Analysis
- max time kernel
148s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 16:23
Behavioral task
behavioral1
Sample
2026-07-17_f10672fd45cf45359edf3c21db590711_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_f10672fd45cf45359edf3c21db590711_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-17_f10672fd45cf45359edf3c21db590711_elex_wannacry.exe
- Size 320KB
- Sample260717-tvxe4aa17x
- SHA256 daeb1bc3750ccd80bc7dd9ea2994cc85fe5dd7fec9914298694c8967cd1b33bc
- MD5 f10672fd45cf45359edf3c21db590711
- SHA1 1e886e0fa7bf55da2d88e7f909fe365b61888c65
- SHA512 bfb1efa8d249df1cc909b5646aa2ef13bf1db9a2122658027447842f47e423e7bd6f7ca51fd7045be569aa42a1c72ea4fc8b55495aea54567a2e16b747d4ffdd
- SSDEEP 3072:EjG1z00BR/ur/NwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Ejmz0Stc/NV/Ah1G/AcQ///NR5fn
- TLSH T164640B192A340AEACEED1BB5AC0249D8A145F9F015F1E13E6133DFDCD8E4DA2C946F91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hoogpcco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nohdaf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bbbkmebo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hiomppkc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lngkjhmi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gkmjkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hagodlge.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Flinddpj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hdmohnhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hfmigmgf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgjekc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oceepj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhagaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pkngco32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jplkig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gaadpqmp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hfdfanoa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kfehoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Amaqde32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hgboiq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmhial32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Koodka32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dakieedj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nemcca32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cabofaaj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdpkoalc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkhcpkkb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iiigqdfd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Omnqcfig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhnbkfek.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmbhhkoa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gfaikoad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jnkchmdl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bimkde32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emkeho32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkechjib.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nimbdi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkimae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mepfbflb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hdlphjaf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iohjebkd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Niklip32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dkbomgde.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pkpmnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dbkpokhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iedjfodg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oapljmgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pcmloa32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmicee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bekdmnio.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dqpffaib.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmfalimb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Podcnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pnkbdqpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Egcaij32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhppcn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmdfpbkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jncobabm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aamkgpbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bmeagjbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Conagl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ebapednb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iimcgg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ggnlhgkg.exe - Executes dropped EXE 64 IoCs
