Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/10/2026, 01:58
Behavioral task
behavioral1
Sample
2026-10-14_1e5e79026cabce6b3d849555d0990ea9_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-14_1e5e79026cabce6b3d849555d0990ea9_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-10-14_1e5e79026cabce6b3d849555d0990ea9_elex_wannacry.exe
- Size 429KB
- Sample261015-cd2vtats3n
- SHA256 d3fab68e9f0eb5d90661aa3cd5cad22d4dfb65e55000bf89264bef69c65adce4
- MD5 1e5e79026cabce6b3d849555d0990ea9
- SHA1 032ea82ed321258332894f6744651fb456331e78
- SHA512 a6d995e55649bb46aca9eac1ae89c16a1514bcf98f0b1b2fe4fdc4958b69669c0613064d5d7b6ccfccbc20d9d8e59847f9a041244285d6170b377f43c5cb211f
- SSDEEP 6144:L3f4WD4e48XV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:L3f4I4e4J/NcZ7/N
- TLSH T1429480652A3019E9DDEE6BF1AD1249E88581E4B115F2F17E6633DFDCC8E4DA2CC04B84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Njkklk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ogndki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ppjbfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dqipeboj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hbmclobc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kldmmp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmglmpkn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eainnn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Blgiphni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Onapnbhi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmoehojj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kengqo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oanodnip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qoplop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lmnjan32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kbiede32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dpmknf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nkgmmpab.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdkgam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jnnpnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gkbkna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hkpqdifa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfmijkhj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fnofkdno.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Haceil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Daccdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kedoqkbe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhhnipbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ehcfkhel.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Doiabgqc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gdglfqjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jnhinq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mqojlbcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lijdbofo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kblpnall.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kldmmp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aggean32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Idpbhc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bbifobho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Adbiojfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lnkedd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Balpph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fefjpp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lkqliaki.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pehnaqid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ajfhhp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ennqpkcm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgijnk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Goepgg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Niipdpae.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idpbhc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Igedenca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bbiamd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Omcjne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Flngpc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Geohdago.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mqojlbcb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojjfpjjj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Opongobp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lpkiim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jeidan32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phlqlgmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ojjfpjjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pphjbgfj.exe - Executes dropped EXE 64 IoCs
