Analysis
- max time kernel
55s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 14:00
Behavioral task
behavioral1
Sample
2026-07-20_fc94e9720543f3a5b100ba6225919ad4_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_fc94e9720543f3a5b100ba6225919ad4_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-20_fc94e9720543f3a5b100ba6225919ad4_elex_wannacry.exe
- Size 320KB
- Sample260720-ra4ybscs8j
- SHA256 ce231240162bf8cee38beee2d277ec4add867bce77e9f9f05357ef252cd8fcc3
- MD5 fc94e9720543f3a5b100ba6225919ad4
- SHA1 0a458526ed885eddf629a50548c518627a86a0e3
- SHA512 5dda67ef4c9a1920648ef01ba5c4e0257762fc6b30b922b759ba7ef0db841eb026ad86d9e2f4dbb73ec50ea694f39f6b197801637ff5301e4f2397c2d9ac75b1
- SSDEEP 3072:7n7QurcDnJbKwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:7EwmndKV/Ah1G/AcQ///NR5fn
- TLSH T1096430191A3409EACDED5FB5AC1249D89185EEF014F1E13E6123DFDCD8E4DAAC825F81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Elnoifjg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddjmkg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmeagjbo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iholhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nfiaajob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phnoac32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahnghafl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gjcmgmdg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okolppdo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Diknnlbi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iqbpkn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jipqkopf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knfeoobh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Agbgda32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hecjej32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhgkqn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ofjqbndk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnjmoqmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ihknibbo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eenfff32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ellpgeag.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Acclejeb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njjdae32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnmaog32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dggbmlba.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Llnnfnlc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kbibgcld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mngepb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fejebdig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ekladi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pamikh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkeeda32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahdgnj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onkimc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kglmbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Koaaaaip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nqmocjdf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Inhmjabg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oefpoi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pjjfnlho.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nifldj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aiabap32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gcfqjmka.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojcpmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iildfd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jpnadp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddhofjpb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ejojepfo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icoglp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Flcegd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjnmib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Neglceej.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cocjbkna.