pid Process 2696 Eeeaibid.exe 1584 Eoneah32.exe 4876 Fkiobhac.exe 5348 Fnjhccnd.exe 5080 Fgbmliee.exe 5968 Fecmjq32.exe 4668 Fgeibicb.exe 252 Fajnoabh.exe 3828 Fhdfll32.exe 5424 Gnaodbhl.exe 4972 Gdkgam32.exe 3512 Gkeonggf.exe 3548 Gekckpgl.exe 2840 Gkglcfec.exe 1300 Gaadpqmp.exe 1704 Ggnlhgkg.exe 248 Gadqepkn.exe 5856 Ghnibj32.exe 2872 Gfaikoad.exe 4372 Hkobdeok.exe 912 Hfdfanoa.exe 1924 Hnokeqll.exe 948 Hheoci32.exe 1904 Hoogpcco.exe 3960 Hdlphjaf.exe 2340 Hkehdd32.exe 5996 Hfklamii.exe 1224 Hgliie32.exe 3784 Hfmigmgf.exe 5652 Ikjapden.exe 120 Ifpemmdd.exe 4208 Iohjebkd.exe 3088 Idebniil.exe 2168 Iojgkbib.exe 1488 Idgocigi.exe 5696 Iomcqa32.exe 4768 Ifglmlol.exe 1792 Ikcdfbmc.exe 1348 Ifihckmi.exe 4644 Jgjekc32.exe 2532 Jndmgn32.exe 2848 Jijaef32.exe 4796 Jodiaqag.exe 2812 Jeqbjgoo.exe 1136 Jkkjfa32.exe 3336 Jbdbcl32.exe 4684 Jiokpfee.exe 3316 Jnkchmdl.exe 1492 Jeekeg32.exe 4076 Jpkpbpko.exe 5000 Kfehoj32.exe 4672 Klapgq32.exe 5328 Kblidkhp.exe 2192 Khhalafg.exe 5588 Knbiil32.exe 5740 Kihnfdmj.exe 3580 Knefnkla.exe 3264 Keonke32.exe 2752 Klifhpjk.exe 1316 Kfnkeh32.exe 4356 Kpfonnab.exe 5564 Lhbdbpnm.exe 5972 Llpmhodc.exe 3248 Lfeaegdi.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Nelmik32.exe Nldhpeop.exe File opened for modification C:\Windows\SysWOW64\Oaqbdc32.exe Ojgjhicl.exe File created C:\Windows\SysWOW64\Cfjehfda.dll Eohcon32.exe File opened for modification C:\Windows\SysWOW64\Gejoib32.exe Gnqflhcg.exe File created C:\Windows\SysWOW64\Gipdba32.dll Giecojpb.exe File created C:\Windows\SysWOW64\Ppbhiamb.dll Bbgehd32.exe File created C:\Windows\SysWOW64\Hkehdd32.exe Hdlphjaf.exe File opened for modification C:\Windows\SysWOW64\Mjpbkc32.exe Mbenfq32.exe File created C:\Windows\SysWOW64\Nomjgqpp.dll Idgocigi.exe File opened for modification C:\Windows\SysWOW64\Allpnplb.exe Aohpek32.exe File opened for modification C:\Windows\SysWOW64\Ckphamkp.exe Cdfpdc32.exe File created C:\Windows\SysWOW64\Bmmppc32.exe Bcdlgnkk.exe File opened for modification C:\Windows\SysWOW64\Cfogohpa.exe Cabofaaj.exe File created C:\Windows\SysWOW64\Nelfnd32.exe Njfaalao.exe File created C:\Windows\SysWOW64\Omnqcfig.exe Odfljp32.exe File created C:\Windows\SysWOW64\Pajekb32.exe Pkpmnh32.exe File opened for modification C:\Windows\SysWOW64\Gnnjgh32.exe Giaaoa32.exe File created C:\Windows\SysWOW64\Dobkgc32.dll Fkkemble.exe File opened for modification C:\Windows\SysWOW64\Efepln32.exe Eplgod32.exe File created C:\Windows\SysWOW64\Fmdcnq32.dll Cdnmphag.exe File created C:\Windows\SysWOW64\Gnaodbhl.exe Fhdfll32.exe File opened for modification C:\Windows\SysWOW64\Acfoep32.exe Ajnkmjqj.exe File created C:\Windows\SysWOW64\Eopbgf32.dll Dfjgjf32.exe File opened for modification C:\Windows\SysWOW64\Edqdij32.exe Dikpla32.exe File created C:\Windows\SysWOW64\Npepdl32.exe Nnccmddi.exe File opened for modification C:\Windows\SysWOW64\Pagbklae.exe Pnifoaba.exe File opened for modification C:\Windows\SysWOW64\Iomcqa32.exe Idgocigi.exe File opened for modification C:\Windows\SysWOW64\Cofemg32.exe Cmhial32.exe File opened for modification C:\Windows\SysWOW64\Emfebjgb.exe Dflmep32.exe File created C:\Windows\SysWOW64\Mglfibmh.exe Mmfalimb.exe File opened for modification C:\Windows\SysWOW64\Pajekb32.exe Pkpmnh32.exe File opened for modification C:\Windows\SysWOW64\Qmepkb32.exe Qhigbl32.exe File created C:\Windows\SysWOW64\Adhdcepc.exe Amnlfk32.exe File created C:\Windows\SysWOW64\Fnjhccnd.exe Fkiobhac.exe File created C:\Windows\SysWOW64\Nabfcegi.exe Nlfnkoia.exe File created C:\Windows\SysWOW64\Nnimipoo.dll Knnhdied.exe File created C:\Windows\SysWOW64\Jpnkbhef.dll