pid Process 4132 Kdffiinp.exe 4100 Lmnjan32.exe 4520 Lkdgqbag.exe 596 Lijdbofo.exe 2920 Mdaedgdb.exe 704 Mkkmaalo.exe 1236 Mnjjmmkc.exe 5688 Mjcghm32.exe 2708 Mcklac32.exe 4728 Mnapnl32.exe 4968 Nkgmmpab.exe 2104 Nklfho32.exe 256 Nqklfe32.exe 5960 Odidld32.exe 2116 Ogjmnomi.exe 5648 Ojjfpjjj.exe 5452 Obdkfg32.exe 5616 Pbfglg32.exe 1380 Pjdifibo.exe 3296 Pbkagfba.exe 2168 Pgjfdm32.exe 2644 Pkhokkel.exe 5640 Qkjlpk32.exe 3236 Qgalelin.exe 3840 Aaianaoo.exe 5816 Ajdbmf32.exe 5876 Acmfel32.exe 5140 Ajfobfaj.exe 3832 Aaqgop32.exe 2056 Ahjoljqc.exe 3444 Andghd32.exe 5184 Aenpeoom.exe 1228 Blhhaigj.exe 5608 Baepjpea.exe 5432 Bhohfj32.exe 2340 Bniacddk.exe 2668 Becipn32.exe 4072 Bjpaheio.exe 4296 Bajjeo32.exe 3024 Blonbh32.exe 4080 Bbifobho.exe 3316 Bdkbgj32.exe 4736 Bjdkcd32.exe 2484 Baocpnmf.exe 6112 Cldgmgml.exe 4480 Cbnpja32.exe 2612 Chkhbh32.exe 3056 Coepob32.exe 5424 Cdaigi32.exe 4756 Ckladcoa.exe 5004 Ckpjob32.exe 4752 Dlpgiebo.exe 2380 Dampal32.exe 5488 Doqpkq32.exe 4928 Dejhgkgm.exe 2900 Dboiaoff.exe 4068 Dcaefo32.exe 4208 Dkljka32.exe 4380 Dafbhkhl.exe 1980 Ehpjdepi.exe 3012 Eceoanpo.exe 296 Eaklcj32.exe 1392 Ehddpdlc.exe 2760 Eamhhjbd.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Cpfhij32.dll Mcklac32.exe File opened for modification C:\Windows\SysWOW64\Foekbg32.exe Fdpgen32.exe File created C:\Windows\SysWOW64\Pmcqcpof.dll Niipdpae.exe File created C:\Windows\SysWOW64\Pohcgj32.dll Halmaiog.exe File created C:\Windows\SysWOW64\Pjkagnii.dll Nhpbpepo.exe File opened for modification C:\Windows\SysWOW64\Blecdn32.exe Bbpoge32.exe File opened for modification C:\Windows\SysWOW64\Gljgkb32.exe Gkhkdjli.exe File opened for modification C:\Windows\SysWOW64\Mkeeda32.exe Mekmgg32.exe File created C:\Windows\SysWOW64\Cdfpdc32.exe Cnlhhi32.exe File created C:\Windows\SysWOW64\Qgalelin.exe Qkjlpk32.exe File created C:\Windows\SysWOW64\Nppkkj32.exe Nifcnpch.exe File created C:\Windows\SysWOW64\Nnohfi32.dll Bpodhf32.exe File created C:\Windows\SysWOW64\Ggfgegho.exe Gegkilik.exe File created C:\Windows\SysWOW64\Fhichmdg.dll Balpph32.exe File opened for modification C:\Windows\SysWOW64\Nppkkj32.exe Nifcnpch.exe File opened for modification C:\Windows\SysWOW64\Hlefgphj.exe Hkdjph32.exe File created C:\Windows\SysWOW64\Ohkkanbe.exe Omegdebp.exe File created C:\Windows\SysWOW64\Pdfjcl32.exe Pnlafaio.exe File created C:\Windows\SysWOW64\Gdfipaep.dll Jbgoik32.exe File created C:\Windows\SysWOW64\Mfejme32.exe Mplapkoj.exe File created C:\Windows\SysWOW64\Bqhlpbjd.exe Bfchcijo.exe File created C:\Windows\SysWOW64\Ajkgmd32.exe Acaopjgd.exe File created C:\Windows\SysWOW64\Mggcbo32.dll Hpjlgp32.exe File created C:\Windows\SysWOW64\Odljbmgj.dll Kdfjej32.exe File opened for modification C:\Windows\SysWOW64\Njfaalao.exe Nclida32.exe File created C:\Windows\SysWOW64\Iiofhm32.dll Hbknqeha.exe File opened for modification C:\Windows\SysWOW64\Nngoddkg.exe Ngmggj32.exe File opened for modification C:\Windows\SysWOW64\Opnbjk32.exe Onmfcb32.exe File created C:\Windows\SysWOW64\Gnggbp32.dll Qoplop32.exe File created C:\Windows\SysWOW64\Dbmfje32.exe Dkcnnk32.exe File opened for modification C:\Windows\SysWOW64\Egcaij32.exe Eqiilp32.exe File opened for modification C:\Windows\SysWOW64\Cdaigi32.exe Coepob32.exe File created C:\Windows\SysWOW64\Inbpbnlg.exe Ighhed32.exe File opened for modification C:\Windows\SysWOW64\Cfaddg32.exe Cpglgmfa.exe File created C:\Windows\SysWOW64\Bbhkgb32.dll Dckdddcd.exe File created C:\Windows\SysWOW64\Ciaaqgdb.dll Padeem32.exe File opened for modification C:\Windows\SysWOW64\Ajckbp32.exe