ccb960cd33b0ecd57e306a266f06b20f57f2dc1581760
- MD5 90c3f3744bdfb5e3c2fd10dad9bafc58
- SHA1 624592f223e5975a6dd21a80fb77f0bda1d3e8af
- SHA512 30e452999290c1847e5def468591e8c61b9c874f43e1652ede435a848bcec9b4c4991ff9c8290036fa768c5363ef50d51c424a1028b374cf98c852e3ef31f32b
- SSDEEP 6144:iw1RKG2QUTOV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:iw+Q8/NcZ7/NZ
- TLSH T10D9460692A7019E6DDFD5BB5AC1259D88181E9B154F1E13EA133EFDCC8F4DA2C804F82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bohbackj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Naejcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ppiklc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qciqga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ngdmhimb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ceqngekl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lefdld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nekgna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pkngco32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jlbecadc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ioeineap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jacggh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ammgifpn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emaemefo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ocamcc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cikgecag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Emldhb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kimlnemd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mlohjpoi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pogpcghp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dnbadlnj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghdoae32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pahppihl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlqjlmjp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Foebmn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Klimbf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhafoh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Plndma32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lnhadnpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iihilhol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cppfgnlj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ckkilhjm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnojad32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hiefmp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lbmheomi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lldfcn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hdjbcnjo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kedlbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ghflgedf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Adfgne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jehmgg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngdmhimb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mjbopcip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gifadggi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qfpbfljd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oemephgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Njfaalao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ilkocb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjkhme32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bqdbec32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oajmdd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ehecpgbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hgghdp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kjdjhgdb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lbgaecjg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Agbgda32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ieojqi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Meknhh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jijaef32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Inhgaipf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jhgneqha.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ccpdhfmb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jepjbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Agdhln32.exe - Executes dropped EXE 64 IoCs
