Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 22:27
Behavioral task
behavioral1
Sample
2026-10-14_457ef6794ad52a32b0963101f43f9929_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-14_457ef6794ad52a32b0963101f43f9929_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-10-14_457ef6794ad52a32b0963101f43f9929_elex_wannacry.exe
- Size 429KB
- Sample261014-2dcclabz9w
- SHA256 a573d44c67efa991916a6f352e729258a9d5e5f890d48d07f37f7536523abd11
- MD5 457ef6794ad52a32b0963101f43f9929
- SHA1 861864fd8088f81a2071c6fb83b321ae9cf80d1b
- SHA512 14bff367d655fb7c1ed46a7cd31877ff352dc77b10b5966dfb2bf54bdd06a49f54bb0036c4c5e43646a0979bdb0ec5c711b26b20831dbd0103a4abe34e479f93
- SSDEEP 6144:Oq7BTPRy+RzONB2gV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:/VDRmk/NcZ7/N
- TLSH T1E0944F692A3019E6DDEE6BF5AC1259D88181E9B514F2F13F6623DFDCC8E6D61CC04B80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cobkbhgk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dldlbgbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fmfnig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pehnaqid.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gnqflhcg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmmppc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Koodka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mpiejkql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pjpokm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Emkeho32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fgpilc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bkjpek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Beomhm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lehaad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mimphakb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mpiejkql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pcdjic32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phekliab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Acnefoac.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kqnbea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lngkjhmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Piknfgmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cjjlep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Emenhcdf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kflink32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phjdggoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhbelp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Acclejeb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcgjie32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apjkmgjm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgpllm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkcnnk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pojccmii.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Poajdlcq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejoogm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hkbmjhdo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jpdhdl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lclpmdhd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Coohbbeb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cofnba32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lhijcohe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bicjjncd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eeqclfaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eohcon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fihnhc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmdcpoid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jofaeb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jikfbkbc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Poodicio.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjhjli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mehcnlie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ccpdhfmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ddifaqcn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhgogojd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ffkpadga.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hgokikan.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnmdfknm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emenhcdf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mnjqfeld.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nockfgao.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgffci32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfpdcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gljgkb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ingpgcmj.exe - Executes dropped EXE 64 IoCs