Diafkl32.exe File opened for modification C:\Windows\SysWOW64\Mnhkklbb.exe Mepfbflb.exe File opened for modification C:\Windows\SysWOW64\Ahbjij32.exe Aahblp32.exe File created C:\Windows\SysWOW64\Jiiiml32.exe Jgkmap32.exe File opened for modification C:\Windows\SysWOW64\Dkikglce.exe Caagofme.exe File created C:\Windows\SysWOW64\Gdkgam32.exe Gnaodbhl.exe File created C:\Windows\SysWOW64\Djcfee32.exe Dpnbhl32.exe File created C:\Windows\SysWOW64\Fhjlkg32.exe Fiilmofe.exe File opened for modification C:\Windows\SysWOW64\Ggfombmd.exe Fmnkdm32.exe File created C:\Windows\SysWOW64\Ofkgnd32.dll Emfebjgb.exe File opened for modification C:\Windows\SysWOW64\Giecojpb.exe Gnppbapl.exe File created C:\Windows\SysWOW64\Paakccpj.dll Iioplg32.exe File created C:\Windows\SysWOW64\Boabkj32.exe Ahgjnpna.exe File opened for modification C:\Windows\SysWOW64\Gifadggi.exe Gbmigm32.exe File opened for modification C:\Windows\SysWOW64\Ldpmlh32.exe Knfeoobh.exe File created C:\Windows\SysWOW64\Mpofnj32.dll Djelqo32.exe File created C:\Windows\SysWOW64\Idoknmfj.exe Iiigqdfd.exe File opened for modification C:\Windows\SysWOW64\Jjeflc32.exe Ipmbcm32.exe File created C:\Windows\SysWOW64\Npmndb32.dll Knchio32.exe File created C:\Windows\SysWOW64\Loigap32.exe Lngkjhmi.exe File created C:\Windows\SysWOW64\Apcemh32.exe Qobhepjf.exe File opened for modification C:\Windows\SysWOW64\Bmqhlk32.exe Adhdcepc.exe File created C:\Windows\SysWOW64\Hicpqh32.exe Hbihdn32.exe File opened for modification C:\Windows\SysWOW64\Kjffngap.exe Keinepch.exe File created C:\Windows\SysWOW64\Eiobmjkd.exe Ebejpp32.exe File opened for modification C:\Windows\SysWOW64\Flinddpj.exe Fjhaml32.exe File opened for modification C:\Windows\SysWOW64\Iihilhol.exe Ibnaonhp.exe File created C:\Windows\SysWOW64\Jpkdoq32.exe Ipihiaqa.exe - Program crash 1 IoCs
pid pid_target Process procid_target 6876 784 WerFault.exe 780 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edemdine.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Injcginc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nanmhf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gikdep32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eeeaibid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pddhlnfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aeodapcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjdjhgdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Linmlm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Palbpb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebapednb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ifglmlol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkkemble.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmjefkap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mqdcga32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjmcghjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pdalfo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qobhepjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojkepmqp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkkjfa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fihecici.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdnipbbo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bkobfdao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eiokbd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qanhkk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdkipb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pgdodq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bodfkpfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikqqfm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Boabkj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgpmffeh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lmmoekem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnhkklbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Joahjcgb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnjhccnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Agdhln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmnkdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Piphaf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mggecl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aagkaj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bngnmjql.