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dbmfje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mekdplkb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aflpde32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idicqm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lgqfmcge.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qaalkamf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gbnhhp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lllaqn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ejjqjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qpmnml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Boabkj32.exe - Executes dropped EXE 64 IoCs
pid Process 2672 Dannbogl.exe 3680 Ddngdj32.exe 2748 Ehaieh32.exe 6096 Ehcfkhel.exe 3776 Edjgpi32.exe 3252 Fhhpfg32.exe 4340 Fhjlkg32.exe 3288 Fpeapilo.exe 6068 Fgbfbc32.exe 2476 Fgdbgbof.exe 3284 Fibocnnj.exe 2860 Galcjkmj.exe 1104 Ghflgedf.exe 4288 Gpcmagpo.exe 5480 Gacjkjgb.exe 2384 Ggpbcaei.exe 2852 Gnjjpk32.exe 3596 Hjchjl32.exe 6124 Hhdhhchf.exe 2176 Hjedpkne.exe 4604 Hpomme32.exe 3968 Hgieipmo.exe 4720 Hjhaeklb.exe 4972 Hpaibe32.exe 5640 Hglaookl.exe 1500 Iaaflh32.exe 1392 Ihknibbo.exe 3292 Ikijenab.exe 1860 Iacbbh32.exe 4432 Igpkjo32.exe 5564 Ijogfj32.exe 4948 Iddlccfp.exe 5584 Ikndpm32.exe 5736 Ibhlmgdj.exe 5956 Ihbdja32.exe 2400 Ijcaaibe.exe 6052 Iqmincia.exe 6132 Iggakn32.exe 4416 Jnaighhk.exe 804 Jdkadb32.exe 6056 Jkejalge.exe 1100 Jbobnf32.exe 1864 Jhijjp32.exe 4184 Jjjgbhlm.exe 2488 Jqdoob32.exe 6092 Jgngkmkf.exe 3532 Jnhphg32.exe 5852 Jdbheajp.exe 4732 Jklpakam.exe 2508 Jbfhne32.exe 4600 Jipqkopf.exe 3896 Kiejfo32.exe 5388 Kqpoja32.exe 4916 Kkechjib.exe 472 Kndodehf.exe 4668 Kengqo32.exe 3372 Kaehepeg.exe 1976 Ljmmnf32.exe 3192 Lebalokn.exe 4236 Lnkedd32.exe 4320 Lnmbjd32.exe 5232 Legjgn32.exe 936 Lnpopcni.exe 5792 Llcoihmb.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Kmncbl32.exe Kjogfp32.exe File opened for modification C:\Windows\SysWOW64\Ohfhqd32.exe Oefpoi32.exe File opened for modification C:\Windows\SysWOW64\Fjjjanla.exe Fcpadd32.exe File created C:\Windows\SysWOW64\Hagkpl32.dll Hbakiina.exe File created C:\Windows\SysWOW64\Migpncoe.dll Dlqpkf32.exe File opened for modification C:\Windows\SysWOW64\Maicmgoc.exe Mnkgakpp.exe File opened for modification C:\Windows\SysWOW64\Cleeafbi.exe Cbpacmbc.exe File created C:\Windows\SysWOW64\Aogbpo32.exe Afpjoaeo.exe File created C:\Windows\SysWOW64\Dencgm32.dll Iimcgg32.exe File created C:\Windows\SysWOW64\Ofdmgkln.dll Cpjmjn32.exe File created C:\Windows\SysWOW64\Gkfnnjnl.exe Gpqjaanf.exe File created C:\Windows\SysWOW64\Gkjnib32.dll Ahdgnj32.exe File created C:\Windows\SysWOW64\Bakmbcka.exe Bffiejkk.exe File created C:\Windows\SysWOW64\Gmndjf32.exe Fbhplnca.exe File opened for modification C:\Windows\SysWOW64\Gmndjf32.exe Fbhplnca.exe File opened for modification C:\Windows\SysWOW64\Gmdjjemp.exe Gkfnnjnl.exe File created C:\Windows\SysWOW64\Hljhbd32.dll Bhpfjh32.exe File created C:\Windows\SysWOW64\Pfjhbe32.dll Jocnem32.exe File opened for modification C:\Windows\SysWOW64\Kimlnemd.exe Kafcmglb.exe File created C:\Windows\SysWOW64\Gdpcap32.dll Dcffggkb.exe File created C:\Windows\SysWOW64\Bodljoed.dll Eekail32.exe File created C:\Windows\SysWOW64\Gnjjpk32.exe Ggpbcaei.exe File created C:\Windows\SysWOW64\Glnlloji.dll Mngepb32.exe File created C:\Windows\SysWOW64\Ncbcjefh.dll Nimbdi32.exe File created C:\Windows\SysWOW64\Cedcglna.dll Bbdhbepl.exe File created C:\Windows\SysWOW64\Dgejeooc.dll Bjnmib32.exe File created C:\Windows\SysWOW64\Gpciecgl.dll Hdehho32.exe File created C:\Windows\SysWOW64\Aajggjap.exe Agdcja32.exe File created C:\Windows\SysWOW64\Fnalfmhp.exe Fggdic32.exe File created C:\Windows\SysWOW64\Hhdhhchf.exe Hjchjl32.exe File opened for modification C:\Windows\SysWOW64\Qaabfgpa.exe Qkhjim32.exe File created C:\Windows\SysWOW64\Emfebjgb.exe Dflmep32.exe File created C:\Windows\SysWOW64\Mgclja32.exe Maicmgoc.exe File opened for modification C:\Windows\SysWOW64\Pjhpccnn.exe Ppclej32.exe File created C:\Windows\SysWOW64\Fcffcd32.dll Jialbf32.exe File opened for modification C:\Windows\SysWOW64\Lejlioie.exe Kopcld32.exe File created C:\Windows\SysWOW64\Ggaoaf32.dll