pid Process 2460 Lpilcnoo.exe 5852 Lehaad32.exe 5160 Lfgnkgbf.exe 2528 Lhijcohe.exe 2680 Lbnnphhk.exe 464 Lihfmb32.exe 5084 Loeoei32.exe 2880 Meogbcel.exe 2100 Mlipomli.exe 3840 Mbchkg32.exe 4376 Mimphakb.exe 4312 Mojhphij.exe 1192 Medqmb32.exe 5380 Mpiejkql.exe 5844 Mfcmge32.exe 4032 Mlpeol32.exe 3396 Moobkh32.exe 3884 Mehjhbma.exe 1340 Mpnnek32.exe 5176 Nfhfbedd.exe 2064 Nhicjm32.exe 3496 Nockfgao.exe 1964 Nemcca32.exe 3756 Npbhqj32.exe 2596 Ngmpmd32.exe 2108 Nhnlelfm.exe 6020 Nccqbeec.exe 760 Nimioo32.exe 1180 Npgalidl.exe 6008 Ngaihcli.exe 5560 Nhbfpl32.exe 264 Oomnmfid.exe 2748 Oeffip32.exe 3904 Oplkgi32.exe 948 Ohgokknb.exe 6036 Ocmchdmh.exe 2756 Ohjlqklp.exe 3216 Ocopncke.exe 1420 Oiihkncb.exe 5752 Opcqgh32.exe 4260 Oepipo32.exe 3260 Pljalipc.exe 1000 Pcdjic32.exe 1220 Phqbaj32.exe 2052 Pokjnd32.exe 2576 Pjpokm32.exe 2868 Ppjghgdg.exe 4140 Pgdodq32.exe 5680 Phekliab.exe 4712 Poodicio.exe 5876 Pfilfm32.exe 5364 Plcdbghi.exe 1644 Pcmloa32.exe 2376 Pjgellfb.exe 1860 Qqamieno.exe 1300 Qgkeep32.exe 5924 Qlhnng32.exe 5152 Qcbfjqkp.exe 5808 Ajlngk32.exe 4932 Aqffdejj.exe 3896 Agpoqoaf.exe 5520 Ahakhg32.exe 5952 Acfoep32.exe 2936 Ajqgbjoh.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Nhbfpl32.exe Ngaihcli.exe File created C:\Windows\SysWOW64\Pjgellfb.exe Pcmloa32.exe File created C:\Windows\SysWOW64\Cjlijp32.exe Cofemg32.exe File created C:\Windows\SysWOW64\Nmmjai32.dll Aeaagoaj.exe File created C:\Windows\SysWOW64\Hoaocf32.exe Hehkjpod.exe File opened for modification C:\Windows\SysWOW64\Ackiqpce.exe Aifdcgcp.exe File created C:\Windows\SysWOW64\Ibadoc32.exe Ilglbjbl.exe File opened for modification C:\Windows\SysWOW64\Fkihgb32.exe Fdopkhfk.exe File created C:\Windows\SysWOW64\Nakgec32.dll Ffaogm32.exe File created C:\Windows\SysWOW64\Hanhcl32.dll Jcbdph32.exe File created C:\Windows\SysWOW64\Foagel32.dll Gmmmoppl.exe File created C:\Windows\SysWOW64\Olbdacbp.exe Oehldi32.exe File created C:\Windows\SysWOW64\Bcfabgel.exe Bfbahcfc.exe File opened for modification C:\Windows\SysWOW64\Jcknpi32.exe Ilafcomm.exe File created C:\Windows\SysWOW64\Dfglpjqo.exe Domdcpib.exe File created C:\Windows\SysWOW64\Qfilee32.dll Fmjqjqao.exe File created C:\Windows\SysWOW64\Calmcg32.exe Ckbegmin.exe File opened for modification C:\Windows\SysWOW64\Cmflkl32.exe Cobkbhgk.exe File created C:\Windows\SysWOW64\Neglceej.exe Nnmdfknm.exe File opened for modification C:\Windows\SysWOW64\Phfjmlhh.exe Pehnaqid.exe File created C:\Windows\SysWOW64\Acfoep32.exe Ahakhg32.exe File created C:\Windows\SysWOW64\Cafqkmge.dll Jcknpi32.exe File opened for modification C:\Windows\SysWOW64\Cimckcoe.exe Cglgck32.exe File created C:\Windows\SysWOW64\Dmcnkmhc.dll Lbkkpb32.exe File created C:\Windows\SysWOW64\Kddnpj32.exe Jnjecp32.exe File opened for modification C:\Windows\SysWOW64\Dhbelp32.exe Dgbhbm32.exe File created C:\Windows\SysWOW64\Ljdbjpnm.dll Meogbcel.exe File created C:\Windows\SysWOW64\Ccmaihoc.dll Aqjpod32.exe File created C:\Windows\SysWOW64\Bidqddgp.exe Bcghlnih.exe File created C:\Windows\SysWOW64\Ecbjdcml.exe Emhahiep.exe File created C:\Windows\SysWOW64\Odljbmgj.dll Kdfjej32.exe File created C:\Windows\SysWOW64\Kleajegi.exe Kflink32.exe File created C:\Windows\SysWOW64\Lpilcnoo.exe 2026-10-14_457ef6794ad52a32b0963101f43f9929_elex_wannacry.exe File created C:\Windows\SysWOW64\Mopoei32.dll Ikfgeh32.exe File created C:\Windows\SysWOW64\Hgdmgi32.dll Jgigfg32.exe File created C:\Windows\SysWOW64\Lgephccp.exe Lmpkkjcj.exe File created C:\Windows\SysWOW64\Aidokffk.dll Qoboofnb.exe File created C:\Windows\SysWOW64\Emoanbll.exe Eehime32.exe File created C:\Windows\SysWOW64\Fealcc32.exe Fngcfikb.exe File created