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nelfnd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gfaikoad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbdbcl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kfehoj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfhani32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggpbcaei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ecpmod32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmfalimb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oocdme32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lelcbmcc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnhdae32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phjdggoj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckgnbl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Figgnm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klifhpjk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Acdbpq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Didjkbim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fhjlkg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpeapilo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjhaml32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kqmkjk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Headjael.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlpeol32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mbigapjb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bfkkhdlk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aaenlj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llploh32.dll" Ibnaonhp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dannbogl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Haefqjeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Macdgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bkmmkj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccnbfi32.dll" Fjhaml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nanmhf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Npgalidl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Abmbaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Alkidi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jndmgn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jjhjli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agccld32.dll" Filailgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikodjj32.dll" Fmfgoa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nliakd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Obgccn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Allpnplb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hdmohnhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Digeaenp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nekgna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbbiak32.dll" Dpnbhl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kbpkdd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mhoiih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njghcg32.dll" Majjgmco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Djelqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ejjelnfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Phdngljk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gnaodbhl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ggnlhgkg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dkbomgde.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fbomfokl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Feceig32.dll" Kqmkjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iiaogj32.dll" Lcfphn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mcbpcm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpfooc32.dll" Gihpejmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dflmep32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iomood32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbkbkm32.dll" Agdcja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdjcejqh.dll" Jnaighhk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncjglifc.dll" Ffclml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hkobdeok.