Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 14:29
Behavioral task
behavioral1
Sample
2026-07-20_717ced8b88c3c062e5cb414a7b650991_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_717ced8b88c3c062e5cb414a7b650991_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-20_717ced8b88c3c062e5cb414a7b650991_elex_wannacry.exe
- Size 320KB
- Sample260720-rtl7mac15l
- SHA256 96c6bc73f11ec40f3785240fbc40fc470762e044c1e647b6de55efc5e8282c07
- MD5 717ced8b88c3c062e5cb414a7b650991
- SHA1 9c1abe4ae4762e4679adf953f87a99fe368aa1a7
- SHA512 326d0623514a49a3c2b2a41f57d6a3e5ea2a5c8e4630e03da43e22dc9f31a30ec19a44bd27a64d070a49876ee6466ec1c18d71db05dc8219baa33642cfc917ed
- SSDEEP 3072:HsmzpUC8rbwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:hzp2bV/Ah1G/AcQ///NR5fn
- TLSH T121640D19263409EADDED2BB5AC0299DC9141E9F015F1E53E6123DFDCD8E4DA2CC29F82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nahgik32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebcmjqej.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ekoniian.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhqoaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ojcghc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Galoin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nhckmmeg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Polpim32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gkhkdjli.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qmccecfp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfkmdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dooaip32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eeqclfaa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njaakf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eqbclagp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Khmjga32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndcoeq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahmqnkbp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nqkihpie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fnfmlchf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbigapjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aogije32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iomood32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgnogmkl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlqjlmjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ajnkmjqj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Afelal32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efdjqeni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nahgik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Glgjfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jkbfafel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lqkgli32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akqfef32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olehai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bcdlgnkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ealkcm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cofemg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmicee32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Innfgb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odooqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eofgioah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Galcjkmj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmcdolbn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gbnobf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phjdggoj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fgenoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hpmhmbko.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qclmmq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjhepnno.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iibclmkn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ihhmaehj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ibegpmah.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jemfbgiq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kpgdjo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kahqbgjp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pcgdbakj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mpghel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hkbddo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Injcginc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ikcmklih.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nobdlqnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ljobiofi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pecefa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hnibhp32.exe - Executes dropped EXE 64 IoCs