C:\Windows\SysWOW64\Jeeded32.dll Chfepa32.exe File opened for modification C:\Windows\SysWOW64\Enfceefi.exe Ekggijge.exe File opened for modification C:\Windows\SysWOW64\Mfcmge32.exe Mpiejkql.exe File created C:\Windows\SysWOW64\Noljjg32.dll Oboicmhj.exe File opened for modification C:\Windows\SysWOW64\Emoanbll.exe Eehime32.exe File created C:\Windows\SysWOW64\Amnlfk32.exe Agdcja32.exe File created C:\Windows\SysWOW64\Bqealm32.dll Ackiqpce.exe File created C:\Windows\SysWOW64\Ofqiil32.dll Bcboan32.exe File created C:\Windows\SysWOW64\Jpooimdc.exe Jkbfafel.exe File created C:\Windows\SysWOW64\Dinnee32.dll Fmehnn32.exe File created C:\Windows\SysWOW64\Hnbaba32.dll Cihcen32.exe File opened for modification C:\Windows\SysWOW64\Diclff32.exe Dbicjlji.exe File created C:\Windows\SysWOW64\Dieilepc.exe Dfglpjqo.exe File created C:\Windows\SysWOW64\Ndddeknc.dll Phjdggoj.exe File created C:\Windows\SysWOW64\Nfhfbedd.exe Mpnnek32.exe File created C:\Windows\SysWOW64\Ofqbhn32.dll Leenanik.exe File created C:\Windows\SysWOW64\Cofemg32.exe Cjjlep32.exe File opened for modification C:\Windows\SysWOW64\Podcnh32.exe Oaqbdc32.exe File opened for modification C:\Windows\SysWOW64\Geohdago.exe Gpbplkhh.exe File opened for modification C:\Windows\SysWOW64\Bgkijp32.exe Bmceaj32.exe File opened for modification C:\Windows\SysWOW64\Ajbmmcii.exe Aomipkic.exe File created C:\Windows\SysWOW64\Depglkhi.dll Lngkjhmi.exe File created C:\Windows\SysWOW64\Oanodnip.exe Ofhkgeij.exe File created C:\Windows\SysWOW64\Qqamieno.exe Pjgellfb.exe File opened for modification C:\Windows\SysWOW64\Phpkgc32.exe Pklkmo32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 5984 12952 WerFault.exe 720 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Agpoqoaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmdcpoid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bdagidhi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mndhkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ffqhmf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmfkac32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dibmfb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Leenanik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Plpqba32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ilafcomm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kknfmdko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhkmoifp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emoanbll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mobjho32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Amcmie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkmbbajb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qifnaecf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmooak32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djcoko32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbqqeahl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lklbnb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lmpkkjcj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aifdcgcp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfpdcc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmflkl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dieilepc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Boeelcmm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Holfhfij.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hoaocf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npepdl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aqffdejj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nelfnd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lcdcbokq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddngdj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbgnobpg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knaldo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkgicccd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knnhdied.