Analysis
- max time kernel
51s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/11/2026, 22:34
Behavioral task
behavioral1
Sample
2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe
- Size 320KB
- Sample261108-2g6qlsvsbs
- SHA256 8734859c475fae3a1f86f837089c7cac4c955bdf401518e5a634b720bd79acdf
- MD5 a1c5191d0c9c7d296ae5e2e553c8e5ab
- SHA1 b5aa9b32a4904547a208af4f436ad350fc725d76
- SHA512 c91d31099f68f5d8d41afa561207961f6d29faac15564ebb0522db866e9fdad5348acd7f8b90eb1422dbaac42d6bc0d0901becc1c8848c9c5b92bc7e9baf4436
- SSDEEP 3072:bpQ/gx1dxjrhdxwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:bnBrhdxV/Ah1G/AcQ///NR5fn
- TLSH T1A0642F1A263409EACEED9BB5EC124DD85181E9F015F1E13E6123EFDCD8E5DA2C819F81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lefdld32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Malgmm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnahmo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Flfjdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nqkihpie.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ekjdnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eajehd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aggean32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eiobmjkd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kedoqkbe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aqoijcbo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjhjli32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Edhjji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Meqmmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ljibdifc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bcqife32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pgfljqia.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohiefdhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Piknfgmd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcdnce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cglbanmo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhkcfmbp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gehfepio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ghmbhd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oioojh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lnhadnpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fdiohnek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ddjmkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bonhqnpi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Blgiphni.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcpqafba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gkmjkg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjodch32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akqfef32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcqjhc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ojmhaklf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fpdckm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjeaph32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdpckbli.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odhman32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qjijgead.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Onhhkb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qqfmnk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Joamlacj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Adfnhlfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qjmeaafi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfkenogb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eoilfidj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gkianp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipgbngfp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pndlca32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahmjce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jfeoip32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qmccecfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gbjegg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bogkgmho.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pqbdclak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ggkiha32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipeehhhb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dklhmlac.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Meknhh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hheoci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cppfgnlj.exe - Executes dropped EXE 64 IoCs