Odjmneim.exe File created C:\Windows\SysWOW64\Bkfelqpk.dll Jidpblik.exe File created C:\Windows\SysWOW64\Ojmmdmaj.dll Bpfkiepp.exe File opened for modification C:\Windows\SysWOW64\Emphhhoh.exe Efepln32.exe File created C:\Windows\SysWOW64\Iciaji32.exe Iloimopp.exe File created C:\Windows\SysWOW64\Ehfido32.dll Jgoflpal.exe File created C:\Windows\SysWOW64\Hijmjj32.exe Gpaiadel.exe File created C:\Windows\SysWOW64\Hnhpmc32.dll Nqmocjdf.exe File created C:\Windows\SysWOW64\Acdiii32.exe Aioelpki.exe File created C:\Windows\SysWOW64\Gkcdiaba.dll Bbqlkdio.exe File created C:\Windows\SysWOW64\Fgpfbjhn.dll Ffngfi32.exe File created C:\Windows\SysWOW64\Mpfqcm32.dll Jmnomk32.exe File created C:\Windows\SysWOW64\Jinjgohg.dll Bpodhf32.exe File opened for modification C:\Windows\SysWOW64\Ehpamnaj.exe Eqiilp32.exe File created C:\Windows\SysWOW64\Abedil32.exe Amikae32.exe File created C:\Windows\SysWOW64\Aehhdf32.dll Mkccmd32.exe File created C:\Windows\SysWOW64\Jkejalge.exe Jdkadb32.exe File opened for modification C:\Windows\SysWOW64\Eiaobjia.exe Ebggep32.exe File opened for modification C:\Windows\SysWOW64\Banabi32.exe Bopefnnf.exe File opened for modification C:\Windows\SysWOW64\Khdedapj.exe Kefiheqf.exe File created C:\Windows\SysWOW64\Dpjofefp.exe Dipgik32.exe File created C:\Windows\SysWOW64\Edlagc32.exe Eleiffho.exe File opened for modification C:\Windows\SysWOW64\Ihknibbo.exe Iaaflh32.exe File created C:\Windows\SysWOW64\Hmicee32.exe Hgokikan.exe File created C:\Windows\SysWOW64\Afknipda.dll Mjahfl32.exe File opened for modification C:\Windows\SysWOW64\Ndcoeq32.exe Nmighf32.exe File created C:\Windows\SysWOW64\Lcdcbokq.exe Lqfgfclm.exe File created C:\Windows\SysWOW64\Kajfmqda.exe Kkpnqf32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 5512 14000 Process not Found 1405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fppjpmim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aabafkgh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iaekfjje.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bicjjncd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkimae32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddgpfgil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Igmqpbab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Doeghk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hjgohf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljmfdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahdgnj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bklfqd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmcjiagf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Imdlgm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aealea32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlflog32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjjnblhi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmjole32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbellhbi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gldgflba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aogbpo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Amfokf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edlagc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbdhbepl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbiamd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dkpbgh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Idceim32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hcedfa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cbeffcei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iaaflh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kqmkjk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kcfgaq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nqhfhjhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Boabkj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gljgkb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mcqjhc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojbamj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckealm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lqfnqjpi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mkjnop32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pacojc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjlhpgfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lmmoekem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpbplkhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Obbnlkbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Feddpj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebcmjqej.