Analysis
- max time kernel
36s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
17/10/2026, 04:34
General
- Target 2026-10-16_e3a80c81371670991f53dfc496466388_elex_wannacry.exe
- Size 144KB
- Sample261017-e63zpahv9j
- SHA256 7e63bc1745eb257d42350f4bf2aedf369275794eeb70a39828fd423c0819479b
Score
7/10
Malware Config
Signatures
- Deletes itself 1 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 64 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-16_e3a80c81371670991f53dfc496466388_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-16_e3a80c81371670991f53dfc496466388_elex_wannacry.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&c:\prwrq.exe "C:\Users\Admin\AppData\Local\Temp\2026-10-16_e3a80c81371670991f53dfc496466388_elex_wannacry.exe"2⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
\??\c:\prwrq.exec:\prwrq.exe "C:\Users\Admin\AppData\Local\Temp\2026-10-16_e3a80c81371670991f53dfc496466388_elex_wannacry.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe7⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe8⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe9⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe10⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe11⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe12⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe14⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe15⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe16⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe17⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe18⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe19⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe20⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe21⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe22⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe23⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe24⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe25⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe26⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe27⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe28⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe29⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe30⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe31⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe32⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe33⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe34⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe35⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe36⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe37⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe38⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe39⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe40⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe41⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe42⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe43⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe44⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe45⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe46⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe47⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe48⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe49⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe50⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe51⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe52⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe53⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe54⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe55⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe56⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe57⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe58⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe59⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe60⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe61⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe62⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe63⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe64⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe65⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe66⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe67⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe68⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe69⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe70⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe71⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe72⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe73⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe74⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe75⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe76⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe77⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe78⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe79⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe80⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe81⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe82⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe83⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe84⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe85⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe86⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe87⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe88⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe89⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe90⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe91⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe92⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe93⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe94⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe95⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe96⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe97⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe98⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe99⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe100⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe101⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe102⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe103⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe104⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe105⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe106⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe107⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe108⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe109⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe110⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe111⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe112⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe113⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe114⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe115⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe116⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe117⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe118⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe119⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe120⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\wkpgu\fjkecp.dll",AbortProc c:\prwrq.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-