pid Process 1144 Ghlcga32.exe 4928 Gfpcpefb.exe 2248 Gkmlilej.exe 3164 Gkoinlbg.exe 3684 Hbiakf32.exe 5956 Helfbqeb.exe 4360 Hillnoif.exe 5216 Ibeqgdpf.exe 1600 Iioicn32.exe 4448 Ibijbc32.exe 3188 Iicboncn.exe 3736 Ildkpiqo.exe 812 Jpbdfgge.exe 4848 Jbqpbbfi.exe 5344 Jfoihalp.exe 5688 Jmhaek32.exe 2416 Jcbibeki.exe 4776 Jmknkk32.exe 4832 Jbgfca32.exe 6052 Jianpl32.exe 2392 Jpkfmfok.exe 940 Jfeoip32.exe 3112 Kemhpl32.exe 1128 Kmdqai32.exe 2608 Kdnincal.exe 3656 Keoeel32.exe 1112 Kpeibdfp.exe 4792 Kbceoped.exe 4540 Kmijliej.exe 2172 Kpgfhddn.exe 1844 Kedoqkbe.exe 2100 Llngmeja.exe 3356 Lbhojo32.exe 2308 Lefkfk32.exe 5576 Lplpcc32.exe 856 Lbjlpo32.exe 1708 Liddligi.exe 2316 Lpnlicne.exe 6124 Lfhdem32.exe 1840 Lmbmbgmo.exe 5588 Ldleoa32.exe 1564 Lemagjjj.exe 2156 Llgjcd32.exe 2484 Lbabpn32.exe 2336 Mikjmhaq.exe 948 Mccofn32.exe 4144 Mmiccf32.exe 4872 Mdckpqod.exe 860 Mdehep32.exe 264 Mibpng32.exe 5128 Mckefmai.exe 5624 Midmcgif.exe 932 Meknhh32.exe 4604 Npabeq32.exe 1488 Ngkjbkem.exe 620 Nneboemj.exe 2984 Nepgcgje.exe 3204 Npfkqpjk.exe 4936 Ngpcmj32.exe 2388 Ndcdfnpa.exe 2816 Nciahk32.exe 1544 Onneeceo.exe 1404 Odhman32.exe 3400 Onqbjccl.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Aflabj32.exe Aqoijcbo.exe File opened for modification C:\Windows\SysWOW64\Knoonphp.exe Kcikagij.exe File created C:\Windows\SysWOW64\Ncdqoekn.dll Ojdnbj32.exe File opened for modification C:\Windows\SysWOW64\Lcimmn32.exe Lmodqdpo.exe File opened for modification C:\Windows\SysWOW64\Ehaieh32.exe Emkeho32.exe File opened for modification C:\Windows\SysWOW64\Onhhkb32.exe Ognpoheh.exe File created C:\Windows\SysWOW64\Aompjamo.exe Ajqgbjoh.exe File created C:\Windows\SysWOW64\Blbhngfl.dll Capbaacl.exe File created C:\Windows\SysWOW64\Hmhmko32.exe Hfodnd32.exe File created C:\Windows\SysWOW64\Gghdkg32.exe Ganlnmop.exe File created C:\Windows\SysWOW64\Cpnmok32.dll Hgebif32.exe File created C:\Windows\SysWOW64\Cecdiafb.dll Dldlbgbb.exe File created C:\Windows\SysWOW64\Gmdcpoid.exe Gbnobf32.exe File created C:\Windows\SysWOW64\Mfocljng.dll Kokkqbog.exe File opened for modification C:\Windows\SysWOW64\Mcpcnm32.exe Mqafbaap.exe File created C:\Windows\SysWOW64\Cikgecag.exe Cgijnk32.exe File created C:\Windows\SysWOW64\Gdmmlf32.exe Gmcdolbn.exe File opened for modification C:\Windows\SysWOW64\Obgccn32.exe Okpkaqmp.exe File created C:\Windows\SysWOW64\Ckeigc32.exe Cdlpjicj.exe File created C:\Windows\SysWOW64\Ljqhdhpk.exe Lgblhmag.exe File opened for modification C:\Windows\SysWOW64\Jodiaqag.exe Jenedhaa.exe File opened for modification C:\Windows\SysWOW64\Jiokpfee.exe Jnifbmfo.exe File created C:\Windows\SysWOW64\Gkianp32.exe Ghkebd32.exe File created C:\Windows\SysWOW64\Mklkepal.exe Mmkkgh32.exe File opened for modification C:\Windows\SysWOW64\Bkobfdao.exe Bhpfjh32.exe File created C:\Windows\SysWOW64\Oaclhq32.dll Mmmqbb32.exe File opened for modification C:\Windows\SysWOW64\Ogeklh32.exe Opnbjk32.exe File created C:\Windows\SysWOW64\Qjdpoacp.exe Qdjgbg32.exe File created C:\Windows\SysWOW64\Helfbqeb.exe Hbiakf32.exe File created C:\Windows\SysWOW64\Pnldlfhp.dll Ildkpiqo.exe File created C:\Windows\SysWOW64\Mhbgipmn.dll Pcncjh32.exe File created C:\Windows\SysWOW64\Nacdac32.dll Ddonnq32.exe File created C:\Windows\SysWOW64\Kibmqond.exe Knmicfnn.exe File opened for modification C:\Windows\SysWOW64\Injmlbkh.exe Igpdph32.exe File created C:\Windows\SysWOW64\Amegnd32.dll Eoccii32.exe File created C:\Windows\SysWOW64\Fkajoiok.exe Fibncmpg.exe File created C:\Windows\SysWOW64\Ibijbc32.exe Iioicn32.exe File created C:\Windows\SysWOW64\Licmbccm.exe Lnnidjcg.exe File created C:\Windows\SysWOW64\Kemqhl32.dll Oomnmfid.exe File created C:\Windows\SysWOW64\Jhggmjhg.dll