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hhdhhchf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdhbpkgj.dll" Lgqfmcge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qjdpoacp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfhideka.dll" Enmjedpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlhjfj32.dll" Fbdeba32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jeqbjgoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mmfkac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oofhnd32.dll" Ommjipel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 2026-07-17_f10672fd45cf45359edf3c21db590711_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agkejbik.dll" Lmmoekem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pajekb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eenfff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cgijnk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Alnmdojp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ckgnbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qjijgead.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gplpfb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cdmfebnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knnpieak.dll" Gbnhhp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gfaikoad.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2696 2036 2026-07-17_f10672fd45cf45359edf3c21db590711_elex_wannacry.exe 89 PID 2696 wrote to memory of 1584 2696 Eeeaibid.exe 90 PID 1584 wrote to memory of 4876 1584 Eoneah32.exe 91 PID 4876 wrote to memory of 5348 4876 Fkiobhac.exe 92 PID 5348 wrote to memory of 5080 5348 Fnjhccnd.exe 93 PID 5080 wrote to memory of 5968 5080 Fgbmliee.exe 94 PID 5968 wrote to memory of 4668 5968 Fecmjq32.exe 95 PID 4668 wrote to memory of 252 4668 Fgeibicb.exe 96 PID 252 wrote to memory of 3828 252 Fajnoabh.exe 97 PID 3828 wrote to memory of 5424 3828 Fhdfll32.exe 98 PID 5424 wrote to memory of 4972 5424 Gnaodbhl.exe 99 PID 4972 wrote to memory of 3512 4972 Gdkgam32.exe 100 PID 3512 wrote to memory of 3548 3512 Gkeonggf.exe 101 PID 3548 wrote to memory of 2840 3548 Gekckpgl.exe 102 PID 2840 wrote to memory of 1300 2840 Gkglcfec.exe 103 PID 1300 wrote to memory of 1704 1300 Gaadpqmp.exe 104 PID 1704 wrote to memory of 248 1704 Ggnlhgkg.exe 105 PID 248 wrote to memory of 5856 248 Gadqepkn.exe 106 PID 5856 wrote to memory of 2872 5856 Ghnibj32.exe 107 PID 2872 wrote to memory of 4372 2872 Gfaikoad.exe 108 PID 4372 wrote to memory of 912 4372 Hkobdeok.exe 109 PID 912 wrote to memory of 1924 912 Hfdfanoa.exe 110 PID 1924 wrote to memory of 948 1924 Hnokeqll.exe 111 PID 948 wrote to memory of 1904 948 Hheoci32.exe 112 PID 1904 wrote to memory of 3960 1904 Hoogpcco.exe 113 PID 3960 wrote to memory of 2340 3960 Hdlphjaf.exe 114 PID 2340 wrote to memory of 5996 2340 Hkehdd32.exe 115 PID 5996 wrote to memory of 1224 5996 Hfklamii.exe 116 PID 1224 wrote to memory of 3784 1224 Hgliie32.exe 117 PID 3784 wrote to memory of 5652 3784 Hfmigmgf.exe 118 PID 5652 wrote to memory of 120 5652 Ikjapden.exe 119 PID 120 wrote to memory of 4208 120 Ifpemmdd.exe 120 PID 4208 wrote to memory of 3088 4208 Iohjebkd.exe 121 PID 3088 wrote to memory of 2168 3088 Idebniil.exe 122 PID 2168 wrote to memory of 1488 2168 Iojgkbib.exe 123 PID 1488 wrote to memory of 5696 1488 Idgocigi.exe 124 PID 5696 wrote to memory of 4768 5696 Iomcqa32.exe 125 PID 4768 wrote to memory of 1792 4768 Ifglmlol.exe 126 PID 1792 wrote to memory of 1348 1792 Ikcdfbmc.exe 127 PID 1348 wrote to memory of 4644 1348 Ifihckmi.exe 128 PID 4644 wrote to memory of 2532 4644 Jgjekc32.exe 129 PID 2532 wrote to memory of 2848 2532 Jndmgn32.exe 130 PID 2848 wrote to memory of 4796 2848 Jijaef32.exe 131 PID 4796 wrote to memory of 2812 4796 Jodiaqag.exe 132 PID 2812 wrote to memory of 1136 2812 Jeqbjgoo.exe 133 PID 1136 wrote to memory of 3336 1136 Jkkjfa32.exe 134 PID 3336 wrote to memory of 4684 3336 Jbdbcl32.exe 135 PID 4684 wrote to memory of 3316 4684 Jiokpfee.exe 136 PID 3316 wrote to memory of 1492 3316 Jnkchmdl.exe 