Aqkgikip.exe File created C:\Windows\SysWOW64\Egdqkk32.exe Eahhcd32.exe File opened for modification C:\Windows\SysWOW64\Lnkedd32.exe Lgamhjja.exe File opened for modification C:\Windows\SysWOW64\Pamikh32.exe Plpqba32.exe File created C:\Windows\SysWOW64\Pepafcii.dll Bhfmic32.exe File opened for modification C:\Windows\SysWOW64\Oeehdcij.exe Onkphi32.exe File created C:\Windows\SysWOW64\Fmdcnq32.dll Chiipg32.exe File created C:\Windows\SysWOW64\Lgmbmn32.exe Lqcjqcnp.exe File created C:\Windows\SysWOW64\Icfjgekh.dll Gbgbgalj.exe File opened for modification C:\Windows\SysWOW64\Galcjkmj.exe Gkbkna32.exe File opened for modification C:\Windows\SysWOW64\Kgopbj32.exe Kepdfo32.exe File created C:\Windows\SysWOW64\Plpqba32.exe Pakleh32.exe File created C:\Windows\SysWOW64\Njkklk32.exe Nenbdd32.exe File created C:\Windows\SysWOW64\Elefkp32.dll Onkphi32.exe File opened for modification C:\Windows\SysWOW64\Ehddpdlc.exe Eaklcj32.exe File created C:\Windows\SysWOW64\Cdbcbhpn.dll Mpiejkql.exe File created C:\Windows\SysWOW64\Okghgd32.dll Neppiagi.exe File created C:\Windows\SysWOW64\Edjgpi32.exe Eidbbp32.exe File created C:\Windows\SysWOW64\Fjmkhkff.exe Fpggkbfq.exe File created C:\Windows\SysWOW64\Jdaajkfd.exe Jnhinq32.exe File created C:\Windows\SysWOW64\Bddjijia.exe Bnkbmp32.exe File created C:\Windows\SysWOW64\Dqmjqb32.exe Dolmijef.exe File created C:\Windows\SysWOW64\Bniacddk.exe Bhohfj32.exe File opened for modification C:\Windows\SysWOW64\Femndhgh.exe Ehimkd32.exe File created C:\Windows\SysWOW64\Ildkpiqo.exe Iejcco32.exe File opened for modification C:\Windows\SysWOW64\Cdabmcdi.exe Cmgjpi32.exe File created C:\Windows\SysWOW64\Gaogja32.exe Gkeonggf.exe File created C:\Windows\SysWOW64\Bmaejnbe.dll Mfaqafjl.exe - Program crash 1 IoCs
pid pid_target Process procid_target 9772 10784 WerFault.exe 1081 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Haceil32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fimonh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hlqmla32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jcmkehcg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aefjbo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bdmmnd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edqdij32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Koodka32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flngpc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mglfibmh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjokpm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Anaofa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgbpkoej.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iejcco32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmfmfigl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eeagnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kepdfo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npepdl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Coijja32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhbdbpnm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Olgdgibf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qemoff32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aoofej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbgdef32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jpkfmfok.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfgcjpdk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aajggjap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Baocpnmf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hgebif32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pamikh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljaooodf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Enhpje32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jiageecb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ammgifpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjneec32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eodjdocj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chkokq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Einmaaqb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnmmleja.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfdfanoa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mpiejkql.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hhoomd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpkcafjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Njkklk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dogdnj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ognpoheh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bnkgomnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggnlhgkg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibkpmm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lemjlcgo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iafogggl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mbbaaapj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qlggcp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dampal32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ilafcomm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iebnqofj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbifobho.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jefbomoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hbflnl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgccccec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pnifoaba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggcjphja.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qkjlpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aappdj32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eeagnc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fkflbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eiokbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Daccdf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fgenoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Analdh32.dll" Agjhadmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejohcl32.dll" Mhncnodp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgagcn32.dll" Ckdcli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nochannh.dll" Boipfp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afaccndj.dll" Cgijnk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gdmmlf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mhafoh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bcokah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lkjehbaa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Beomhm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ibncmchl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fddqpn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ggnlhgkg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Olgdgibf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aqmldddb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hkeajn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iqklhd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lklbnb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmeono32.dll" Mnjjmmkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Balpph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gdkgam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Boplmekj.dll" Gnqflhcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdhpccdg.dll" Jebfgl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Egcaij32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Haceil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kdffiinp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Andghd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Klbgag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bllabpck.dll" Noehlgol.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pplcnf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjmgafni.dll" Hglaookl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ebcmjqej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mglfibmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeipko32.dll" Mlciobhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mfejme32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nbljaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ijcaaibe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mbbaaapj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bnkbmp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jcoapami.