Pebfen32.exe File opened for modification C:\Windows\SysWOW64\Ahonbhig.exe Qgmbkp32.exe File opened for modification C:\Windows\SysWOW64\Oioojh32.exe Nbefmopd.exe File created C:\Windows\SysWOW64\Ehcdhg32.dll Fejebdig.exe File created C:\Windows\SysWOW64\Ghnibj32.exe Gnhdea32.exe File opened for modification C:\Windows\SysWOW64\Hfioln32.exe Hoogpcco.exe File created C:\Windows\SysWOW64\Caciik32.dll Injmlbkh.exe File opened for modification C:\Windows\SysWOW64\Ponfdf32.exe Phdngljk.exe File opened for modification C:\Windows\SysWOW64\Mjgneg32.exe Mcnfhmcf.exe File created C:\Windows\SysWOW64\Ngkibk32.dll Ganlnmop.exe File created C:\Windows\SysWOW64\Didmclli.dll Nkieab32.exe File opened for modification C:\Windows\SysWOW64\Aljcip32.exe Aepklffh.exe File opened for modification C:\Windows\SysWOW64\Ckeigc32.exe Cdlpjicj.exe File created C:\Windows\SysWOW64\Gapgpnkg.dll Dnbadlnj.exe File opened for modification C:\Windows\SysWOW64\Iikmlnae.exe Ibadoc32.exe File opened for modification C:\Windows\SysWOW64\Onapnbhi.exe Ofjgmdgg.exe File opened for modification C:\Windows\SysWOW64\Bgkijp32.exe Banabi32.exe File created C:\Windows\SysWOW64\Fcoipdme.dll Badipiae.exe File opened for modification C:\Windows\SysWOW64\Ibicgmhe.exe Iojgkbib.exe File created C:\Windows\SysWOW64\Nblcgpho.exe Nlbkjf32.exe File created C:\Windows\SysWOW64\Lcmfnf32.dll Kjblcj32.exe File created C:\Windows\SysWOW64\Ikjapden.exe Hfmigmgf.exe File created C:\Windows\SysWOW64\Mbenfq32.exe Mjneec32.exe File created C:\Windows\SysWOW64\Aohgjgid.dll Pibdff32.exe File opened for modification C:\Windows\SysWOW64\Lddgghfo.exe Lmmoekem.exe - Program crash 1 IoCs
pid pid_target Process procid_target 20368 15636 Process not Found 2283 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekjdnj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bnppim32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ejklfd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aepklffh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbndoa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpiobc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nciahk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhfacp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lddgghfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdnmphag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibeqgdpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Igpdph32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ohhnln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dkfanqmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpnfak32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mdehep32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cppfgnlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pedlpgqe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phmhgmpc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpaiadel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kemhpl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Amfqikko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnnidjcg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mkjnop32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgbpkoej.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdopkhfk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlmbofdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Njfaalao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aamkgpbi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckeigc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekmhnpfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmflkl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfodnd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jlqohhja.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mqafbaap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgglnb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Padeem32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Coqnmkpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddngdj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Faeihogj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgeibicb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lechfeoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ijcjgcni.