137 PID 1492 wrote to memory of 4076 1492 Jeekeg32.exe 138 PID 4076 wrote to memory of 5000 4076 Jpkpbpko.exe 139 PID 5000 wrote to memory of 4672 5000 Kfehoj32.exe 140 PID 4672 wrote to memory of 5328 4672 Klapgq32.exe 141 PID 5328 wrote to memory of 2192 5328 Kblidkhp.exe 142 PID 2192 wrote to memory of 5588 2192 Khhalafg.exe 143 PID 5588 wrote to memory of 5740 5588 Knbiil32.exe 144 PID 5740 wrote to memory of 3580 5740 Kihnfdmj.exe 145 PID 3580 wrote to memory of 3264 3580 Knefnkla.exe 146 PID 3264 wrote to memory of 2752 3264 Keonke32.exe 147 PID 2752 wrote to memory of 1316 2752 Klifhpjk.exe 148 PID 1316 wrote to memory of 4356 1316 Kfnkeh32.exe 150 PID 4356 wrote to memory of 5564 4356 Kpfonnab.exe 151 PID 5564 wrote to memory of 5972 5564 Lhbdbpnm.exe 152 PID 5972 wrote to memory of 3248 5972 Llpmhodc.exe 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_f10672fd45cf45359edf3c21db590711_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_f10672fd45cf45359edf3c21db590711_elex_wannacry.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\Eeeaibid.exeC:\Windows\system32\Eeeaibid.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\Eoneah32.exeC:\Windows\system32\Eoneah32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\Fkiobhac.exeC:\Windows\system32\Fkiobhac.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\Fnjhccnd.exeC:\Windows\system32\Fnjhccnd.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Windows\SysWOW64\Fgbmliee.exeC:\Windows\system32\Fgbmliee.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\Fecmjq32.exeC:\Windows\system32\Fecmjq32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\SysWOW64\Fgeibicb.exeC:\Windows\system32\Fgeibicb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\Fajnoabh.exeC:\Windows\system32\Fajnoabh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\Fhdfll32.exeC:\Windows\system32\Fhdfll32.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\Gnaodbhl.exeC:\Windows\system32\Gnaodbhl.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Windows\SysWOW64\Gdkgam32.exeC:\Windows\system32\Gdkgam32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\Gkeonggf.exeC:\Windows\system32\Gkeonggf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\Gekckpgl.exeC:\Windows\system32\Gekckpgl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\Gkglcfec.exeC:\Windows\system32\Gkglcfec.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\Gaadpqmp.exeC:\Windows\system32\Gaadpqmp.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\Ggnlhgkg.exeC:\Windows\system32\Ggnlhgkg.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\Gadqepkn.exeC:\Windows\system32\Gadqepkn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\Ghnibj32.exeC:\Windows\system32\Ghnibj32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\SysWOW64\Gfaikoad.exeC:\Windows\system32\Gfaikoad.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\Hkobdeok.exeC:\Windows\system32\Hkobdeok.exe21⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\Hfdfanoa.exeC:\Windows\system32\Hfdfanoa.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\Hnokeqll.exeC:\Windows\system32\Hnokeqll.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\Hheoci32.exeC:\Windows\system32\Hheoci32.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\Hoogpcco.exeC:\Windows\system32\Hoogpcco.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\Hdlphjaf.exeC:\Windows\system32\Hdlphjaf.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\Hkehdd32.exeC:\Windows\system32\Hkehdd32.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\Hfklamii.exeC:\Windows\system32\Hfklamii.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\Hgliie32.exeC:\Windows\system32\Hgliie32.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\Hfmigmgf.exeC:\Windows\system32\Hfmigmgf.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\Ikjapden.exeC:\Windows\system32\Ikjapden.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Windows\SysWOW64\Ifpemmdd.exeC:\Windows\system32\Ifpemmdd.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Windows\SysWOW64\Iohjebkd.exeC:\Windows\system32\Iohjebkd.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\Idebniil.exeC:\Windows\system32\Idebniil.