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chfepa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhijcohe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cpbbln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpggkbfq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mglfibmh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Podcnh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eeqclfaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kddnpj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pkbjchio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cggnhlml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pidaleei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Poimigfm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Deliaf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fejebdig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nemcca32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hjedpkne.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nliakd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Okbhgq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oehldi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bcfabgel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpjlgp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aoioeo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phekliab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjpbkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahnghafl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgigfg32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqjibapd.dll" Pokjnd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kqbdej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nabfcegi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmolbbcj.dll" Dfglpjqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifmlhcfo.dll" Mnhdae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkkbp32.dll" Dcgackke.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ccpdhfmb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jlclnhho.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Plcdbghi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nhkief32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mjmokmji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dekioo32.dll" Cgnogmkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Liioop32.dll" Kabkpqgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apgnin32.dll" Epdaneff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fmfnig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Npepdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgijlm32.dll" Ejlban32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nlfnkoia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jghpkq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ffaogm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ibadoc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lgblhmag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ohggah32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oplkgi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkjhoebc.dll" Kgdpgo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfpmglkb.dll" Jndenjmo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nimioo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bijnnf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nabfcegi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbpfckie.dll" Hedaoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ahofidlb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 2026-10-14_457ef6794ad52a32b0963101f43f9929_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iegpaf32.dll" Fkihgb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Emhahiep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Headjael.