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bafnmnjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdpjeh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gfpcpefb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Akniofoa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mcnfhmcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dnhgcgbi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kpgfhddn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmhcda32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfcompnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggfombmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chepehne.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cleeafbi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnmblb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keoeel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aqkgikip.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckaffjbg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpcffalc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cgijnk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ldpmlh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pkkdci32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qmccecfp.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pcepdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bcahgh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhafak32.dll" Ilnbch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kpldpddh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cggifn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hfmigmgf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eephkk32.dll" Nhbfpl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eckhkgmf.dll" Qjijgead.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ldpmlh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ncjmob32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hillnoif.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Joamlacj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ahonbhig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Embkhn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lqndahiq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnkpindo.dll" Imbpam32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dopiqj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbffkg32.dll" Ikjapden.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gdleap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dajfhepb.dll" Ljcldo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hoobnf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Didoqi32.dll" Bhkfdcbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lagekp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lnpopcni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bhipiihc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bgimepmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bphgoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fbmoabde.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kedoqkbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehhfeg32.dll" Lplpcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qjmeaafi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acgkohdi.dll" Fhkcfmbp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Emkeho32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bafnmnjn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqbegb32.dll" Gnmblb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elphbe32.dll" Gihpejmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Moanja32.dll" Ehfjkn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdnklomi.dll" Hnlgekkc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nogngp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pkcannmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gdglfqjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