pid Process 2152 Gddigk32.exe 2980 Hbhjqp32.exe 2792 Hheoci32.exe 2620 Hnddqp32.exe 2964 Hdpicj32.exe 1200 Ibdiln32.exe 2484 Ihnbih32.exe 1464 Igcojdhp.exe 5920 Ibkpmm32.exe 1736 Ighhed32.exe 2948 Jfkehk32.exe 708 Jkhnab32.exe 1076 Jpffgp32.exe 4868 Jeekeg32.exe 4728 Knpmcl32.exe 2604 Knbiil32.exe 1420 Kelaef32.exe 3304 Khmjga32.exe 2528 Kbbodj32.exe 2112 Kpfonnab.exe 1128 Llpmhodc.exe 5616 Lfeaegdi.exe 1408 Locbpi32.exe 1444 Lemjlcgo.exe 2348 Llgcin32.exe 5496 Mbqkfhfh.exe 2676 Mikcbb32.exe 5584 Moglkikl.exe 1920 Meadgc32.exe 4968 Mpghel32.exe 2896 Medqmb32.exe 2380 Mpiejkql.exe 2024 Mfcmge32.exe 2092 Mlpeol32.exe 6068 Mbjnlfnn.exe 3140 Mhgfdmle.exe 3508 Noaoagca.exe 6028 Nekgna32.exe 1760 Nppkkj32.exe 8 Ngjcgdba.exe 5608 Nlglpkpi.exe 2808 Nbadmege.exe 6108 Nhnlelfm.exe 5160 Nohdaf32.exe 1604 Nebmnqdf.exe 1764 Nedjdp32.exe 4100 Ohebek32.exe 4324 Ogfccchd.exe 4120 Olcklj32.exe 1892 Oekpdoll.exe 4732 Olehai32.exe 6036 Olgdgibf.exe 5320 Ogmidbal.exe 5908 Pohnhdog.exe 4908 Pokjnd32.exe 1844 Pfdbknda.exe 4756 Pgdodq32.exe 6040 Pplcnf32.exe 5508 Ppopcf32.exe 5792 Qqamieno.exe 4128 Qhlamhkj.exe 5016 Qfpbfljd.exe 4772 Aoifoa32.exe 5044 Ajnkmjqj.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Amnlfk32.exe Agdcja32.exe File created C:\Windows\SysWOW64\Bdkaiilp.dll Ikcmklih.exe File created C:\Windows\SysWOW64\Qcbhdmai.dll Klbnjo32.exe File opened for modification C:\Windows\SysWOW64\Aifdcgcp.exe Aqjpod32.exe File created C:\Windows\SysWOW64\Gifcfc32.dll Bfpdcc32.exe File created C:\Windows\SysWOW64\Jebfgl32.exe Jljbogaf.exe File created C:\Windows\SysWOW64\Ncifdlii.exe Nqkihpie.exe File opened for modification C:\Windows\SysWOW64\Ofaeffpa.exe Npgmjl32.exe File opened for modification C:\Windows\SysWOW64\Okedmp32.exe Oehldi32.exe File created C:\Windows\SysWOW64\Gmdgfd32.dll Plpjhk32.exe File opened for modification C:\Windows\SysWOW64\Ebcmjqej.exe Emfebjgb.exe File created C:\Windows\SysWOW64\Amhlpb32.exe Ahkdhk32.exe File opened for modification C:\Windows\SysWOW64\Npgmjl32.exe Nnfpbcbf.exe File created C:\Windows\SysWOW64\Ldkkddha.dll Kpiqpo32.exe File created C:\Windows\SysWOW64\Dgapmp32.dll Mjkipdpg.exe File created C:\Windows\SysWOW64\Ffdidbph.dll Kdmqfi32.exe File opened for modification C:\Windows\SysWOW64\Nclida32.exe Nnpalk32.exe File created C:\Windows\SysWOW64\Fechhcal.exe Fnipliip.exe File opened for modification C:\Windows\SysWOW64\Giaaoa32.exe Gnlmai32.exe File created C:\Windows\SysWOW64\Hecdhgla.dll Ckphamkp.exe File created C:\Windows\SysWOW64\Dkndbkop.exe Dddlfa32.exe File created C:\Windows\SysWOW64\Haceil32.exe Gpaiadel.exe File created C:\Windows\SysWOW64\Mnkmlhab.dll Menimfnd.exe File opened for modification C:\Windows\SysWOW64\Nckkoe32.exe Nmacbk32.exe File opened for modification C:\Windows\SysWOW64\Amcmie32.exe Afjemkbi.exe File opened for modification C:\Windows\SysWOW64\Ffclml32.exe Flngpc32.exe File opened for modification C:\Windows\SysWOW64\Nmighf32.exe Nlhkqngo.exe File opened for modification C:\Windows\SysWOW64\Bllbkg32.exe Bafnmnjn.exe File created C:\Windows\SysWOW64\Ebkolf32.dll Jidpblik.exe File opened for modification C:\Windows\SysWOW64\Pgdodq32.exe Pfdbknda.exe File opened for modification C:\Windows\SysWOW64\Aapeakij.exe Qfkqcb32.exe File created C:\Windows\SysWOW64\Menimfnd.exe Mjhepnno.exe File created C:\Windows\SysWOW64\Mebchf32.exe Mjmokmji.exe File opened for modification C:\Windows\SysWOW64\Hlpfak32.exe Hbhbie32.exe File created C:\Windows\SysWOW64\Geenclkn.exe Gohfkemf.exe File created C:\Windows\SysWOW64\Aaiiffjj.exe Akoqjl32.exe File opened for modification C:\Windows\SysWOW64\Nklbfaae.exe Nacmnlkd.exe File created C:\Windows\SysWOW64\Dkbomgde.exe Dfefeq32.exe File opened for modification C:\Windows\SysWOW64\Nlfnkoia.exe Ncofjaho.exe File created C:\Windows\SysWOW64\Nphabc32.dll Hbjonepq.exe File created C:\Windows\SysWOW64\Jijpnp32.dll Lmodqdpo.exe File opened for modification C:\Windows\SysWOW64\Ikcmklih.exe Iqmincia.exe File created C:\Windows\SysWOW64\Kgenlldo.exe Kqkeoama.exe File created C:\Windows\SysWOW64\Dccpdooi.dll Bicjjncd.exe File opened for modification C:\Windows\SysWOW64\Fbdeba32.exe Fgoadi32.exe File opened for modification C:\Windows\SysWOW64\Aepklffh.exe Qlggcp32.exe File created C:\Windows\SysWOW64\Alpmdo32.dll Aonokdce.exe File opened for modification C:\Windows\SysWOW64\Kphkee32.exe Jebfgl32.exe File opened for modification C:\Windows\SysWOW64\Cgnogmkl.exe Cpdgjc32.exe File opened for modification C:\Windows\SysWOW64\Eqbclagp.exe Eoagdi32.exe File created C:\Windows\SysWOW64\Mkhepqnd.dll Afelal32.exe File created C:\Windows\SysWOW64\Pfqafh32.dll Jgjnpm32.exe File created C:\Windows\SysWOW64\Pcqdkcfn.dll Jcmkehcg.exe File created C:\Windows\SysWOW64\Nhnlilfk.dll Ddbfkh32.exe File created C:\Windows\SysWOW64\Lckicnei.exe Lnnakg32.exe File created C:\Windows\SysWOW64\Mnhdae32.exe Mjjkkghp.exe File created C:\Windows\SysWOW64\Oapljmgm.exe Ofjgmdgg.exe File created C:\Windows\SysWOW64\Gaqhdmmm.exe Gldpkfoe.exe File opened for modification C:\Windows\SysWOW64\Pokjnd32.exe Pohnhdog.exe File created C:\Windows\SysWOW64\Gepkfejp.dll Cihcen32.exe File opened for modification C:\Windows\SysWOW64\Eimegk32.exe Ebcmjqej.exe File opened for modification C:\Windows\SysWOW64\Dbfgdllk.exe Dkmogbeo.exe File created C:\Windows\SysWOW64\Hpmhmbko.exe Hehdpjki.exe File created C:\Windows\SysWOW64\Afelal32.exe Ajnkmjqj.exe - Program crash 1 IoCs