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mogccnfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kpgfhddn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hhoomd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lqkgli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpmgom32.dll" Gnjjpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Modmkn32.dll" Legjgn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mkkmaalo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Blhhaigj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dkljka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ikmepj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fchpnh32.dll" Ehcfkhel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndblob32.dll" Pmgcidqm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjicmp32.dll" Oanodnip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Phombg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Meiabh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pahdfp32.dll" Nlhbja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jledol32.dll" Gkdhcqcj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hpjlgp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hlefgphj.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1120 wrote to memory of 4132 1120 2026-10-14_1e5e79026cabce6b3d849555d0990ea9_elex_wannacry.exe 89 PID 4132 wrote to memory of 4100 4132 Kdffiinp.exe 90 PID 4100 wrote to memory of 4520 4100 Lmnjan32.exe 91 PID 4520 wrote to memory of 596 4520 Lkdgqbag.exe 92 PID 596 wrote to memory of 2920 596 Lijdbofo.exe 93 PID 2920 wrote to memory of 704 2920 Mdaedgdb.exe 94 PID 704 wrote to memory of 1236 704 Mkkmaalo.exe 95 PID 1236 wrote to memory of 5688 1236 Mnjjmmkc.exe 96 PID 5688 wrote to memory of 2708 5688 Mjcghm32.exe 97 PID 2708 wrote to memory of 4728 2708 Mcklac32.exe 98 PID 4728 wrote to memory of 4968 4728 Mnapnl32.exe 99 PID 4968 wrote to memory of 2104 4968 Nkgmmpab.exe 100 PID 2104 wrote to memory of 256 2104 Nklfho32.exe 101 PID 256 wrote to memory of 5960 256 Nqklfe32.exe 102 PID 5960 wrote to memory of 2116 5960 Odidld32.exe 103 PID 2116 wrote to memory of 5648 2116 Ogjmnomi.exe 104 PID 5648 wrote to memory of 5452 5648 Ojjfpjjj.exe 105 PID 5452 wrote to memory of 5616 5452 Obdkfg32.exe 106 PID 5616 wrote to memory of 1380 5616 Pbfglg32.exe 107 PID 1380 wrote to memory of 3296 1380 Pjdifibo.exe 108 PID 3296 wrote to memory of 2168 3296 Pbkagfba.exe 109 PID 2168 wrote to memory of 2644 2168 Pgjfdm32.exe 110 PID 2644 wrote to memory of 5640 2644 Pkhokkel.exe 111 PID 5640 wrote to memory of 3236 5640 Qkjlpk32.exe 112 PID 3236 wrote to memory of 3840 3236 Qgalelin.exe 113 PID 3840 wrote to memory of 5816 3840 Aaianaoo.exe 114 PID 5816 wrote to memory of 5876 5816 Ajdbmf32.exe 115 PID 5876 wrote to memory of 5140 5876 Acmfel32.exe 116 PID 5140 wrote to memory of 3832 5140 Ajfobfaj.exe 117 PID 3832 wrote to memory of 2056 3832 Aaqgop32.exe 118 PID 2056 wrote to memory of 3444 2056 Ahjoljqc.exe 119 PID 3444 wrote to memory of 5184 3444 Andghd32.exe 120 PID 5184 wrote to memory of 1228 5184 Aenpeoom.exe 121 PID 1228 wrote to memory of 5608 1228 Blhhaigj.exe 122 PID 5608 wrote to memory of 5432 5608 Baepjpea.exe 123 PID 5432 wrote to memory of 2340 5432 Bhohfj32.exe 124 PID 2340 wrote to memory of 2668 2340 Bniacddk.exe 125 PID 2668 wrote to memory of 4072 2668 Becipn32.exe 126 PID 4072 wrote to memory of 4296 4072 Bjpaheio.exe 127 PID 4296 wrote to memory of 3024 4296 Bajjeo32.exe 128 PID 3024 wrote to memory of 4080 3024 Blonbh32.exe 129 PID 4080 wrote to memory of 3316 4080 Bbifobho.exe 130 PID 3316 wrote to memory of 4736 3316 Bdkbgj32.exe 131 PID 4736 wrote to memory of 2484 4736 Bjdkcd32.exe 132 PID 2484 wrote to memory of 6112 2484 Baocpnmf.exe 133 PID 6112 wrote to memory of 4480 6112 Cldgmgml.exe 134 PID 4480 wrote to memory of 2612 4480 Cbnpja32.exe 135 PID 2612 wrote to memory of 3056 