hpabho32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lklbnb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eoccii32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jodiaqag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbbiak32.dll" Dcjnikhc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hjchjl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mghaofkn.dll" Plbmhadm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekoofiod.dll" Igomeb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ibqndm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pjaefc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idbmkn32.dll" Ekpmljin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adnjna32.dll" Licmbccm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qcpieamc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgkmid32.dll" Ldbjah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bopefnnf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ebdlkdlp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Opnglhnd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kjdjhgdb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgbqlaea.dll" Nldhpeop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Knoonphp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obmichdq.dll" Efeiahdo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Deokhc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Moedgenf.dll" Lnlloj32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 1144 3000 2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe 88 PID 1144 wrote to memory of 4928 1144 Ghlcga32.exe 90 PID 4928 wrote to memory of 2248 4928 Gfpcpefb.exe 91 PID 2248 wrote to memory of 3164 2248 Gkmlilej.exe 92 PID 3164 wrote to memory of 3684 3164 Gkoinlbg.exe 93 PID 3684 wrote to memory of 5956 3684 Hbiakf32.exe 94 PID 5956 wrote to memory of 4360 5956 Helfbqeb.exe 95 PID 4360 wrote to memory of 5216 4360 Hillnoif.exe 96 PID 5216 wrote to memory of 1600 5216 Ibeqgdpf.exe 97 PID 1600 wrote to memory of 4448 1600 Iioicn32.exe 98 PID 4448 wrote to memory of 3188 4448 Ibijbc32.exe 99 PID 3188 wrote to memory of 3736 3188 Iicboncn.exe 100 PID 3736 wrote to memory of 812 3736 Ildkpiqo.exe 101 PID 812 wrote to memory of 4848 812 Jpbdfgge.exe 102 PID 4848 wrote to memory of 5344 4848 Jbqpbbfi.exe 103 PID 5344 wrote to memory of 5688 5344 Jfoihalp.exe 104 PID 5688 wrote to memory of 2416 5688 Jmhaek32.exe 105 PID 2416 wrote to memory of 4776 2416 Jcbibeki.exe 106 PID 4776 wrote to memory of 4832 4776 Jmknkk32.exe 107 PID 4832 wrote to memory of 6052 4832 Jbgfca32.exe 108 PID 6052 wrote to memory of 2392 6052 Jianpl32.exe 109 PID 2392 wrote to memory of 940 2392 Jpkfmfok.exe 110 PID 940 wrote to memory of 3112 940 Jfeoip32.exe 111 PID 3112 wrote to memory of 1128 3112 Kemhpl32.exe 112 PID 1128 wrote to memory of 2608 1128 Kmdqai32.exe 113 PID 2608 wrote to memory of 3656 2608 Kdnincal.exe 114 PID 3656 wrote to memory of 1112 3656 Keoeel32.exe 115 PID 1112 wrote to memory of 4792 1112 Kpeibdfp.exe 116 PID 4792 wrote to memory of 4540 4792 Kbceoped.exe 117 PID 4540 wrote to memory of 2172 4540 Kmijliej.exe 118 PID 2172 wrote to memory of 1844 2172 Kpgfhddn.exe 119 PID 1844 wrote to memory of 2100 1844 Kedoqkbe.exe 120 PID 2100 wrote to memory of 3356 2100 Llngmeja.exe 121 PID 3356 wrote to memory of 2308 3356 Lbhojo32.exe 122 PID 2308 wrote to memory of 5576 2308 Lefkfk32.exe 123 PID 5576 wrote to memory of 856 5576 Lplpcc32.exe 124 PID 856 wrote to memory of 1708 856 Lbjlpo32.exe 125 PID 1708 wrote to memory of 2316 1708 Liddligi.exe 126 PID 2316 wrote to memory of 6124 2316 Lpnlicne.exe 127 PID 6124 wrote to memory of 1840 6124 Lfhdem32.exe 128 PID 1840 wrote to memory of 5588 1840 Lmbmbgmo.exe 129 PID 5588 wrote to memory of 1564 5588 Ldleoa32.exe 130 PID 1564 wrote to memory of 2156 1564 Lemagjjj.exe 131 PID 2156 wrote to memory of 2484 2156 Llgjcd32.exe 132 PID 2484 wrote to memory of 2336 2484 Lbabpn32.exe 133 PID 2336 wrote to memory of 948 2336 Mikjmhaq.exe 134 PID 948 wrote to memory of 4144 948 Mccofn32.exe 135 