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mggecl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bkmmkj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dmmblkpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Depglkhi.dll" Lngkjhmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bekdmnio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiphfa32.dll" Dnondf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dhgogojd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nhbfpl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Plpqba32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Epikid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mnegkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qoaoflcl.dll" Mojhphij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpdiag32.dll" Fabqdl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Njdlfbgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epbbim32.dll" Bjicnbba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dfglpjqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbkbkm32.dll" Agdcja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoodae32.dll" Mimphakb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgodho32.dll" Hpaibe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hdclbopg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lgccccec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mmfalimb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Beajnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jndenjmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnhcfa32.dll" Nfeekgjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hpkcafjg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Miabik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcmcpl32.dll" Lklbnb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lklbnb32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4220 wrote to memory of 2460 4220 2026-10-14_457ef6794ad52a32b0963101f43f9929_elex_wannacry.exe 89 PID 2460 wrote to memory of 5852 2460 Lpilcnoo.exe 90 PID 5852 wrote to memory of 5160 5852 Lehaad32.exe 91 PID 5160 wrote to memory of 2528 5160 Lfgnkgbf.exe 92 PID 2528 wrote to memory of 2680 2528 Lhijcohe.exe 93 PID 2680 wrote to memory of 464 2680 Lbnnphhk.exe 94 PID 464 wrote to memory of 5084 464 Lihfmb32.exe 95 PID 5084 wrote to memory of 2880 5084 Loeoei32.exe 96 PID 2880 wrote to memory of 2100 2880 Meogbcel.exe 97 PID 2100 wrote to memory of 3840 2100 Mlipomli.exe 98 PID 3840 wrote to memory of 4376 3840 Mbchkg32.exe 99 PID 4376 wrote to memory of 4312 4376 Mimphakb.exe 100 PID 4312 wrote to memory of 1192 4312 Mojhphij.exe 101 PID 1192 wrote to memory of 5380 1192 Medqmb32.exe 102 PID 5380 wrote to memory of 5844 5380 Mpiejkql.exe 103 PID 5844 wrote to memory of 4032 5844 Mfcmge32.exe 104 PID 4032 wrote to memory of 3396 4032 Mlpeol32.exe 105 PID 3396 wrote to memory of 3884 3396 Moobkh32.exe 106 PID 3884 wrote to memory of 1340 3884 Mehjhbma.exe 107 PID 1340 wrote to memory of 5176 1340 Mpnnek32.exe 108 PID 5176 wrote to memory of 2064 5176 Nfhfbedd.exe 109 PID 2064 wrote to memory of 3496 2064 Nhicjm32.exe 110 PID 3496 wrote to memory of 1964 3496 Nockfgao.exe 111 PID 1964 wrote to memory of 3756 1964 Nemcca32.exe 112 PID 3756 wrote to memory of 2596 3756 Npbhqj32.exe 113 PID 2596 wrote to memory of 2108 2596 Ngmpmd32.exe 114 PID 2108 wrote to memory of 6020 2108 Nhnlelfm.exe 115 PID 6020 wrote to memory of 760 6020 Nccqbeec.exe 116 PID 760 wrote to memory of 1180 760 Nimioo32.exe 117 PID 1180 wrote to memory of 6008 1180 Npgalidl.exe 118 PID 6008 wrote to memory of 5560 6008 Ngaihcli.exe 119 PID 5560 wrote to memory of 264 5560 Nhbfpl32.exe 120 PID 264 wrote to memory of 2748 264 Oomnmfid.exe 121 PID 2748 wrote to memory of 3904 2748 Oeffip32.exe 122 PID 3904 wrote to memory of 948 3904 Oplkgi32.exe 123 PID 948 wrote to memory of 6036 948 Ohgokknb.exe 124 PID 6036 wrote to memory of 2756 6036 Ocmchdmh.exe 125 PID 2756 wrote to memory of 3216 2756 Ohjlqklp.exe 126 PID 3216 wrote to memory of 1420 3216 Ocopncke.exe 127 PID 1420 wrote to memory of 5752 1420 Oiihkncb.exe 128 PID 5752 wrote to memory of 4260 5752 Opcqgh32.exe 129 PID 4260 wrote to memory of 3260 4260 Oepipo32.exe 130 PID 3260 wrote to memory of 1000 3260 Pljalipc.exe 131 PID 1000 wrote to memory of 1220 1000 Pcdjic32.exe 132 PID 1220 wrote to memory of 2052 1220 Phqbaj32.exe 133 PID 2052 wrote to memory of 2576 2052 Pokjnd32.exe 134 PID 2576 wrote to memory of 2868 2576 Pjpokm32.exe 135 PID 2868 wrote to memory of 4140 2868 Ppjghgdg.exe 136 PID 4140 wrote to memory of 5680 4140 Pgdodq32.exe 137 PID 5680 wrote to memory of 4712 5680 Phekliab.exe 138 PID 4712 wrote to memory of 5876 4712 Poodicio.exe 139 PID 5876 wrote to