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\Iojgkbib.exeC:\Windows\system32\Iojgkbib.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\Idgocigi.exeC:\Windows\system32\Idgocigi.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\Iomcqa32.exeC:\Windows\system32\Iomcqa32.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Windows\SysWOW64\Ifglmlol.exeC:\Windows\system32\Ifglmlol.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\Ikcdfbmc.exeC:\Windows\system32\Ikcdfbmc.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\Ifihckmi.exeC:\Windows\system32\Ifihckmi.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\Jgjekc32.exeC:\Windows\system32\Jgjekc32.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\Jndmgn32.exeC:\Windows\system32\Jndmgn32.exe42⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\Jijaef32.exeC:\Windows\system32\Jijaef32.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\Jodiaqag.exeC:\Windows\system32\Jodiaqag.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\Jeqbjgoo.exeC:\Windows\system32\Jeqbjgoo.exe45⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\Jkkjfa32.exeC:\Windows\system32\Jkkjfa32.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\Jbdbcl32.exeC:\Windows\system32\Jbdbcl32.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\Jiokpfee.exeC:\Windows\system32\Jiokpfee.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\Jnkchmdl.exeC:\Windows\system32\Jnkchmdl.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\Jeekeg32.exeC:\Windows\system32\Jeekeg32.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\Jpkpbpko.exeC:\Windows\system32\Jpkpbpko.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\Kfehoj32.exeC:\Windows\system32\Kfehoj32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\Klapgq32.exeC:\Windows\system32\Klapgq32.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\Kblidkhp.exeC:\Windows\system32\Kblidkhp.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Windows\SysWOW64\Khhalafg.exeC:\Windows\system32\Khhalafg.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\Knbiil32.exeC:\Windows\system32\Knbiil32.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\Kihnfdmj.exeC:\Windows\system32\Kihnfdmj.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\SysWOW64\Knefnkla.exeC:\Windows\system32\Knefnkla.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\Keonke32.exeC:\Windows\system32\Keonke32.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\Klifhpjk.exeC:\Windows\system32\Klifhpjk.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\Kfnkeh32.exeC:\Windows\system32\Kfnkeh32.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\Kpfonnab.exeC:\Windows\system32\Kpfonnab.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\Lhbdbpnm.exeC:\Windows\system32\Lhbdbpnm.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\Llpmhodc.exeC:\Windows\system32\Llpmhodc.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\Lfeaegdi.exeC:\Windows\system32\Lfeaegdi.exe65⤵
- Executes dropped EXE
PID:3248 -
C:\Windows\SysWOW64\Loqejjad.exeC:\Windows\system32\Loqejjad.exe66⤵PID:5816
-
C:\Windows\SysWOW64\Lhijcohe.exeC:\Windows\system32\Lhijcohe.exe67⤵PID:1452
-
C:\Windows\SysWOW64\Lfjjqg32.exeC:\Windows\system32\Lfjjqg32.exe68⤵PID:680
-
C:\Windows\SysWOW64\Lhkghofb.exeC:\Windows\system32\Lhkghofb.exe69⤵PID:4656
-
C:\Windows\SysWOW64\Meogbcel.exeC:\Windows\system32\Meogbcel.exe70⤵PID:2920
-
C:\Windows\SysWOW64\Mlipomli.exeC:\Windows\system32\Mlipomli.exe71⤵PID:6068
-
C:\Windows\SysWOW64\Mhppcn32.exeC:\Windows\system32\Mhppcn32.exe72⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4956 -
C:\Windows\SysWOW64\Mbedag32.exeC:\Windows\system32\Mbedag32.exe73⤵PID:6020
-
C:\Windows\SysWOW64\Mpiejkql.exeC:\Windows\system32\Mpiejkql.exe74⤵PID:3332
-
C:\Windows\SysWOW64\Mfcmge32.exeC:\Windows\system32\Mfcmge32.exe75⤵PID:5964
-
C:\Windows\SysWOW64\Mlpeol32.exeC:\Windows\system32\Mlpeol32.exe76⤵
- System Location Discovery: System Language Discovery
PID:1760 -
C:\Windows\SysWOW64\Mhgfdmle.exeC:\Windows\system32\Mhgfdmle.exe77⤵PID:4144
-
C:\Windows\SysWOW64\Nekgna32.exeC:\Windows\system32\Nekgna32.exe78⤵