PID 4144 wrote to memory of 4872 4144 Mmiccf32.exe 136 PID 4872 wrote to memory of 860 4872 Mdckpqod.exe 137 PID 860 wrote to memory of 264 860 Mdehep32.exe 138 PID 264 wrote to memory of 5128 264 Mibpng32.exe 139 PID 5128 wrote to memory of 5624 5128 Mckefmai.exe 140 PID 5624 wrote to memory of 932 5624 Midmcgif.exe 141 PID 932 wrote to memory of 4604 932 Meknhh32.exe 142 PID 4604 wrote to memory of 1488 4604 Npabeq32.exe 143 PID 1488 wrote to memory of 620 1488 Ngkjbkem.exe 144 PID 620 wrote to memory of 2984 620 Nneboemj.exe 145 PID 2984 wrote to memory of 3204 2984 Nepgcgje.exe 146 PID 3204 wrote to memory of 4936 3204 Npfkqpjk.exe 147 PID 4936 wrote to memory of 2388 4936 Ngpcmj32.exe 148 PID 2388 wrote to memory of 2816 2388 Ndcdfnpa.exe 149 PID 2816 wrote to memory of 1544 2816 Nciahk32.exe 150 PID 1544 wrote to memory of 1404 1544 Onneeceo.exe 151 PID 1404 wrote to memory of 3400 1404 Odhman32.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\Ghlcga32.exeC:\Windows\system32\Ghlcga32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\Gfpcpefb.exeC:\Windows\system32\Gfpcpefb.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\Gkmlilej.exeC:\Windows\system32\Gkmlilej.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\Gkoinlbg.exeC:\Windows\system32\Gkoinlbg.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\Hbiakf32.exeC:\Windows\system32\Hbiakf32.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\Helfbqeb.exeC:\Windows\system32\Helfbqeb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Windows\SysWOW64\Hillnoif.exeC:\Windows\system32\Hillnoif.exe8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\Ibeqgdpf.exeC:\Windows\system32\Ibeqgdpf.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Windows\SysWOW64\Iioicn32.exeC:\Windows\system32\Iioicn32.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\Ibijbc32.exeC:\Windows\system32\Ibijbc32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\Iicboncn.exeC:\Windows\system32\Iicboncn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\Ildkpiqo.exeC:\Windows\system32\Ildkpiqo.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\Jpbdfgge.exeC:\Windows\system32\Jpbdfgge.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\SysWOW64\Jbqpbbfi.exeC:\Windows\system32\Jbqpbbfi.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\Jfoihalp.exeC:\Windows\system32\Jfoihalp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\SysWOW64\Jmhaek32.exeC:\Windows\system32\Jmhaek32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Windows\SysWOW64\Jcbibeki.exeC:\Windows\system32\Jcbibeki.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\Jmknkk32.exeC:\Windows\system32\Jmknkk32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\Jbgfca32.exeC:\Windows\system32\Jbgfca32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\Jianpl32.exeC:\Windows\system32\Jianpl32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\SysWOW64\Jpkfmfok.exeC:\Windows\system32\Jpkfmfok.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\Jfeoip32.exeC:\Windows\system32\Jfeoip32.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\Kemhpl32.exeC:\Windows\system32\Kemhpl32.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\Kmdqai32.exeC:\Windows\system32\Kmdqai32.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\Kdnincal.exeC:\Windows\system32\Kdnincal.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\Keoeel32.exeC:\Windows\system32\Keoeel32.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\Kpeibdfp.exeC:\Windows\system32\Kpeibdfp.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\Kbceoped.exeC:\Windows\system32\Kbceoped.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\Kmijliej.exeC:\Windows\system32\Kmijliej.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\Kpgfhddn.exeC:\Windows\system32\Kpgfhddn.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\Kedoqkbe.exeC:\Windows\system32\Kedoqkbe.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\Llngmeja.exeC:\Windows\system32\Llngmeja.