pid Process 4140 Okcmingd.exe 5316 Odnngclb.exe 2648 Okjbimal.exe 2264 Odbgbb32.exe 4540 Pbhdafdd.exe 2400 Pgemimck.exe 2880 Pndoagfc.exe 2104 Qepccqlm.exe 2692 Qkjlpk32.exe 2040 Achmjmnb.exe 3132 Abimhd32.exe 52 Ajfobfaj.exe 3512 Abpcicpi.exe 2028 Bjkhme32.exe 5588 Baepjpea.exe 5932 Bhohfj32.exe 1384 Bbgiibja.exe 3644 Bopgdcnc.exe 3908 Caapfnkd.exe 5852 Clfdcgkj.exe 1000 Caeiam32.exe 2928 Ckpjob32.exe 6124 Dampal32.exe 5444 Dhfhnfhc.exe 1332 Daaiml32.exe 1932 Eddodfhp.exe 2800 Eojcao32.exe 4164 Eedkniob.exe 1160 Ekqcfpmj.exe 5584 Eefhcimp.exe 4424 Elpppcdl.exe 1292 Eamhhjbd.exe 5776 Ehgqed32.exe 2704 Ecmebm32.exe 3192 Ednajepe.exe 3252 Eocegn32.exe 5476 Fdpnpe32.exe 6060 Foebmn32.exe 6036 Ffpjihee.exe 1564 Fklcbocl.exe 4016 Ffbgog32.exe 3204 Fllplajo.exe 5136 Fbihdhhf.exe 6016 Gfimpfmj.exe 4860 Goabhl32.exe 3764 Gfkjef32.exe 2716 Glebbpbd.exe 2292 Gofkckoe.exe 5188 Gcddjiel.exe 4528 Giqlbqcc.exe 3656 Hdgmga32.exe 2472 Hkaedk32.exe 4676 Hiefmp32.exe 4128 Hbnjfefo.exe 4976 Hoakpi32.exe 2960 Heochp32.exe 2428 Hcpcehko.exe 3880 Hmhhnmao.exe 3536 Iecmcpoj.exe 5592 Ikmepj32.exe 4224 Ipkneh32.exe 1836 Imonol32.exe 264 Iejcco32.exe 5680 Ippgqg32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Ckpjob32.exe Caeiam32.exe File opened for modification C:\Windows\SysWOW64\Ocamcc32.exe Oiihkncb.exe File created C:\Windows\SysWOW64\Egkkpjcf.dll Iddlccfp.exe File created C:\Windows\SysWOW64\Onnmnfpg.dll Beajnm32.exe File opened for modification C:\Windows\SysWOW64\Gpbplkhh.exe Gemkobia.exe File opened for modification C:\Windows\SysWOW64\Hpnohinj.exe Hidgko32.exe File created C:\Windows\SysWOW64\Jcoapami.exe Jleicg32.exe File created C:\Windows\SysWOW64\Hhbjac32.dll Baepjpea.exe File created C:\Windows\SysWOW64\Ehlpjikd.exe Dmglmpkn.exe File created C:\Windows\SysWOW64\Colqno32.dll Allpnplb.exe File created C:\Windows\SysWOW64\Jlafbnic.dll Fmancbji.exe File created C:\Windows\SysWOW64\Mmpoidio.dll Gbgbgalj.exe File opened for modification C:\Windows\SysWOW64\Ledeicdf.exe Lcfimheb.exe File created C:\Windows\SysWOW64\Mefmbbod.exe Mpiejkql.exe File created C:\Windows\SysWOW64\Dmcnkmhc.dll Lankloml.exe File created C:\Windows\SysWOW64\Obafim32.exe Olgnlb32.exe File created C:\Windows\SysWOW64\Gbgbgalj.exe Gkmjkg32.exe File opened for modification C:\Windows\SysWOW64\Pgemimck.exe Pbhdafdd.exe File created C:\Windows\SysWOW64\Ippgqg32.exe Iejcco32.exe File created C:\Windows\SysWOW64\Pfcmpdjp.exe Odaphl32.exe File opened for modification C:\Windows\SysWOW64\Inejlibi.exe Hhiacb32.exe File created C:\Windows\SysWOW64\Ppemmg32.exe Ocamcc32.exe File created C:\Windows\SysWOW64\Mgnckjeh.dll Mhjhfnma.exe File opened for modification C:\Windows\SysWOW64\Pimfji32.exe Ppdbqchi.exe File created C:\Windows\SysWOW64\Djaigibm.dll Qgnief32.exe File opened for modification C:\Windows\SysWOW64\Cjfaon32.exe Cclhbcho.exe File created C:\Windows\SysWOW64\Fmiaimki.exe Fgpilc32.exe File created C:\Windows\SysWOW64\Nlbkjf32.exe Malgmm32.exe File created C:\Windows\SysWOW64\Njgoibfd.dll Gifadggi.exe File opened for modification C:\Windows\SysWOW64\Jgpmffeh.exe Jqfejl32.exe File opened for modification C:\Windows\SysWOW64\Kpldpddh.exe Kfgpblda.exe File opened for modification C:\Windows\SysWOW64\Bdmmnd32.exe Bmceaj32.exe File opened for modification C:\Windows\SysWOW64\Jpgmaf32.exe Jeaidn32.exe File created C:\Windows\SysWOW64\Pkcannmj.exe Pibdff32.exe File created C:\Windows\SysWOW64\Ecpmod32.exe Elienf32.exe File created C:\Windows\SysWOW64\Mlohjpoi.exe Meepne32.exe File created C:\Windows\SysWOW64\Bohbackj.exe Beomhm32.exe File created C:\Windows\SysWOW64\Bogapc32.dll Njedlojg.exe File created C:\Windows\SysWOW64\Jnlqnoji.dll Bjkhme32.exe File created C:\Windows\SysWOW64\Naejcl32.exe Nklbfaae.exe File created C:\Windows\SysWOW64\Lqfgfclm.exe Lfpcijlg.exe File created C:\Windows\SysWOW64\Belgbbnd.dll Iaekfjje.exe File created C:\Windows\SysWOW64\Mogpol32.dll Dfhjefhf.exe