memory of 5364 5876 Pfilfm32.exe 140 PID 5364 wrote to memory of 1644 5364 Plcdbghi.exe 141 PID 1644 wrote to memory of 2376 1644 Pcmloa32.exe 142 PID 2376 wrote to memory of 1860 2376 Pjgellfb.exe 143 PID 1860 wrote to memory of 1300 1860 Qqamieno.exe 144 PID 1300 wrote to memory of 5924 1300 Qgkeep32.exe 145 PID 5924 wrote to memory of 5152 5924 Qlhnng32.exe 146 PID 5152 wrote to memory of 5808 5152 Qcbfjqkp.exe 147 PID 5808 wrote to memory of 4932 5808 Ajlngk32.exe 148 PID 4932 wrote to memory of 3896 4932 Aqffdejj.exe 149 PID 3896 wrote to memory of 5520 3896 Agpoqoaf.exe 150 PID 5520 wrote to memory of 5952 5520 Ahakhg32.exe 151 PID 5952 wrote to memory of 2936 5952 Acfoep32.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-14_457ef6794ad52a32b0963101f43f9929_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-14_457ef6794ad52a32b0963101f43f9929_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\Lpilcnoo.exeC:\Windows\system32\Lpilcnoo.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\Lehaad32.exeC:\Windows\system32\Lehaad32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\Lfgnkgbf.exeC:\Windows\system32\Lfgnkgbf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\SysWOW64\Lhijcohe.exeC:\Windows\system32\Lhijcohe.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\Lbnnphhk.exeC:\Windows\system32\Lbnnphhk.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\Lihfmb32.exeC:\Windows\system32\Lihfmb32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\Loeoei32.exeC:\Windows\system32\Loeoei32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\Meogbcel.exeC:\Windows\system32\Meogbcel.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\Mlipomli.exeC:\Windows\system32\Mlipomli.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\Mbchkg32.exeC:\Windows\system32\Mbchkg32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\Mimphakb.exeC:\Windows\system32\Mimphakb.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\Mojhphij.exeC:\Windows\system32\Mojhphij.exe13⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\Medqmb32.exeC:\Windows\system32\Medqmb32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\Mpiejkql.exeC:\Windows\system32\Mpiejkql.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Windows\SysWOW64\Mfcmge32.exeC:\Windows\system32\Mfcmge32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Windows\SysWOW64\Mlpeol32.exeC:\Windows\system32\Mlpeol32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\Moobkh32.exeC:\Windows\system32\Moobkh32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\Mehjhbma.exeC:\Windows\system32\Mehjhbma.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\Mpnnek32.exeC:\Windows\system32\Mpnnek32.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\Nfhfbedd.exeC:\Windows\system32\Nfhfbedd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Windows\SysWOW64\Nhicjm32.exeC:\Windows\system32\Nhicjm32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\Nockfgao.exeC:\Windows\system32\Nockfgao.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\Nemcca32.exeC:\Windows\system32\Nemcca32.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\Npbhqj32.exeC:\Windows\system32\Npbhqj32.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\Ngmpmd32.exeC:\Windows\system32\Ngmpmd32.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\Nhnlelfm.exeC:\Windows\system32\Nhnlelfm.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\Nccqbeec.exeC:\Windows\system32\Nccqbeec.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\Nimioo32.exeC:\Windows\system32\Nimioo32.exe29⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\Npgalidl.exeC:\Windows\system32\Npgalidl.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\Ngaihcli.exeC:\Windows\system32\Ngaihcli.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Windows\SysWOW64\Nhbfpl32.exeC:\Windows\system32\Nhbfpl32.exe32⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Windows\SysWOW64\Oomnmfid.exeC:\Windows\system32\Oomnmfid.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\Oeffip32.exeC:\Windows\system32\Oeffip32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\Oplkgi32.exeC:\Windows\system32\Oplkgi32.exe35⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\Ohgokknb.exeC:\Windows\system32\Ohgokknb.