- Modifies registry class
PID:4652 -
C:\Windows\SysWOW64\Nleojlbk.exeC:\Windows\system32\Nleojlbk.exe79⤵PID:3216
-
C:\Windows\SysWOW64\Nemcca32.exeC:\Windows\system32\Nemcca32.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3528 -
C:\Windows\SysWOW64\Niklip32.exeC:\Windows\system32\Niklip32.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3144 -
C:\Windows\SysWOW64\Nohdaf32.exeC:\Windows\system32\Nohdaf32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6056 -
C:\Windows\SysWOW64\Nebmnqdf.exeC:\Windows\system32\Nebmnqdf.exe83⤵PID:1484
-
C:\Windows\SysWOW64\Npgalidl.exeC:\Windows\system32\Npgalidl.exe84⤵
- Modifies registry class
PID:1444 -
C:\Windows\SysWOW64\Ngaihcli.exeC:\Windows\system32\Ngaihcli.exe85⤵PID:704
-
C:\Windows\SysWOW64\Ocjgcd32.exeC:\Windows\system32\Ocjgcd32.exe86⤵PID:4300
-
C:\Windows\SysWOW64\Olcklj32.exeC:\Windows\system32\Olcklj32.exe87⤵PID:1016
-
C:\Windows\SysWOW64\Oocdme32.exeC:\Windows\system32\Oocdme32.exe88⤵
- System Location Discovery: System Language Discovery
PID:2712 -
C:\Windows\SysWOW64\Opcqgh32.exeC:\Windows\system32\Opcqgh32.exe89⤵PID:4836
-
C:\Windows\SysWOW64\Ojkepmqp.exeC:\Windows\system32\Ojkepmqp.exe90⤵
- System Location Discovery: System Language Discovery
PID:6100 -
C:\Windows\SysWOW64\Pohnhdog.exeC:\Windows\system32\Pohnhdog.exe91⤵PID:1096
-
C:\Windows\SysWOW64\Pfdbknda.exeC:\Windows\system32\Pfdbknda.exe92⤵PID:5496
-
C:\Windows\SysWOW64\Pgdodq32.exeC:\Windows\system32\Pgdodq32.exe93⤵
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Windows\SysWOW64\Plagmh32.exeC:\Windows\system32\Plagmh32.exe94⤵PID:5124
-
C:\Windows\SysWOW64\Pgfljqia.exeC:\Windows\system32\Pgfljqia.exe95⤵PID:1772
-
C:\Windows\SysWOW64\Phhhbi32.exeC:\Windows\system32\Phhhbi32.exe96⤵PID:5736
-
C:\Windows\SysWOW64\Pcmloa32.exeC:\Windows\system32\Pcmloa32.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4616 -
C:\Windows\SysWOW64\Qhjegh32.exeC:\Windows\system32\Qhjegh32.exe98⤵PID:2892
-
C:\Windows\SysWOW64\Qcpieamc.exeC:\Windows\system32\Qcpieamc.exe99⤵PID:1916
-
C:\Windows\SysWOW64\Qhlamhkj.exeC:\Windows\system32\Qhlamhkj.exe100⤵PID:4948
-
C:\Windows\SysWOW64\Qgmbkp32.exeC:\Windows\system32\Qgmbkp32.exe101⤵PID:5660
-
C:\Windows\SysWOW64\Ahonbhig.exeC:\Windows\system32\Ahonbhig.exe102⤵PID:5296
-
C:\Windows\SysWOW64\Acdbpq32.exeC:\Windows\system32\Acdbpq32.exe103⤵
- System Location Discovery: System Language Discovery
PID:5948 -
C:\Windows\SysWOW64\Ajnkmjqj.exeC:\Windows\system32\Ajnkmjqj.exe104⤵
- Drops file in System32 directory
PID:1796 -
C:\Windows\SysWOW64\Acfoep32.exeC:\Windows\system32\Acfoep32.exe105⤵PID:4420
-
C:\Windows\SysWOW64\Amodnenk.exeC:\Windows\system32\Amodnenk.exe106⤵PID:4888
-
C:\Windows\SysWOW64\Agdhln32.exeC:\Windows\system32\Agdhln32.exe107⤵
- System Location Discovery: System Language Discovery
PID:5460 -
C:\Windows\SysWOW64\Amaqde32.exeC:\Windows\system32\Amaqde32.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3032 -
C:\Windows\SysWOW64\Afjemkbi.exeC:\Windows\system32\Afjemkbi.exe109⤵PID:4632
-
C:\Windows\SysWOW64\Aqoijcbo.exeC:\Windows\system32\Aqoijcbo.exe110⤵PID:6104
-
C:\Windows\SysWOW64\Bjgncihp.exeC:\Windows\system32\Bjgncihp.exe111⤵PID:5840
-
C:\Windows\SysWOW64\Bodfkpfg.exeC:\Windows\system32\Bodfkpfg.exe112⤵
- System Location Discovery: System Language Discovery
PID:2380 -
C:\Windows\SysWOW64\Bimkde32.exeC:\Windows\system32\Bimkde32.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4072 -
C:\Windows\SysWOW64\Bcboan32.exeC:\Windows\system32\Bcboan32.exe114⤵PID:1284
-
C:\Windows\SysWOW64\Bjlgnh32.exeC:\Windows\system32\Bjlgnh32.exe115⤵PID:5732
-
C:\Windows\SysWOW64\Bcdlgnkk.exeC:\Windows\system32\Bcdlgnkk.exe116⤵
- Drops file in System32 directory
PID:4980 -
C:\Windows\SysWOW64\Bmmppc32.exeC:\Windows\system32\Bmmppc32.exe117⤵PID:1908
-
C:\Windows\SysWOW64\Bgbdml32.exeC:\Windows\system32\Bgbdml32.exe118⤵PID:4184
-
C:\Windows\SysWOW64\Bmomecoi.exeC:\Windows\system32\Bmomecoi.exe119⤵PID:2392
-
C:\Windows\SysWOW64\Cfhani32.exeC:\Windows\system32\Cfhani32.exe120⤵
- System Location Discovery: System Language Discovery
PID:3012 -
C:\Windows\SysWOW64\Cameka32.exeC:\Windows\system32\Cameka32.exe121⤵PID:5752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-