File created C:\Windows\SysWOW64\Gideogil.exe Gdglfqjd.exe File opened for modification C:\Windows\SysWOW64\Oblhlpne.exe Oqkkdh32.exe File created C:\Windows\SysWOW64\Inkojihg.dll Gfkjef32.exe File created C:\Windows\SysWOW64\Kfehoj32.exe Jpkpbpko.exe File opened for modification C:\Windows\SysWOW64\Hddbmedc.exe Gnjjpk32.exe File opened for modification C:\Windows\SysWOW64\Dieilepc.exe Dnpdom32.exe File opened for modification C:\Windows\SysWOW64\Doeghk32.exe Chkokq32.exe File created C:\Windows\SysWOW64\Elpppcdl.exe Eefhcimp.exe File created C:\Windows\SysWOW64\Bcjlld32.exe Bnmcdm32.exe File created C:\Windows\SysWOW64\Kafdmf32.dll Gonnhf32.exe File created C:\Windows\SysWOW64\Mlpeol32.exe Mefmbbod.exe File opened for modification C:\Windows\SysWOW64\Pcmloa32.exe Pjehflie.exe File created C:\Windows\SysWOW64\Pjdhck32.dll Omjfij32.exe File created C:\Windows\SysWOW64\Mghaofkn.dll Poajdlcq.exe File created C:\Windows\SysWOW64\Pkacebhg.dll Oobfhh32.exe File created C:\Windows\SysWOW64\Dcfchp32.dll Gofkckoe.exe File created C:\Windows\SysWOW64\Hdlphjaf.exe Hoogpcco.exe File opened for modification C:\Windows\SysWOW64\Nhpijldj.exe Ngombd32.exe File opened for modification C:\Windows\SysWOW64\Oloaamqf.exe Oajmdd32.exe File opened for modification C:\Windows\SysWOW64\Bmceaj32.exe Bdjqienq.exe File created C:\Windows\SysWOW64\Bhkmmepj.dll Abcgdm32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1464 10416 WerFault.exe 1044 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jlpklg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmnlnfcb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ncfmhecp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmdogpmq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gflhie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pqmjhm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfpfokfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lafmce32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lllaqn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmpmfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nldhpeop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Okpkaqmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cglgck32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmiaimki.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mecjbl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Allpnplb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdnipbbo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kglmbd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ppiklc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bqdbec32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cihjpd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eiaobjia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnbjkj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmofmk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jehmgg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hoogpcco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oefpoi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cbbnim32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jmfdpkeo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gochceml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Baohmo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dkndbkop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jqfejl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aebhaede.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hoakpi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmgfmg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmiccf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mpiejkql.