2612 Chkhbh32.exe 136 PID 3056 wrote to memory of 5424 3056 Coepob32.exe 137 PID 5424 wrote to memory of 4756 5424 Cdaigi32.exe 138 PID 5312 wrote to memory of 5004 5312 Coijja32.exe 140 PID 5004 wrote to memory of 4752 5004 Ckpjob32.exe 141 PID 4752 wrote to memory of 2380 4752 Dlpgiebo.exe 142 PID 2380 wrote to memory of 5488 2380 Dampal32.exe 143 PID 5488 wrote to memory of 4928 5488 Doqpkq32.exe 144 PID 4928 wrote to memory of 2900 4928 Dejhgkgm.exe 145 PID 2900 wrote to memory of 4068 2900 Dboiaoff.exe 146 PID 4068 wrote to memory of 4208 4068 Dcaefo32.exe 147 PID 4208 wrote to memory of 4380 4208 Dkljka32.exe 148 PID 4380 wrote to memory of 1980 4380 Dafbhkhl.exe 149 PID 1980 wrote to memory of 3012 1980 Ehpjdepi.exe 150 PID 3012 wrote to memory of 296 3012 Eceoanpo.exe 151 PID 296 wrote to memory of 1392 296 Eaklcj32.exe 152 PID 1392 wrote to memory of 2760 1392 Ehddpdlc.exe 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-14_1e5e79026cabce6b3d849555d0990ea9_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-14_1e5e79026cabce6b3d849555d0990ea9_elex_wannacry.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\Kdffiinp.exeC:\Windows\system32\Kdffiinp.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\Lmnjan32.exeC:\Windows\system32\Lmnjan32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\Lkdgqbag.exeC:\Windows\system32\Lkdgqbag.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\Lijdbofo.exeC:\Windows\system32\Lijdbofo.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\SysWOW64\Mdaedgdb.exeC:\Windows\system32\Mdaedgdb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\Mkkmaalo.exeC:\Windows\system32\Mkkmaalo.exe7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\Mnjjmmkc.exeC:\Windows\system32\Mnjjmmkc.exe8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\Mjcghm32.exeC:\Windows\system32\Mjcghm32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Windows\SysWOW64\Mcklac32.exeC:\Windows\system32\Mcklac32.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\Mnapnl32.exeC:\Windows\system32\Mnapnl32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\Nkgmmpab.exeC:\Windows\system32\Nkgmmpab.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\Nklfho32.exeC:\Windows\system32\Nklfho32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\Nqklfe32.exeC:\Windows\system32\Nqklfe32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\SysWOW64\Odidld32.exeC:\Windows\system32\Odidld32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\SysWOW64\Ogjmnomi.exeC:\Windows\system32\Ogjmnomi.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\Ojjfpjjj.exeC:\Windows\system32\Ojjfpjjj.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Windows\SysWOW64\Obdkfg32.exeC:\Windows\system32\Obdkfg32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Windows\SysWOW64\Pbfglg32.exeC:\Windows\system32\Pbfglg32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\SysWOW64\Pjdifibo.exeC:\Windows\system32\Pjdifibo.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\Pbkagfba.exeC:\Windows\system32\Pbkagfba.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\Pgjfdm32.exeC:\Windows\system32\Pgjfdm32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\Pkhokkel.exeC:\Windows\system32\Pkhokkel.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\Qkjlpk32.exeC:\Windows\system32\Qkjlpk32.exe24⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\Qgalelin.exeC:\Windows\system32\Qgalelin.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\Aaianaoo.exeC:\Windows\system32\Aaianaoo.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\Ajdbmf32.exeC:\Windows\system32\Ajdbmf32.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\Acmfel32.exeC:\Windows\system32\Acmfel32.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\Ajfobfaj.exeC:\Windows\system32\Ajfobfaj.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Windows\SysWOW64\Aaqgop32.exeC:\Windows\system32\Aaqgop32.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\SysWOW64\Ahjoljqc.exeC:\Windows\system32\Ahjoljqc.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\Andghd32.exeC:\Windows\system32\Andghd32.exe32⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\Aenpeoom.exeC:\Windows\system32\Aenpeoom.