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhgkqn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ecanhpmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ffngfi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iddlccfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jpalomaq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lfnfck32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojcghc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjhpccnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Defhnldg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnpopcni.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnjjpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nifldj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebdcejpk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpnfak32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgdinmod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Offnae32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Afpjoaeo.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bnfiapfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bklfqd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bnmobopb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dgpebf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jhhonl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bdpidg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcappaqj.dll" Ikijenab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bibngh32.dll" Mgibil32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Plbmhadm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gbqlhfgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Onapnbhi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Conagl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjnfof32.dll" Egnacd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lhkdkj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 2026-07-20_fc94e9720543f3a5b100ba6225919ad4_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nacmnlkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gkeffoig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbdcac32.dll" Lbngfbdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pahppihl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gldgflba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elhdhn32.dll" Bdlfdnhb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhdbkdmb.dll" Olgbidbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laanqhjo.dll" Qkoefnfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qddikf32.dll" Beoigphb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhkengpl.dll" Fjjnblhi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mkeeda32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nmenmgab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Koodka32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bonhqnpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqqjfe32.dll" Ibnaonhp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ccmcaicm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Engbehmo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Igpkjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kengqo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mijlhl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ajndbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nmajmaoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ddcoad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jcefbhpo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jqdoob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cobkbhgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fijknbmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gbnhhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fdfdmbpf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ihbdja32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Onapnbhi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bmeagjbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jaajah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jeeigakm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iqbpkn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Khondelh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jgngkmkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jljiimeb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hmpclnof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Igomeb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lidqbadl.dll" Jocepc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Coigllel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dqkmkb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glmljo32.dll" Hbgkno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hlqmla32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Akipdg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keqeeg32.dll" Cdmokljp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhfoha32.dll" Ibpgjg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jjdoeh32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3412 wrote to memory of 2672 3412 2026-07-20_fc94e9720543f3a5b100ba6225919ad4_elex_wannacry.exe 89 PID 2672 wrote to memory of 3680 2672 Dannbogl.exe 90 PID 3680 wrote to memory of 2748 3680 Ddngdj32.exe 91 PID 2748 wrote to memory of 6096 2748 Ehaieh32.exe 92 PID 6096 wrote to memory of 3776 6096 Ehcfkhel.exe 93 PID 3776 wrote to memory of 3252 3776 Edjgpi32.exe 94 PID 3252 wrote to memory of 4340 3252 Fhhpfg32.exe 95 PID 4340 wrote to memory of 3288 4340 Fhjlkg32.exe 96 PID 3288 wrote to memory of 6068 3288 Fpeapilo.exe 97 PID 6068 wrote to memory of 2476 6068 Fgbfbc32.exe 98 PID 2476 wrote to memory of 3284 2476 Fgdbgbof.exe 99 PID 3284 wrote to memory of 2860 3284 Fibocnnj.exe 100 PID 2860 wrote to memory of 1104 2860 Galcjkmj.exe 101 PID 1104 wrote to memory of 4288 1104 Ghflgedf.exe 102 PID 4288 wrote to memory of 5480 4288 Gpcmagpo.exe 103 PID 5480 wrote to memory of 2384 5480 Gacjkjgb.exe 104 PID 2384 wrote to memory of 2852 2384 Ggpbcaei.exe 105 PID 2852 wrote to memory of 3596 2852 Gnjjpk32.exe 106 PID 3596 wrote to memory of 6124 3596 Hjchjl32.exe 107 PID 6124 wrote to memory of 2176 6124 Hhdhhchf.exe 108 PID 2176 wrote to memory of 4604 2176 Hjedpkne.exe 109 PID 4604 wrote to memory of 3968 4604 Hpomme32.exe 110 PID 3968 wrote to memory of 4720 3968 Hgieipmo.exe 111 PID 4720 wrote to memory of 4972 4720 Hjhaeklb.exe 112 PID 4972 wrote to memory of 5640 4972 Hpaibe32.exe 113 PID 5640 wrote to memory of 1500 5640 Hglaookl.exe 114 PID 1500 wrote to memory of 1392 1500 Iaaflh32.exe 115 PID 1392 wrote to memory of 3292 1392 Ihknibbo.exe 116 PID 3292 wrote to memory of 1860 3292 Ikijenab.exe 117 PID 1860 wrote to memory of 4432 1860 Iacbbh32.exe 118 PID 4432 wrote to memory of 5564 4432 Igpkjo32.exe 119 PID 5564 wrote to memory of 4948 5564 Ijogfj32.exe 120 PID 4948 wrote to memory of 5584 4948 Iddlccfp.exe 121 PID 5584 wrote to memory of 5736 5584 Ikndpm32.exe 122 PID 5736 wrote to memory of 5956 5736 Ibhlmgdj.exe 123 PID 5956 wrote to memory of 2400 5956 Ihbdja32.exe 124 PID 2400 wrote to memory of 6052 2400 Ijcaaibe.exe 125 PID 6052 wrote to memory of 6132 6052 Iqmincia.exe 126 PID 6132 wrote to memory of 4416 6132 Iggakn32.exe 127 PID 4416 wrote to memory of 804 4416 Jnaighhk.exe 128 PID 804 wrote to memory of 6056 804 Jdkadb32.exe 129 PID 6056 wrote to memory of 1100 6056 Jkejalge.exe 130 PID 1100 wrote to memory of 1864 1100 Jbobnf32.exe 131 PID 1864 wrote to memory of 4184 1864 Jhijjp32.exe 132 PID 4184 wrote to memory of 2488 4184 Jjjgbhlm.exe 133 PID 2488 wrote to memory of 6092 2488 Jqdoob32.exe 134 PID 6092 wrote to memory of 3532 6092 Jgngkmkf.exe 135 PID 3532 wrote to memory of 5852 3532 Jnhphg32.exe 136 PID 5852 