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbiamd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Okjbimal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jfaenqjm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Faakickc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahenip32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lcejmeol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Piocoi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Idieob32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgnihd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Alimnj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlciobhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Leipbg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eiokbd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fibncmpg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jlgooa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bcjlld32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lefdld32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkhkdjli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eohcon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkggfl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjneec32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgoadi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kpnjknni.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mfoclflo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jqdoob32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jofaeb32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnbimd32.dll" Ehocjo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jklpakam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkjcegnh.dll" Oefpoi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cmabpmjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cmflkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aljhbm32.dll" Ioeineap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mogccnfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Midbfehn.dll" Ekoniian.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Agdhln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fmkgdgej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Anobaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cplhdn32.dll" Mogccnfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqbegb32.dll" Gpkbaekd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hbihdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lehaad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnomkf32.dll" Mlbbel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbfmek32.dll" Imfill32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iihilhol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifqikhho.dll" Pjcbkbnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nlknqd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mqojlbcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfgdqk32.dll" Abimhd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fklcbocl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Npcokpln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Emihbp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Idceim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmeimo32.dll" Jepjbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhoecana.dll" Ohhnln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgnnkfll.dll" Lemagjjj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Daqbbe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eoilfidj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfplmb32.dll" Gadqepkn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nmgjbg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pmoijcje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omooiflc.dll" Mqojlbcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pknhff32.dll" Hoakpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oflfoepg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fipbnn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jgngkmkf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bfpdcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lefllfkj.dll" Bmjlpnpb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mndapl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mccfnc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Phnoac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dmdhmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdahkafp.dll" Beomhm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eohcon32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Baegchgb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mckeji32.dll" Galoin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mckfln32.dll" Ipdnna32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qqcjnell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cafhap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcmflj32.dll" Hddbmedc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Alfpijll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bohbackj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nbibpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kelkkpae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gifadggi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lkqliaki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Faeihogj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aekleind.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bcjlld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fachob32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dmglmpkn.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3832 wrote to memory of 4140 3832 2026-10-11_90c3f3744bdfb5e3c2fd10dad9bafc58_elex_wannacry.exe 90 PID 4140 wrote to memory of 5316 4140 Okcmingd.exe 91 PID 5316 wrote to memory of 2648 5316 Odnngclb.exe 92 PID 2648 wrote to memory of 2264 2648 Okjbimal.exe 93 PID 2264 wrote to memory of 4540 2264 Odbgbb32.exe 94 PID 4540 wrote to memory of 2400 4540 Pbhdafdd.exe 95 PID 2400 wrote to memory of 2880 2400 Pgemimck.exe 96 PID 2880 wrote to memory of 2104 2880 Pndoagfc.exe 97 PID 2104 wrote to memory of 2692 2104 Qepccqlm.exe 98 PID 2692 wrote to memory of 2040 2692 Qkjlpk32.exe 99 PID 2040 wrote to memory of 3132 2040 Achmjmnb.exe 100 PID 3132 wrote to memory of 52 3132 Abimhd32.exe 101 PID 52 wrote to memory of 3512 52 Ajfobfaj.exe 102 PID 3512 wrote to memory of 2028 3512 Abpcicpi.exe 103 PID 2028 wrote to memory of 5588 2028 Bjkhme32.exe 104 PID 5588 wrote to memory of 5932 5588 Baepjpea.exe 105 PID 5932 wrote to memory of 1384 5932 Bhohfj32.exe 106 PID 1384 wrote to memory of 3644 1384 Bbgiibja.exe 107 PID 3644 wrote to memory of 3908 3644 Bopgdcnc.exe 108 PID 3908 wrote to memory of 5852 3908 Caapfnkd.exe 109 PID 5852 wrote to memory of 1000 5852 Clfdcgkj.exe 110 PID 1000 wrote to memory of 2928 1000 Caeiam32.exe 111 PID 2928 wrote to memory of 6124 2928 Ckpjob32.exe 112 PID 6124 wrote to memory of 5444 6124 Dampal32.exe 113 PID 5444 wrote to memory of 1332 5444 Dhfhnfhc.exe 114 PID 1332 wrote to memory of 1932 1332 Daaiml32.exe 115 PID 1932 wrote to memory of 2800 1932 Eddodfhp.exe 116 PID 2800 wrote to memory of 4164 2800 Eojcao32.exe 117 PID 4164 wrote to memory of 1160 4164 Eedkniob.exe 118 PID 1160 wrote to memory of 5584 1160 Ekqcfpmj.exe 119 PID 5584 wrote to memory of 4424 5584 Eefhcimp.exe 120 PID 4424 wrote to memory of 1292 4424 Elpppcdl.exe 121 PID 1292 wrote to memory of 5776 1292 Eamhhjbd.exe 122 PID 5776 wrote to memory of 2704 5776 Ehgqed32.exe 123 PID 2704 wrote to memory of 3192 2704 Ecmebm32.exe 124 PID 3192 wrote to memory of 3252 3192 Ednajepe.exe 125 PID 3252 wrote to memory of 5476 3252 Eocegn32.exe 126 PID 5476 wrote to memory of 6060 5476 Fdpnpe32.exe 127 PID 6060 wrote to memory of 6036 6060 Foebmn32.exe 128 PID 6036 wrote to memory of 1564 6036 Ffpjihee.exe 129 PID 1564 wrote to memory of 4016 1564 Fklcbocl.exe 130 PID 4016 wrote to memory of 3204 4016 Ffbgog32.exe 131 PID 3204 wrote to memory of 5136 3204 Fllplajo.exe 132 PID 5136 wrote to memory of 6016 5136 Fbihdhhf.exe 133 PID 6016 wrote to memory of 4860 6016 Gfimpfmj.exe 134 PID 4860 wrote to memory of 3764 4860 Goabhl32.exe 135 PID 3764 wrote to memory of 2716 3764 Gfkjef32.exe 136 PID 2716 wrote to memory of 2292 2716 Glebbpbd.exe 137 PID 2292 wrote to memory of 5188 2292 Gofkckoe.exe 138 PID 5188 wrote to memory of 4528 5188 Gcddjiel.exe 139 PID 4528 wrote to memory of 3656 4528 Giqlbqcc.exe 140 PID 3656 wrote to memory of 2472 3656 Hdgmga32.exe 141 PID 2472 wrote to memory