pid pid_target Process procid_target 7056 6392 WerFault.exe 797 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npgmjl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ohebek32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kqkeoama.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lbgaecjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qmccecfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iomood32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjopil32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ighhed32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibhlmgdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ecbjdcml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hbhjqp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ldbjah32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Doanno32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkofpf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfedhihl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihnkobpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmdach32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gihgoq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaqhdmmm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhnaam32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nobldfio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cikgecag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cjlijp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbicjlji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkeajn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgjnpm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pafcjijo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iciaji32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aehghn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ogmidbal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbmoodbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nahgik32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpnfak32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ofjgmdgg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ngjcgdba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lqkgli32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjhepnno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kgacaopj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bdagidhi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jaonlhbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oifpijea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdbheajp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmafpchb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hekgppma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opiipkfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Galcjkmj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oldagc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cilmpmki.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljaooodf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eodjdocj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hnibhp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mohingqi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bcddlhgo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjjnblhi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jcphkhad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qoboofnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hmhmko32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjnnkpqo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lfeaegdi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfefeq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mekmgg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bemqcngl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bafnmnjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Igajka32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Olgdgibf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmaejnbe.dll" Medqmb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nhnlelfm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ipcomo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcdfggmg.dll" Aecnmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fieacc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iomood32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldpqel32.dll" Lckicnei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fgldoi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iphihnjk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icabjacn.dll" Ngehoqdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eenfff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idgfkahe.dll" Mbqkfhfh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Boeelcmm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hnlgekkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ankfplap.dll" Geohdago.