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\Lbhojo32.exeC:\Windows\system32\Lbhojo32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\Lefkfk32.exeC:\Windows\system32\Lefkfk32.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\Lplpcc32.exeC:\Windows\system32\Lplpcc32.exe36⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Windows\SysWOW64\Lbjlpo32.exeC:\Windows\system32\Lbjlpo32.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\Liddligi.exeC:\Windows\system32\Liddligi.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\Lpnlicne.exeC:\Windows\system32\Lpnlicne.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\Lfhdem32.exeC:\Windows\system32\Lfhdem32.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\SysWOW64\Lmbmbgmo.exeC:\Windows\system32\Lmbmbgmo.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\Ldleoa32.exeC:\Windows\system32\Ldleoa32.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\Lemagjjj.exeC:\Windows\system32\Lemagjjj.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\Llgjcd32.exeC:\Windows\system32\Llgjcd32.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\Lbabpn32.exeC:\Windows\system32\Lbabpn32.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\Mikjmhaq.exeC:\Windows\system32\Mikjmhaq.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\Mccofn32.exeC:\Windows\system32\Mccofn32.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\Mmiccf32.exeC:\Windows\system32\Mmiccf32.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\Mdckpqod.exeC:\Windows\system32\Mdckpqod.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\Mdehep32.exeC:\Windows\system32\Mdehep32.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\Mibpng32.exeC:\Windows\system32\Mibpng32.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\Mckefmai.exeC:\Windows\system32\Mckefmai.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Windows\SysWOW64\Midmcgif.exeC:\Windows\system32\Midmcgif.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\Meknhh32.exeC:\Windows\system32\Meknhh32.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\Npabeq32.exeC:\Windows\system32\Npabeq32.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\Ngkjbkem.exeC:\Windows\system32\Ngkjbkem.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\Nneboemj.exeC:\Windows\system32\Nneboemj.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\Nepgcgje.exeC:\Windows\system32\Nepgcgje.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\Npfkqpjk.exeC:\Windows\system32\Npfkqpjk.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\Ngpcmj32.exeC:\Windows\system32\Ngpcmj32.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\Ndcdfnpa.exeC:\Windows\system32\Ndcdfnpa.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\Nciahk32.exeC:\Windows\system32\Nciahk32.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\Onneeceo.exeC:\Windows\system32\Onneeceo.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\Odhman32.exeC:\Windows\system32\Odhman32.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\Onqbjccl.exeC:\Windows\system32\Onqbjccl.exe65⤵
- Executes dropped EXE
PID:3400 -
C:\Windows\SysWOW64\Odkjgm32.exeC:\Windows\system32\Odkjgm32.exe66⤵PID:5252
-
C:\Windows\SysWOW64\Olfolp32.exeC:\Windows\system32\Olfolp32.exe67⤵PID:5944
-
C:\Windows\SysWOW64\Ogkcihgj.exeC:\Windows\system32\Ogkcihgj.exe68⤵PID:4076
-
C:\Windows\SysWOW64\Onekeb32.exeC:\Windows\system32\Onekeb32.exe69⤵PID:828
-
C:\Windows\SysWOW64\Ognpoheh.exeC:\Windows\system32\Ognpoheh.exe70⤵
- Drops file in System32 directory
PID:5636 -
C:\Windows\SysWOW64\Onhhkb32.exeC:\Windows\system32\Onhhkb32.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2628 -
C:\Windows\SysWOW64\Pjnipc32.exeC:\Windows\system32\Pjnipc32.exe72⤵PID:3380
-
C:\Windows\SysWOW64\Pqhammje.exeC:\Windows\system32\Pqhammje.exe73⤵PID:4084
-
C:\Windows\SysWOW64\Pjaefc32.exeC:\Windows\system32\Pjaefc32.exe74⤵
- Modifies registry class
PID:1256 -
C:\Windows\SysWOW64\Pfgfkd32.exeC:\Windows\system32\Pfgfkd32.exe75⤵PID:2212
-
C:\Windows\SysWOW64\Pckfdh32.exeC:\Windows\system32\Pckfdh32.exe76⤵PID:5988
-
C:\Windows\SysWOW64\Pjeoablq.exeC:\Windows\system32\Pjeoablq.exe77⤵PID:3496
-
C:\Windows\SysWOW64\Pcncjh32.exeC:\Windows\system32\Pcncjh32.exe78⤵