of 4676 2472 Hkaedk32.exe 142 PID 4676 wrote to memory of 4128 4676 Hiefmp32.exe 143 PID 4128 wrote to memory of 4976 4128 Hbnjfefo.exe 144 PID 4976 wrote to memory of 2960 4976 Hoakpi32.exe 145 PID 2960 wrote to memory of 2428 2960 Heochp32.exe 146 PID 2428 wrote to memory of 3880 2428 Hcpcehko.exe 147 PID 3880 wrote to memory of 3536 3880 Hmhhnmao.exe 148 PID 3536 wrote to memory of 5592 3536 Iecmcpoj.exe 149 PID 5592 wrote to memory of 4224 5592 Ikmepj32.exe 150 PID 4224 wrote to memory of 1836 4224 Ipkneh32.exe 151 PID 1836 wrote to memory of 264 1836 Imonol32.exe 152 PID 264 wrote to memory of 5680 264 Iejcco32.exe 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-11_90c3f3744bdfb5e3c2fd10dad9bafc58_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-11_90c3f3744bdfb5e3c2fd10dad9bafc58_elex_wannacry.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\SysWOW64\Okcmingd.exeC:\Windows\system32\Okcmingd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\Odnngclb.exeC:\Windows\system32\Odnngclb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Windows\SysWOW64\Okjbimal.exeC:\Windows\system32\Okjbimal.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\Odbgbb32.exeC:\Windows\system32\Odbgbb32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\Pbhdafdd.exeC:\Windows\system32\Pbhdafdd.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\Pgemimck.exeC:\Windows\system32\Pgemimck.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\Pndoagfc.exeC:\Windows\system32\Pndoagfc.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\Qepccqlm.exeC:\Windows\system32\Qepccqlm.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\Qkjlpk32.exeC:\Windows\system32\Qkjlpk32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\Achmjmnb.exeC:\Windows\system32\Achmjmnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\Abimhd32.exeC:\Windows\system32\Abimhd32.exe12⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\Ajfobfaj.exeC:\Windows\system32\Ajfobfaj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Windows\SysWOW64\Abpcicpi.exeC:\Windows\system32\Abpcicpi.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\Bjkhme32.exeC:\Windows\system32\Bjkhme32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\Baepjpea.exeC:\Windows\system32\Baepjpea.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\Bhohfj32.exeC:\Windows\system32\Bhohfj32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\Bbgiibja.exeC:\Windows\system32\Bbgiibja.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\Bopgdcnc.exeC:\Windows\system32\Bopgdcnc.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\Caapfnkd.exeC:\Windows\system32\Caapfnkd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\Clfdcgkj.exeC:\Windows\system32\Clfdcgkj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\Caeiam32.exeC:\Windows\system32\Caeiam32.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\Ckpjob32.exeC:\Windows\system32\Ckpjob32.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\Dampal32.exeC:\Windows\system32\Dampal32.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\SysWOW64\Dhfhnfhc.exeC:\Windows\system32\Dhfhnfhc.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Windows\SysWOW64\Daaiml32.exeC:\Windows\system32\Daaiml32.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\Eddodfhp.exeC:\Windows\system32\Eddodfhp.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\Eojcao32.exeC:\Windows\system32\Eojcao32.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\Eedkniob.exeC:\Windows\system32\Eedkniob.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\Ekqcfpmj.exeC:\Windows\system32\Ekqcfpmj.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\Eefhcimp.exeC:\Windows\system32\Eefhcimp.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\Elpppcdl.exeC:\Windows\system32\Elpppcdl.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\Eamhhjbd.exeC:\Windows\system32\Eamhhjbd.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\Ehgqed32.exeC:\Windows\system32\Ehgqed32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Windows\SysWOW64\Ecmebm32.exeC:\Windows\system32\Ecmebm32.