wrote to memory of 4732 5852 Jdbheajp.exe 137 PID 4732 wrote to memory of 2508 4732 Jklpakam.exe 138 PID 2508 wrote to memory of 4600 2508 Jbfhne32.exe 139 PID 4600 wrote to memory of 3896 4600 Jipqkopf.exe 140 PID 3896 wrote to memory of 5388 3896 Kiejfo32.exe 141 PID 5388 wrote to memory of 4916 5388 Kqpoja32.exe 142 PID 4916 wrote to memory of 472 4916 Kkechjib.exe 143 PID 472 wrote to memory of 4668 472 Kndodehf.exe 144 PID 4668 wrote to memory of 3372 4668 Kengqo32.exe 145 PID 3372 wrote to memory of 1976 3372 Kaehepeg.exe 146 PID 1976 wrote to memory of 3192 1976 Ljmmnf32.exe 147 PID 3192 wrote to memory of 4236 3192 Lebalokn.exe 148 PID 4236 wrote to memory of 4320 4236 Lnkedd32.exe 149 PID 4320 wrote to memory of 5232 4320 Lnmbjd32.exe 150 PID 5232 wrote to memory of 936 5232 Legjgn32.exe 151 PID 936 wrote to memory of 5792 936 Lnpopcni.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_fc94e9720543f3a5b100ba6225919ad4_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_fc94e9720543f3a5b100ba6225919ad4_elex_wannacry.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\Dannbogl.exeC:\Windows\system32\Dannbogl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\Ddngdj32.exeC:\Windows\system32\Ddngdj32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\Ehaieh32.exeC:\Windows\system32\Ehaieh32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\Ehcfkhel.exeC:\Windows\system32\Ehcfkhel.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\SysWOW64\Edjgpi32.exeC:\Windows\system32\Edjgpi32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\Fhhpfg32.exeC:\Windows\system32\Fhhpfg32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\Fhjlkg32.exeC:\Windows\system32\Fhjlkg32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\Fpeapilo.exeC:\Windows\system32\Fpeapilo.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\Fgbfbc32.exeC:\Windows\system32\Fgbfbc32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Windows\SysWOW64\Fgdbgbof.exeC:\Windows\system32\Fgdbgbof.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\Fibocnnj.exeC:\Windows\system32\Fibocnnj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\Galcjkmj.exeC:\Windows\system32\Galcjkmj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\Ghflgedf.exeC:\Windows\system32\Ghflgedf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\Gpcmagpo.exeC:\Windows\system32\Gpcmagpo.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\Gacjkjgb.exeC:\Windows\system32\Gacjkjgb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Windows\SysWOW64\Ggpbcaei.exeC:\Windows\system32\Ggpbcaei.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\Gnjjpk32.exeC:\Windows\system32\Gnjjpk32.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\Hjchjl32.exeC:\Windows\system32\Hjchjl32.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\Hhdhhchf.exeC:\Windows\system32\Hhdhhchf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\SysWOW64\Hjedpkne.exeC:\Windows\system32\Hjedpkne.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\Hpomme32.exeC:\Windows\system32\Hpomme32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\Hgieipmo.exeC:\Windows\system32\Hgieipmo.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\Hjhaeklb.exeC:\Windows\system32\Hjhaeklb.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\Hpaibe32.exeC:\Windows\system32\Hpaibe32.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\Hglaookl.exeC:\Windows\system32\Hglaookl.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\Iaaflh32.exeC:\Windows\system32\Iaaflh32.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\Ihknibbo.exeC:\Windows\system32\Ihknibbo.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\Ikijenab.exeC:\Windows\system32\Ikijenab.exe29⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\Iacbbh32.exeC:\Windows\system32\Iacbbh32.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\Igpkjo32.exeC:\Windows\system32\Igpkjo32.exe31⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\Ijogfj32.exeC:\Windows\system32\Ijogfj32.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\Iddlccfp.exeC:\Windows\system32\Iddlccfp.