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\Ocmchdmh.exeC:\Windows\system32\Ocmchdmh.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\Ohjlqklp.exeC:\Windows\system32\Ohjlqklp.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\Ocopncke.exeC:\Windows\system32\Ocopncke.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\Oiihkncb.exeC:\Windows\system32\Oiihkncb.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\Opcqgh32.exeC:\Windows\system32\Opcqgh32.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\Oepipo32.exeC:\Windows\system32\Oepipo32.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\Pljalipc.exeC:\Windows\system32\Pljalipc.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\Pcdjic32.exeC:\Windows\system32\Pcdjic32.exe44⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\Phqbaj32.exeC:\Windows\system32\Phqbaj32.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\Pokjnd32.exeC:\Windows\system32\Pokjnd32.exe46⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\Pjpokm32.exeC:\Windows\system32\Pjpokm32.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\Ppjghgdg.exeC:\Windows\system32\Ppjghgdg.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\Pgdodq32.exeC:\Windows\system32\Pgdodq32.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\Phekliab.exeC:\Windows\system32\Phekliab.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Windows\SysWOW64\Poodicio.exeC:\Windows\system32\Poodicio.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\Pfilfm32.exeC:\Windows\system32\Pfilfm32.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\Plcdbghi.exeC:\Windows\system32\Plcdbghi.exe53⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Windows\SysWOW64\Pcmloa32.exeC:\Windows\system32\Pcmloa32.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\Pjgellfb.exeC:\Windows\system32\Pjgellfb.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\Qqamieno.exeC:\Windows\system32\Qqamieno.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\Qgkeep32.exeC:\Windows\system32\Qgkeep32.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\Qlhnng32.exeC:\Windows\system32\Qlhnng32.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\Qcbfjqkp.exeC:\Windows\system32\Qcbfjqkp.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Windows\SysWOW64\Ajlngk32.exeC:\Windows\system32\Ajlngk32.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\Aqffdejj.exeC:\Windows\system32\Aqffdejj.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\Agpoqoaf.exeC:\Windows\system32\Agpoqoaf.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\Ahakhg32.exeC:\Windows\system32\Ahakhg32.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Windows\SysWOW64\Acfoep32.exeC:\Windows\system32\Acfoep32.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Windows\SysWOW64\Ajqgbjoh.exeC:\Windows\system32\Ajqgbjoh.exe65⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\SysWOW64\Aqjpod32.exeC:\Windows\system32\Aqjpod32.exe66⤵
- Drops file in System32 directory
PID:5400 -
C:\Windows\SysWOW64\Agdhln32.exeC:\Windows\system32\Agdhln32.exe67⤵PID:1940
-
C:\Windows\SysWOW64\Aifdcgcp.exeC:\Windows\system32\Aifdcgcp.exe68⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5656 -
C:\Windows\SysWOW64\Ackiqpce.exeC:\Windows\system32\Ackiqpce.exe69⤵
- Drops file in System32 directory
PID:628 -
C:\Windows\SysWOW64\Ajeami32.exeC:\Windows\system32\Ajeami32.exe70⤵PID:3564
-
C:\Windows\SysWOW64\Amcmie32.exeC:\Windows\system32\Amcmie32.exe71⤵
- System Location Discovery: System Language Discovery
PID:1312 -
C:\Windows\SysWOW64\Acnefoac.exeC:\Windows\system32\Acnefoac.exe72⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3784 -
C:\Windows\SysWOW64\Bijnnf32.exeC:\Windows\system32\Bijnnf32.exe73⤵
- Modifies registry class
PID:5484 -
C:\Windows\SysWOW64\Bodfkpfg.exeC:\Windows\system32\Bodfkpfg.exe74⤵PID:3400
-
C:\Windows\SysWOW64\Bfnnhj32.exeC:\Windows\system32\Bfnnhj32.exe75⤵PID:1264
-
C:\Windows\SysWOW64\Bmhfddeq.exeC:\Windows\system32\Bmhfddeq.exe76⤵PID:4700
-
C:\Windows\SysWOW64\Bcboan32.exeC:\Windows\system32\Bcboan32.exe77⤵
- Drops file in System32 directory