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\Ednajepe.exeC:\Windows\system32\Ednajepe.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\Eocegn32.exeC:\Windows\system32\Eocegn32.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\Fdpnpe32.exeC:\Windows\system32\Fdpnpe32.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Windows\SysWOW64\Foebmn32.exeC:\Windows\system32\Foebmn32.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Windows\SysWOW64\Ffpjihee.exeC:\Windows\system32\Ffpjihee.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\Fklcbocl.exeC:\Windows\system32\Fklcbocl.exe41⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\Ffbgog32.exeC:\Windows\system32\Ffbgog32.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\Fllplajo.exeC:\Windows\system32\Fllplajo.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\Fbihdhhf.exeC:\Windows\system32\Fbihdhhf.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Windows\SysWOW64\Gfimpfmj.exeC:\Windows\system32\Gfimpfmj.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\SysWOW64\Goabhl32.exeC:\Windows\system32\Goabhl32.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\Gfkjef32.exeC:\Windows\system32\Gfkjef32.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\Glebbpbd.exeC:\Windows\system32\Glebbpbd.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\Gofkckoe.exeC:\Windows\system32\Gofkckoe.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\Gcddjiel.exeC:\Windows\system32\Gcddjiel.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Windows\SysWOW64\Giqlbqcc.exeC:\Windows\system32\Giqlbqcc.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\Hdgmga32.exeC:\Windows\system32\Hdgmga32.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\Hkaedk32.exeC:\Windows\system32\Hkaedk32.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\Hiefmp32.exeC:\Windows\system32\Hiefmp32.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\Hbnjfefo.exeC:\Windows\system32\Hbnjfefo.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\Hoakpi32.exeC:\Windows\system32\Hoakpi32.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\Heochp32.exeC:\Windows\system32\Heochp32.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\Hcpcehko.exeC:\Windows\system32\Hcpcehko.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\Hmhhnmao.exeC:\Windows\system32\Hmhhnmao.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\Iecmcpoj.exeC:\Windows\system32\Iecmcpoj.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\Ikmepj32.exeC:\Windows\system32\Ikmepj32.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Windows\SysWOW64\Ipkneh32.exeC:\Windows\system32\Ipkneh32.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\Imonol32.exeC:\Windows\system32\Imonol32.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\Iejcco32.exeC:\Windows\system32\Iejcco32.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\Ippgqg32.exeC:\Windows\system32\Ippgqg32.exe65⤵
- Executes dropped EXE
PID:5680 -
C:\Windows\SysWOW64\Imdgjlgb.exeC:\Windows\system32\Imdgjlgb.exe66⤵PID:3112
-
C:\Windows\SysWOW64\Jmfdpkeo.exeC:\Windows\system32\Jmfdpkeo.exe67⤵
- System Location Discovery: System Language Discovery
PID:5868 -
C:\Windows\SysWOW64\Jeaidn32.exeC:\Windows\system32\Jeaidn32.exe68⤵
- Drops file in System32 directory
PID:5608 -
C:\Windows\SysWOW64\Jpgmaf32.exeC:\Windows\system32\Jpgmaf32.exe69⤵PID:1304
-
C:\Windows\SysWOW64\Jfaenqjm.exeC:\Windows\system32\Jfaenqjm.exe70⤵
- System Location Discovery: System Language Discovery
PID:4960 -
C:\Windows\SysWOW64\Jcefgeif.exeC:\Windows\system32\Jcefgeif.exe71⤵PID:628
-
C:\Windows\SysWOW64\Jlpklg32.exeC:\Windows\system32\Jlpklg32.exe72⤵
- System Location Discovery: System Language Discovery
PID:4232 -
C:\Windows\SysWOW64\Jidkek32.exeC:\Windows\system32\Jidkek32.exe73⤵PID:2836
-
C:\Windows\SysWOW64\Kblpnall.exeC:\Windows\system32\Kblpnall.exe74⤵PID:6048
-
C:\Windows\SysWOW64\Klddgfbl.exeC:\Windows\system32\Klddgfbl.exe75⤵PID:4664
-
C:\Windows\SysWOW64\Klgqmfpj.exeC:\Windows\system32\Klgqmfpj.exe76⤵PID:696
-
C:\Windows\SysWOW64\Kfmejopp.exeC:\Windows\system32\Kfmejopp.exe77⤵PID:5276