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\Ikndpm32.exeC:\Windows\system32\Ikndpm32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\Ibhlmgdj.exeC:\Windows\system32\Ibhlmgdj.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Windows\SysWOW64\Ihbdja32.exeC:\Windows\system32\Ihbdja32.exe36⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Windows\SysWOW64\Ijcaaibe.exeC:\Windows\system32\Ijcaaibe.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\Iqmincia.exeC:\Windows\system32\Iqmincia.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\SysWOW64\Iggakn32.exeC:\Windows\system32\Iggakn32.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Windows\SysWOW64\Jnaighhk.exeC:\Windows\system32\Jnaighhk.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\Jdkadb32.exeC:\Windows\system32\Jdkadb32.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\Jkejalge.exeC:\Windows\system32\Jkejalge.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Windows\SysWOW64\Jbobnf32.exeC:\Windows\system32\Jbobnf32.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\Jhijjp32.exeC:\Windows\system32\Jhijjp32.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\Jjjgbhlm.exeC:\Windows\system32\Jjjgbhlm.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\Jqdoob32.exeC:\Windows\system32\Jqdoob32.exe46⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\Jgngkmkf.exeC:\Windows\system32\Jgngkmkf.exe47⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\SysWOW64\Jnhphg32.exeC:\Windows\system32\Jnhphg32.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\Jdbheajp.exeC:\Windows\system32\Jdbheajp.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\Jklpakam.exeC:\Windows\system32\Jklpakam.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\Jbfhne32.exeC:\Windows\system32\Jbfhne32.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\Jipqkopf.exeC:\Windows\system32\Jipqkopf.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\Kiejfo32.exeC:\Windows\system32\Kiejfo32.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\Kqpoja32.exeC:\Windows\system32\Kqpoja32.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Windows\SysWOW64\Kkechjib.exeC:\Windows\system32\Kkechjib.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\Kndodehf.exeC:\Windows\system32\Kndodehf.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\Kengqo32.exeC:\Windows\system32\Kengqo32.exe57⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\Kaehepeg.exeC:\Windows\system32\Kaehepeg.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\Ljmmnf32.exeC:\Windows\system32\Ljmmnf32.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\Lebalokn.exeC:\Windows\system32\Lebalokn.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\Lnkedd32.exeC:\Windows\system32\Lnkedd32.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\Lnmbjd32.exeC:\Windows\system32\Lnmbjd32.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\Legjgn32.exeC:\Windows\system32\Legjgn32.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Windows\SysWOW64\Lnpopcni.exeC:\Windows\system32\Lnpopcni.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\SysWOW64\Llcoihmb.exeC:\Windows\system32\Llcoihmb.exe65⤵
- Executes dropped EXE
PID:5792 -
C:\Windows\SysWOW64\Lbngfbdo.exeC:\Windows\system32\Lbngfbdo.exe66⤵
- Modifies registry class
PID:564 -
C:\Windows\SysWOW64\Mlflog32.exeC:\Windows\system32\Mlflog32.exe67⤵
- System Location Discovery: System Language Discovery
PID:4168 -
C:\Windows\SysWOW64\Mijlhl32.exeC:\Windows\system32\Mijlhl32.exe68⤵
- Modifies registry class
PID:4880 -
C:\Windows\SysWOW64\Mngepb32.exeC:\Windows\system32\Mngepb32.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5616 -
C:\Windows\SysWOW64\Mhoiih32.exeC:\Windows\system32\Mhoiih32.exe70⤵PID:5612
-
C:\Windows\SysWOW64\Mbenfq32.exeC:\Windows\system32\Mbenfq32.exe71⤵PID:1308
-
C:\Windows\SysWOW64\Mlmbofdh.exeC:\Windows\system32\Mlmbofdh.exe72⤵PID:2976
-
C:\Windows\SysWOW64\Meefhl32.exeC:\Windows\system32\Meefhl32.exe73⤵PID:2592
-
C:\Windows\SysWOW64\Nhfpjghi.exeC:\Windows\system32\Nhfpjghi.exe74⤵PID:2908
-
C:\Windows\SysWOW64\Nblcgpho.exeC:\Windows\system32\Nblcgpho.exe75⤵PID:1912