- Drops file in System32 directory
PID:2008 -
C:\Windows\SysWOW64\Pqbdclak.exeC:\Windows\system32\Pqbdclak.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2300 -
C:\Windows\SysWOW64\Qgllpf32.exeC:\Windows\system32\Qgllpf32.exe80⤵PID:2144
-
C:\Windows\SysWOW64\Qjmeaafi.exeC:\Windows\system32\Qjmeaafi.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3424 -
C:\Windows\SysWOW64\Qqfmnk32.exeC:\Windows\system32\Qqfmnk32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1240 -
C:\Windows\SysWOW64\Ajoagadf.exeC:\Windows\system32\Ajoagadf.exe83⤵PID:4364
-
C:\Windows\SysWOW64\Agcbqecp.exeC:\Windows\system32\Agcbqecp.exe84⤵PID:3748
-
C:\Windows\SysWOW64\Aqkgikip.exeC:\Windows\system32\Aqkgikip.exe85⤵
- System Location Discovery: System Language Discovery
PID:4380 -
C:\Windows\SysWOW64\Ageofe32.exeC:\Windows\system32\Ageofe32.exe86⤵PID:1896
-
C:\Windows\SysWOW64\Ambgnl32.exeC:\Windows\system32\Ambgnl32.exe87⤵PID:1816
-
C:\Windows\SysWOW64\Afjlgafe.exeC:\Windows\system32\Afjlgafe.exe88⤵PID:5052
-
C:\Windows\SysWOW64\Amfqikko.exeC:\Windows\system32\Amfqikko.exe89⤵
- System Location Discovery: System Language Discovery
PID:2564 -
C:\Windows\SysWOW64\Bcqife32.exeC:\Windows\system32\Bcqife32.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2672 -
C:\Windows\SysWOW64\Bjkacoji.exeC:\Windows\system32\Bjkacoji.exe91⤵PID:2556
-
C:\Windows\SysWOW64\Badipiae.exeC:\Windows\system32\Badipiae.exe92⤵
- Drops file in System32 directory
PID:1940 -
C:\Windows\SysWOW64\Bfabhppm.exeC:\Windows\system32\Bfabhppm.exe93⤵PID:788
-
C:\Windows\SysWOW64\Bmkjdj32.exeC:\Windows\system32\Bmkjdj32.exe94⤵PID:1300
-
C:\Windows\SysWOW64\Bfcompnj.exeC:\Windows\system32\Bfcompnj.exe95⤵
- System Location Discovery: System Language Discovery
PID:472 -
C:\Windows\SysWOW64\Baickimp.exeC:\Windows\system32\Baickimp.exe96⤵PID:5084
-
C:\Windows\SysWOW64\Bgckgcem.exeC:\Windows\system32\Bgckgcem.exe97⤵PID:2516
-
C:\Windows\SysWOW64\Bmpcpjcd.exeC:\Windows\system32\Bmpcpjcd.exe98⤵PID:3064
-
C:\Windows\SysWOW64\Bhehmbbj.exeC:\Windows\system32\Bhehmbbj.exe99⤵PID:2792
-
C:\Windows\SysWOW64\Bnppim32.exeC:\Windows\system32\Bnppim32.exe100⤵
- System Location Discovery: System Language Discovery
PID:3600 -
C:\Windows\SysWOW64\Cclhbcho.exeC:\Windows\system32\Cclhbcho.exe101⤵PID:3624
-
C:\Windows\SysWOW64\Cfkenogb.exeC:\Windows\system32\Cfkenogb.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3668 -
C:\Windows\SysWOW64\Capikhgh.exeC:\Windows\system32\Capikhgh.exe103⤵PID:1296
-
C:\Windows\SysWOW64\Cjindm32.exeC:\Windows\system32\Cjindm32.exe104⤵PID:1988
-
C:\Windows\SysWOW64\Cdabmcdi.exeC:\Windows\system32\Cdabmcdi.exe105⤵PID:1812
-
C:\Windows\SysWOW64\Cjkjjmlf.exeC:\Windows\system32\Cjkjjmlf.exe106⤵PID:4788
-
C:\Windows\SysWOW64\Cdcobb32.exeC:\Windows\system32\Cdcobb32.exe107⤵PID:1720
-
C:\Windows\SysWOW64\Cjmgomjc.exeC:\Windows\system32\Cjmgomjc.exe108⤵PID:5000
-
C:\Windows\SysWOW64\Cagolf32.exeC:\Windows\system32\Cagolf32.exe109⤵PID:2940
-
C:\Windows\SysWOW64\Cjpcel32.exeC:\Windows\system32\Cjpcel32.exe110⤵PID:4072
-
C:\Windows\SysWOW64\Dajlafon.exeC:\Windows\system32\Dajlafon.exe111⤵PID:1768
-
C:\Windows\SysWOW64\Dffdjmme.exeC:\Windows\system32\Dffdjmme.exe112⤵PID:1332
-
C:\Windows\SysWOW64\Dmpmfg32.exeC:\Windows\system32\Dmpmfg32.exe113⤵PID:6032
-
C:\Windows\SysWOW64\Dhfacp32.exeC:\Windows\system32\Dhfacp32.exe114⤵
- System Location Discovery: System Language Discovery
PID:3076 -
C:\Windows\SysWOW64\Dopiqj32.exeC:\Windows\system32\Dopiqj32.exe115⤵
- Modifies registry class
PID:5808 -
C:\Windows\SysWOW64\Dhhnipbe.exeC:\Windows\system32\Dhhnipbe.exe116⤵PID:4216
-
C:\Windows\SysWOW64\Dobffj32.exeC:\Windows\system32\Dobffj32.exe117⤵PID:5868
-
C:\Windows\SysWOW64\Ddonnq32.exeC:\Windows\system32\Ddonnq32.exe118⤵
- Drops file in System32 directory
PID:5504 -
C:\Windows\SysWOW64\Dkifkkpf.exeC:\Windows\system32\Dkifkkpf.exe119⤵PID:3200
-
C:\Windows\SysWOW64\Deokhc32.exeC:\Windows\system32\Deokhc32.exe120⤵
- Modifies registry class
PID:596 -
C:\Windows\SysWOW64\Dgpgplej.exeC:\Windows\system32\Dgpgplej.exe121⤵PID:5696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-