-
C:\Windows\SysWOW64\Klimbf32.exeC:\Windows\system32\Klimbf32.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2152 -
C:\Windows\SysWOW64\Kfoapo32.exeC:\Windows\system32\Kfoapo32.exe79⤵PID:3272
-
C:\Windows\SysWOW64\Kfanen32.exeC:\Windows\system32\Kfanen32.exe80⤵PID:2708
-
C:\Windows\SysWOW64\Libggiik.exeC:\Windows\system32\Libggiik.exe81⤵PID:5984
-
C:\Windows\SysWOW64\Lbjlpo32.exeC:\Windows\system32\Lbjlpo32.exe82⤵PID:764
-
C:\Windows\SysWOW64\Lmppmh32.exeC:\Windows\system32\Lmppmh32.exe83⤵PID:1992
-
C:\Windows\SysWOW64\Lbmheomi.exeC:\Windows\system32\Lbmheomi.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1920 -
C:\Windows\SysWOW64\Lpqioclc.exeC:\Windows\system32\Lpqioclc.exe85⤵PID:4636
-
C:\Windows\SysWOW64\Lemagjjj.exeC:\Windows\system32\Lemagjjj.exe86⤵
- Modifies registry class
PID:5024 -
C:\Windows\SysWOW64\Mmgfmg32.exeC:\Windows\system32\Mmgfmg32.exe87⤵
- System Location Discovery: System Language Discovery
PID:6032 -
C:\Windows\SysWOW64\Mmiccf32.exeC:\Windows\system32\Mmiccf32.exe88⤵
- System Location Discovery: System Language Discovery
PID:980 -
C:\Windows\SysWOW64\Mmlphfed.exeC:\Windows\system32\Mmlphfed.exe89⤵PID:5512
-
C:\Windows\SysWOW64\Mchhamcl.exeC:\Windows\system32\Mchhamcl.exe90⤵PID:5332
-
C:\Windows\SysWOW64\Mmnlnfcb.exeC:\Windows\system32\Mmnlnfcb.exe91⤵
- System Location Discovery: System Language Discovery
PID:3564 -
C:\Windows\SysWOW64\Mckefmai.exeC:\Windows\system32\Mckefmai.exe92⤵PID:1396
-
C:\Windows\SysWOW64\Mlciobhj.exeC:\Windows\system32\Mlciobhj.exe93⤵
- System Location Discovery: System Language Discovery
PID:1356 -
C:\Windows\SysWOW64\Meknhh32.exeC:\Windows\system32\Meknhh32.exe94⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2320 -
C:\Windows\SysWOW64\Npabeq32.exeC:\Windows\system32\Npabeq32.exe95⤵PID:4616
-
C:\Windows\SysWOW64\Niifnf32.exeC:\Windows\system32\Niifnf32.exe96⤵PID:5812
-
C:\Windows\SysWOW64\Npcokpln.exeC:\Windows\system32\Npcokpln.exe97⤵
- Modifies registry class
PID:2724 -
C:\Windows\SysWOW64\Nepgcgje.exeC:\Windows\system32\Nepgcgje.exe98⤵PID:1088
-
C:\Windows\SysWOW64\Ndagao32.exeC:\Windows\system32\Ndagao32.exe99⤵PID:3188
-
C:\Windows\SysWOW64\Njnpie32.exeC:\Windows\system32\Njnpie32.exe100⤵PID:1060
-
C:\Windows\SysWOW64\Ndcdfnpa.exeC:\Windows\system32\Ndcdfnpa.exe101⤵PID:2316
-
C:\Windows\SysWOW64\Njploeoi.exeC:\Windows\system32\Njploeoi.exe102⤵PID:4812
-
C:\Windows\SysWOW64\Ngdmhimb.exeC:\Windows\system32\Ngdmhimb.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4584 -
C:\Windows\SysWOW64\Odhman32.exeC:\Windows\system32\Odhman32.exe104⤵PID:5184
-
C:\Windows\SysWOW64\Ojefjd32.exeC:\Windows\system32\Ojefjd32.exe105⤵PID:2044
-
C:\Windows\SysWOW64\Odkjgm32.exeC:\Windows\system32\Odkjgm32.exe106⤵PID:1444
-
C:\Windows\SysWOW64\Oflfoepg.exeC:\Windows\system32\Oflfoepg.exe107⤵
- Modifies registry class
PID:4952 -
C:\Windows\SysWOW64\Odmgmmhf.exeC:\Windows\system32\Odmgmmhf.exe108⤵PID:2848
-
C:\Windows\SysWOW64\Onekeb32.exeC:\Windows\system32\Onekeb32.exe109⤵PID:1736
-
C:\Windows\SysWOW64\Ocbdni32.exeC:\Windows\system32\Ocbdni32.exe110⤵PID:5328
-
C:\Windows\SysWOW64\Onhhkb32.exeC:\Windows\system32\Onhhkb32.exe111⤵PID:4868
-
C:\Windows\SysWOW64\Odaphl32.exeC:\Windows\system32\Odaphl32.exe112⤵
- Drops file in System32 directory
PID:4372 -
C:\Windows\SysWOW64\Pfcmpdjp.exeC:\Windows\system32\Pfcmpdjp.exe113⤵PID:5548
-
C:\Windows\SysWOW64\Pcgmiiii.exeC:\Windows\system32\Pcgmiiii.exe114⤵PID:1520
-
C:\Windows\SysWOW64\Pnlafaio.exeC:\Windows\system32\Pnlafaio.exe115⤵PID:1768
-
C:\Windows\SysWOW64\Pcijoh32.exeC:\Windows\system32\Pcijoh32.exe116⤵PID:4536
-
C:\Windows\SysWOW64\Pjcbkbnc.exeC:\Windows\system32\Pjcbkbnc.exe117⤵
- Modifies registry class
PID:4200 -
C:\Windows\SysWOW64\Pqmjhm32.exeC:\Windows\system32\Pqmjhm32.exe118⤵
- System Location Discovery: System Language Discovery
PID:3940 -
C:\Windows\SysWOW64\Pfjcpc32.exeC:\Windows\system32\Pfjcpc32.exe119⤵PID:5788
-
C:\Windows\SysWOW64\Pqpgnl32.exeC:\Windows\system32\Pqpgnl32.exe120⤵PID:5340
-
C:\Windows\SysWOW64\Pflpfcbe.exeC:\Windows\system32\Pflpfcbe.exe121⤵PID:3372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-