-
C:\Windows\SysWOW64\Nifldj32.exeC:\Windows\system32\Nifldj32.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2752 -
C:\Windows\SysWOW64\Njghkb32.exeC:\Windows\system32\Njghkb32.exe77⤵PID:5304
-
C:\Windows\SysWOW64\Nihiiimi.exeC:\Windows\system32\Nihiiimi.exe78⤵PID:4944
-
C:\Windows\SysWOW64\Nacmnlkd.exeC:\Windows\system32\Nacmnlkd.exe79⤵
- Modifies registry class
PID:2528 -
C:\Windows\SysWOW64\Nogngp32.exeC:\Windows\system32\Nogngp32.exe80⤵PID:3000
-
C:\Windows\SysWOW64\Nimbdi32.exeC:\Windows\system32\Nimbdi32.exe81⤵
- Drops file in System32 directory
PID:712 -
C:\Windows\SysWOW64\Ohboeenl.exeC:\Windows\system32\Ohboeenl.exe82⤵PID:2724
-
C:\Windows\SysWOW64\Oefpoi32.exeC:\Windows\system32\Oefpoi32.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1380 -
C:\Windows\SysWOW64\Ohfhqd32.exeC:\Windows\system32\Ohfhqd32.exe84⤵PID:5924
-
C:\Windows\SysWOW64\Oifekg32.exeC:\Windows\system32\Oifekg32.exe85⤵PID:1460
-
C:\Windows\SysWOW64\Oldagc32.exeC:\Windows\system32\Oldagc32.exe86⤵PID:4304
-
C:\Windows\SysWOW64\Oboicmhj.exeC:\Windows\system32\Oboicmhj.exe87⤵PID:4384
-
C:\Windows\SysWOW64\Phnoac32.exeC:\Windows\system32\Phnoac32.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3384 -
C:\Windows\SysWOW64\Peaokh32.exeC:\Windows\system32\Peaokh32.exe89⤵PID:624
-
C:\Windows\SysWOW64\Pkngco32.exeC:\Windows\system32\Pkngco32.exe90⤵PID:5400
-
C:\Windows\SysWOW64\Pahppihl.exeC:\Windows\system32\Pahppihl.exe91⤵
- Modifies registry class
PID:1052 -
C:\Windows\SysWOW64\Phbhlcpi.exeC:\Windows\system32\Phbhlcpi.exe92⤵PID:2996
-
C:\Windows\SysWOW64\Polpim32.exeC:\Windows\system32\Polpim32.exe93⤵PID:3040
-
C:\Windows\SysWOW64\Pibdff32.exeC:\Windows\system32\Pibdff32.exe94⤵PID:2532
-
C:\Windows\SysWOW64\Pkcannmj.exeC:\Windows\system32\Pkcannmj.exe95⤵PID:1352
-
C:\Windows\SysWOW64\Pamikh32.exeC:\Windows\system32\Pamikh32.exe96⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1800 -
C:\Windows\SysWOW64\Plbmhadm.exeC:\Windows\system32\Plbmhadm.exe97⤵
- Modifies registry class
PID:2644 -
C:\Windows\SysWOW64\Poajdlcq.exeC:\Windows\system32\Poajdlcq.exe98⤵PID:5380
-
C:\Windows\SysWOW64\Qifnaecf.exeC:\Windows\system32\Qifnaecf.exe99⤵PID:2656
-
C:\Windows\SysWOW64\Qkhjim32.exeC:\Windows\system32\Qkhjim32.exe100⤵
- Drops file in System32 directory
PID:4788 -
C:\Windows\SysWOW64\Qaabfgpa.exeC:\Windows\system32\Qaabfgpa.exe101⤵PID:3820
-
C:\Windows\SysWOW64\Qjijgead.exeC:\Windows\system32\Qjijgead.exe102⤵PID:1796
-
C:\Windows\SysWOW64\Qkjgomgb.exeC:\Windows\system32\Qkjgomgb.exe103⤵PID:2152
-
C:\Windows\SysWOW64\Aadokg32.exeC:\Windows\system32\Aadokg32.exe104⤵PID:2816
-
C:\Windows\SysWOW64\Ahnghafl.exeC:\Windows\system32\Ahnghafl.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1548 -
C:\Windows\SysWOW64\Acclejeb.exeC:\Windows\system32\Acclejeb.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4596 -
C:\Windows\SysWOW64\Ajndbd32.exeC:\Windows\system32\Ajndbd32.exe107⤵
- Modifies registry class
PID:4816 -
C:\Windows\SysWOW64\Akoqjl32.exeC:\Windows\system32\Akoqjl32.exe108⤵PID:5760
-
C:\Windows\SysWOW64\Afddge32.exeC:\Windows\system32\Afddge32.exe109⤵PID:3488
-
C:\Windows\SysWOW64\Akamol32.exeC:\Windows\system32\Akamol32.exe110⤵PID:4764
-
C:\Windows\SysWOW64\Aakelfhg.exeC:\Windows\system32\Aakelfhg.exe111⤵PID:244
-
C:\Windows\SysWOW64\Alqjiohm.exeC:\Windows\system32\Alqjiohm.exe112⤵PID:5880
-
C:\Windows\SysWOW64\Ackbfioj.exeC:\Windows\system32\Ackbfioj.exe113⤵PID:3108
-
C:\Windows\SysWOW64\Ahgjnpna.exeC:\Windows\system32\Ahgjnpna.exe114⤵PID:4456
-
C:\Windows\SysWOW64\Boabkj32.exeC:\Windows\system32\Boabkj32.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:5208 -
C:\Windows\SysWOW64\Bfkkhdlk.exeC:\Windows\system32\Bfkkhdlk.exe116⤵PID:2000
-
C:\Windows\SysWOW64\Blecdn32.exeC:\Windows\system32\Blecdn32.exe117⤵PID:5708
-
C:\Windows\SysWOW64\Bcokah32.exeC:\Windows\system32\Bcokah32.exe118⤵PID:5036
-
C:\Windows\SysWOW64\Bjicnbba.exeC:\Windows\system32\Bjicnbba.exe119⤵PID:5288
-
C:\Windows\SysWOW64\Bkjpek32.exeC:\Windows\system32\Bkjpek32.exe120⤵PID:1164
-
C:\Windows\SysWOW64\Bbdhbepl.exeC:\Windows\system32\Bbdhbepl.exe121⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-