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Windows\SysWOW64\Blhhaigj.exeC:\Windows\system32\Blhhaigj.exe34⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\Baepjpea.exeC:\Windows\system32\Baepjpea.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Windows\SysWOW64\Bhohfj32.exeC:\Windows\system32\Bhohfj32.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Windows\SysWOW64\Bniacddk.exeC:\Windows\system32\Bniacddk.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\Becipn32.exeC:\Windows\system32\Becipn32.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\Bjpaheio.exeC:\Windows\system32\Bjpaheio.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\Bajjeo32.exeC:\Windows\system32\Bajjeo32.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\Blonbh32.exeC:\Windows\system32\Blonbh32.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\Bbifobho.exeC:\Windows\system32\Bbifobho.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\Bdkbgj32.exeC:\Windows\system32\Bdkbgj32.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\Bjdkcd32.exeC:\Windows\system32\Bjdkcd32.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\Baocpnmf.exeC:\Windows\system32\Baocpnmf.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\Cldgmgml.exeC:\Windows\system32\Cldgmgml.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Windows\SysWOW64\Cbnpja32.exeC:\Windows\system32\Cbnpja32.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\Chkhbh32.exeC:\Windows\system32\Chkhbh32.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\Coepob32.exeC:\Windows\system32\Coepob32.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\Cdaigi32.exeC:\Windows\system32\Cdaigi32.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Windows\SysWOW64\Ckladcoa.exeC:\Windows\system32\Ckladcoa.exe51⤵
- Executes dropped EXE
PID:4756 -
C:\Windows\SysWOW64\Coijja32.exeC:\Windows\system32\Coijja32.exe52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\Ckpjob32.exeC:\Windows\system32\Ckpjob32.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\Dlpgiebo.exeC:\Windows\system32\Dlpgiebo.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\Dampal32.exeC:\Windows\system32\Dampal32.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\Doqpkq32.exeC:\Windows\system32\Doqpkq32.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Windows\SysWOW64\Dejhgkgm.exeC:\Windows\system32\Dejhgkgm.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\Dboiaoff.exeC:\Windows\system32\Dboiaoff.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\Dcaefo32.exeC:\Windows\system32\Dcaefo32.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\Dkljka32.exeC:\Windows\system32\Dkljka32.exe60⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\Dafbhkhl.exeC:\Windows\system32\Dafbhkhl.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\Ehpjdepi.exeC:\Windows\system32\Ehpjdepi.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\Eceoanpo.exeC:\Windows\system32\Eceoanpo.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\Eaklcj32.exeC:\Windows\system32\Eaklcj32.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\Ehddpdlc.exeC:\Windows\system32\Ehddpdlc.exe65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\Eamhhjbd.exeC:\Windows\system32\Eamhhjbd.exe66⤵
- Executes dropped EXE
PID:2760 -
C:\Windows\SysWOW64\Ecmebm32.exeC:\Windows\system32\Ecmebm32.exe67⤵PID:980
-
C:\Windows\SysWOW64\Ehimkd32.exeC:\Windows\system32\Ehimkd32.exe68⤵
- Drops file in System32 directory
PID:4852 -
C:\Windows\SysWOW64\Femndhgh.exeC:\Windows\system32\Femndhgh.exe69⤵PID:4128
-
C:\Windows\SysWOW64\Fcanmlea.exeC:\Windows\system32\Fcanmlea.exe70⤵PID:796
-
C:\Windows\SysWOW64\Fdbked32.exeC:\Windows\system32\Fdbked32.exe71⤵PID:3476
-
C:\Windows\SysWOW64\Ffbgog32.exeC:\Windows\system32\Ffbgog32.exe72⤵PID:1284
-
C:\Windows\SysWOW64\Fcfhhk32.exeC:\Windows\system32\Fcfhhk32.exe73⤵PID:2028
-
C:\Windows\SysWOW64\Fkalmn32.exeC:\Windows\system32\Fkalmn32.exe74⤵PID:3676
-
C:\Windows\SysWOW64\Fbkdjh32.exeC:\Windows\system32\Fbkdjh32.exe75⤵PID:1824
-