PID:5624 -
C:\Windows\SysWOW64\Bjlgnh32.exeC:\Windows\system32\Bjlgnh32.exe78⤵PID:696
-
C:\Windows\SysWOW64\Boipfp32.exeC:\Windows\system32\Boipfp32.exe79⤵PID:5776
-
C:\Windows\SysWOW64\Bfchcijo.exeC:\Windows\system32\Bfchcijo.exe80⤵PID:3948
-
C:\Windows\SysWOW64\Bmmppc32.exeC:\Windows\system32\Bmmppc32.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4540 -
C:\Windows\SysWOW64\Bcghlnih.exeC:\Windows\system32\Bcghlnih.exe82⤵
- Drops file in System32 directory
PID:2304 -
C:\Windows\SysWOW64\Bidqddgp.exeC:\Windows\system32\Bidqddgp.exe83⤵PID:5500
-
C:\Windows\SysWOW64\Bpniaool.exeC:\Windows\system32\Bpniaool.exe84⤵PID:5240
-
C:\Windows\SysWOW64\Cfhani32.exeC:\Windows\system32\Cfhani32.exe85⤵PID:2368
-
C:\Windows\SysWOW64\Cameka32.exeC:\Windows\system32\Cameka32.exe86⤵PID:1496
-
C:\Windows\SysWOW64\Cggnhlml.exeC:\Windows\system32\Cggnhlml.exe87⤵
- System Location Discovery: System Language Discovery
PID:4620 -
C:\Windows\SysWOW64\Cpbbln32.exeC:\Windows\system32\Cpbbln32.exe88⤵
- System Location Discovery: System Language Discovery
PID:1680 -
C:\Windows\SysWOW64\Cflkihbd.exeC:\Windows\system32\Cflkihbd.exe89⤵PID:2976
-
C:\Windows\SysWOW64\Cmfcfb32.exeC:\Windows\system32\Cmfcfb32.exe90⤵PID:896
-
C:\Windows\SysWOW64\Cglgck32.exeC:\Windows\system32\Cglgck32.exe91⤵
- Drops file in System32 directory
PID:3256 -
C:\Windows\SysWOW64\Cimckcoe.exeC:\Windows\system32\Cimckcoe.exe92⤵PID:1068
-
C:\Windows\SysWOW64\Cpglgmfa.exeC:\Windows\system32\Cpglgmfa.exe93⤵PID:1432
-
C:\Windows\SysWOW64\Cjmpeffh.exeC:\Windows\system32\Cjmpeffh.exe94⤵PID:3480
-
C:\Windows\SysWOW64\Dgqqnjea.exeC:\Windows\system32\Dgqqnjea.exe95⤵PID:5956
-
C:\Windows\SysWOW64\Dibmfb32.exeC:\Windows\system32\Dibmfb32.exe96⤵
- System Location Discovery: System Language Discovery
PID:2364 -
C:\Windows\SysWOW64\Dcgackke.exeC:\Windows\system32\Dcgackke.exe97⤵
- Modifies registry class
PID:1956 -
C:\Windows\SysWOW64\Didjkbim.exeC:\Windows\system32\Didjkbim.exe98⤵PID:236
-
C:\Windows\SysWOW64\Dpnbhl32.exeC:\Windows\system32\Dpnbhl32.exe99⤵PID:4824
-
C:\Windows\SysWOW64\Dfhjefhf.exeC:\Windows\system32\Dfhjefhf.exe100⤵PID:2060
-
C:\Windows\SysWOW64\Dannbogl.exeC:\Windows\system32\Dannbogl.exe101⤵PID:1464
-
C:\Windows\SysWOW64\Dhgfoioi.exeC:\Windows\system32\Dhgfoioi.exe102⤵PID:1676
-
C:\Windows\SysWOW64\Diicfa32.exeC:\Windows\system32\Diicfa32.exe103⤵PID:616
-
C:\Windows\SysWOW64\Ddngdj32.exeC:\Windows\system32\Ddngdj32.exe104⤵
- System Location Discovery: System Language Discovery
PID:3636 -
C:\Windows\SysWOW64\Emkeho32.exeC:\Windows\system32\Emkeho32.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5332 -
C:\Windows\SysWOW64\Effffd32.exeC:\Windows\system32\Effffd32.exe106⤵PID:2564
-
C:\Windows\SysWOW64\Ealkcm32.exeC:\Windows\system32\Ealkcm32.exe107⤵PID:5972
-
C:\Windows\SysWOW64\Ehecpgbi.exeC:\Windows\system32\Ehecpgbi.exe108⤵PID:3164
-
C:\Windows\SysWOW64\Embkhn32.exeC:\Windows\system32\Embkhn32.exe109⤵PID:5208
-
C:\Windows\SysWOW64\Ffkpadga.exeC:\Windows\system32\Ffkpadga.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:436 -
C:\Windows\SysWOW64\Fmehnn32.exeC:\Windows\system32\Fmehnn32.exe111⤵
- Drops file in System32 directory
PID:6080 -
C:\Windows\SysWOW64\Fdopkhfk.exeC:\Windows\system32\Fdopkhfk.exe112⤵
- Drops file in System32 directory
PID:4888 -
C:\Windows\SysWOW64\Fkihgb32.exeC:\Windows\system32\Fkihgb32.exe113⤵
- Modifies registry class
PID:1116 -
C:\Windows\SysWOW64\Fabqdl32.exeC:\Windows\system32\Fabqdl32.exe114⤵
- Modifies registry class
PID:2896 -
C:\Windows\SysWOW64\Fgpilc32.exeC:\Windows\system32\Fgpilc32.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4444 -
C:\Windows\SysWOW64\Fmiaimki.exeC:\Windows\system32\Fmiaimki.exe116⤵PID:5960
-
C:\Windows\SysWOW64\Fdcjfg32.exeC:\Windows\system32\Fdcjfg32.exe117⤵PID:1996
-
C:\Windows\SysWOW64\Fkmbbajb.exeC:\Windows\system32\Fkmbbajb.exe118⤵
- System Location Discovery: System Language Discovery
PID:6068 -
C:\Windows\SysWOW64\Fpjjkh32.exeC:\Windows\system32\Fpjjkh32.exe119⤵PID:708
-
C:\Windows\SysWOW64\Fgdbgbof.exeC:\Windows\system32\Fgdbgbof.exe120⤵PID:3136
-
C:\Windows\SysWOW64\Fmnkdm32.exeC:\Windows\system32\Fmnkdm32.exe121⤵PID:4516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-