C:\Windows\SysWOW64\Fhemfbnq.exeC:\Windows\system32\Fhemfbnq.exe76⤵PID:2404
-
C:\Windows\SysWOW64\Gbmaog32.exeC:\Windows\system32\Gbmaog32.exe77⤵PID:2100
-
C:\Windows\SysWOW64\Gkffhmka.exeC:\Windows\system32\Gkffhmka.exe78⤵PID:1376
-
C:\Windows\SysWOW64\Goconkah.exeC:\Windows\system32\Goconkah.exe79⤵PID:5828
-
C:\Windows\SysWOW64\Gcagdj32.exeC:\Windows\system32\Gcagdj32.exe80⤵PID:1976
-
C:\Windows\SysWOW64\Gdcdlb32.exeC:\Windows\system32\Gdcdlb32.exe81⤵PID:1280
-
C:\Windows\SysWOW64\Gkmlilej.exeC:\Windows\system32\Gkmlilej.exe82⤵PID:1756
-
C:\Windows\SysWOW64\Gbgdef32.exeC:\Windows\system32\Gbgdef32.exe83⤵
- System Location Discovery: System Language Discovery
PID:2452 -
C:\Windows\SysWOW64\Hmoehojj.exeC:\Windows\system32\Hmoehojj.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4696 -
C:\Windows\SysWOW64\Hbknqeha.exeC:\Windows\system32\Hbknqeha.exe85⤵
- Drops file in System32 directory
PID:4772 -
C:\Windows\SysWOW64\Hiefmp32.exeC:\Windows\system32\Hiefmp32.exe86⤵PID:1704
-
C:\Windows\SysWOW64\Hoonjjgk.exeC:\Windows\system32\Hoonjjgk.exe87⤵PID:2352
-
C:\Windows\SysWOW64\Hkhkdjkl.exeC:\Windows\system32\Hkhkdjkl.exe88⤵PID:4472
-
C:\Windows\SysWOW64\Hbbdad32.exeC:\Windows\system32\Hbbdad32.exe89⤵PID:4232
-
C:\Windows\SysWOW64\Hmhhnmao.exeC:\Windows\system32\Hmhhnmao.exe90⤵PID:6016
-
C:\Windows\SysWOW64\Ifplgc32.exeC:\Windows\system32\Ifplgc32.exe91⤵PID:4464
-
C:\Windows\SysWOW64\Ikmepj32.exeC:\Windows\system32\Ikmepj32.exe92⤵
- Modifies registry class
PID:2580 -
C:\Windows\SysWOW64\Ieeihomg.exeC:\Windows\system32\Ieeihomg.exe93⤵PID:5544
-
C:\Windows\SysWOW64\Ilpaei32.exeC:\Windows\system32\Ilpaei32.exe94⤵PID:1560
-
C:\Windows\SysWOW64\Ibijbc32.exeC:\Windows\system32\Ibijbc32.exe95⤵PID:5220
-
C:\Windows\SysWOW64\Iicboncn.exeC:\Windows\system32\Iicboncn.exe96⤵PID:2184
-
C:\Windows\SysWOW64\Ipmjkh32.exeC:\Windows\system32\Ipmjkh32.exe97⤵PID:4376
-
C:\Windows\SysWOW64\Iejcco32.exeC:\Windows\system32\Iejcco32.exe98⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3540 -
C:\Windows\SysWOW64\Ildkpiqo.exeC:\Windows\system32\Ildkpiqo.exe99⤵PID:4644
-
C:\Windows\SysWOW64\Ibncmchl.exeC:\Windows\system32\Ibncmchl.exe100⤵
- Modifies registry class
PID:1540 -
C:\Windows\SysWOW64\Iihkjm32.exeC:\Windows\system32\Iihkjm32.exe101⤵PID:2300
-
C:\Windows\SysWOW64\Jpbdfgge.exeC:\Windows\system32\Jpbdfgge.exe102⤵PID:2608
-
C:\Windows\SysWOW64\Jeolonem.exeC:\Windows\system32\Jeolonem.exe103⤵PID:4428
-
C:\Windows\SysWOW64\Jlidkh32.exeC:\Windows\system32\Jlidkh32.exe104⤵PID:6084
-
C:\Windows\SysWOW64\Jeaidn32.exeC:\Windows\system32\Jeaidn32.exe105⤵PID:6020
-
C:\Windows\SysWOW64\Jpgmaf32.exeC:\Windows\system32\Jpgmaf32.exe106⤵PID:3096
-
C:\Windows\SysWOW64\Jecejm32.exeC:\Windows\system32\Jecejm32.exe107⤵PID:5408
-
C:\Windows\SysWOW64\Jpijgf32.exeC:\Windows\system32\Jpijgf32.exe108⤵PID:1764
-
C:\Windows\SysWOW64\Jefbomoe.exeC:\Windows\system32\Jefbomoe.exe109⤵
- System Location Discovery: System Language Discovery
PID:2280 -
C:\Windows\SysWOW64\Jpkfmfok.exeC:\Windows\system32\Jpkfmfok.exe110⤵
- System Location Discovery: System Language Discovery
PID:752 -
C:\Windows\SysWOW64\Jfeoip32.exeC:\Windows\system32\Jfeoip32.exe111⤵PID:1768
-
C:\Windows\SysWOW64\Klbgag32.exeC:\Windows\system32\Klbgag32.exe112⤵
- Modifies registry class
PID:4612 -
C:\Windows\SysWOW64\Kblpnall.exeC:\Windows\system32\Kblpnall.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1124 -
C:\Windows\SysWOW64\Kifhkkci.exeC:\Windows\system32\Kifhkkci.exe114⤵PID:3008
-
C:\Windows\SysWOW64\Klddgfbl.exeC:\Windows\system32\Klddgfbl.exe115⤵PID:4240
-
C:\Windows\SysWOW64\Kfjhdobb.exeC:\Windows\system32\Kfjhdobb.exe116⤵PID:1184
-
C:\Windows\SysWOW64\Klgqmfpj.exeC:\Windows\system32\Klgqmfpj.exe117⤵PID:5472
-
C:\Windows\SysWOW64\Kfmejopp.exeC:\Windows\system32\Kfmejopp.exe118⤵PID:3804
-
C:\Windows\SysWOW64\Kmfmfigl.exeC:\Windows\system32\Kmfmfigl.exe119⤵
- System Location Discovery: System Language Discovery
PID:3896 -
C:\Windows\SysWOW64\Kbceoped.exeC:\Windows\system32\Kbceoped.exe120⤵PID:4264
-
C:\Windows\SysWOW64\Kpgfhddn.exeC:\Windows\system32\Kpgfhddn.exe121⤵
- Modifies registry class
PID:2908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-