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mqhmbqlh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pnmojp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Paihffkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bljncj32.dll" Lqkgli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hoellb32.dll" Boeelcmm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iemdep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pceife32.dll" Mjjkkghp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 2026-07-20_717ced8b88c3c062e5cb414a7b650991_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pngfap32.dll" Kakmhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ofeggo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ogfccchd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Amcmie32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jbmehf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nobdlqnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oefpoi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gnlmai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hpdlajfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jdbheajp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aeadmn32.dll" Chdikajj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmelgi32.dll" Ajdjcc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ohebek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmbobi32.dll" Ajnkmjqj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdnklomi.dll" Hnlgekkc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Blhpjnbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppmmcbgi.dll" Cncnhh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olnedl32.dll" 2026-07-20_717ced8b88c3c062e5cb414a7b650991_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kolnpglb.dll" Bgeabloo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lbngfbdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghcnel32.dll" Bocoqj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kjeiij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mjjkkghp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oginofdg.dll" Mjdkeaij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nhkief32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gpqjaanf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Agbgda32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Foaoie32.dll" Gnppbapl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjbfio32.dll" Hngebq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nobldfio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nohdaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dejnbf32.dll" Ihbdja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibhjkk32.dll" Jjopmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddfmipco.dll" Cfkmdl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pjopil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ngehoqdn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Chbcphph.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Njekfenc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nekgna32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eipigqop.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5948 wrote to memory of 2152 5948 2026-07-20_717ced8b88c3c062e5cb414a7b650991_elex_wannacry.exe 89 PID 2152 wrote to memory of 2980 2152 Gddigk32.exe 90 PID 2980 wrote to memory of 2792 2980 Hbhjqp32.exe 91 PID 2792 wrote to memory of 2620 2792 Hheoci32.exe 92 PID 2620 wrote to memory of 2964 2620 Hnddqp32.exe 93 PID 2964 wrote to memory of 1200 2964 Hdpicj32.exe 94 PID 1200 wrote to memory of 2484 1200 Ibdiln32.exe 95 PID 2484 wrote to memory of 1464 2484 Ihnbih32.exe 96 PID 1464 wrote to memory of 5920 1464 Igcojdhp.exe 97 PID 5920 wrote to memory of 1736 5920 Ibkpmm32.exe 98 PID 1736 wrote to memory of 2948 1736 Ighhed32.exe 99 PID 2948 wrote to memory of 708 2948 Jfkehk32.exe 100 PID 708 wrote to memory of 1076 708 Jkhnab32.exe 101 PID 1076 wrote to memory of 4868 1076 Jpffgp32.exe 102 PID 4868 wrote to memory of 4728 4868 Jeekeg32.exe 103 PID 4728 wrote to memory of 2604 4728 Knpmcl32.exe 104 PID 2604 wrote to memory of 1420 2604 Knbiil32.exe 105 PID 1420 wrote to memory of 3304 1420 Kelaef32.exe 106 PID 3304 wrote to memory of 2528 3304 Khmjga32.exe 107 PID 2528 wrote to memory of 2112 2528 Kbbodj32.exe 108 PID 2112 wrote to memory of 1128 2112 Kpfonnab.exe 109 PID 1128 wrote to memory of 5616 1128 Llpmhodc.exe 110 PID 5616 wrote to memory of 1408 5616 Lfeaegdi.exe 111 PID 1408 wrote to memory of 1444 1408 Locbpi32.exe 112 PID 1444 wrote to memory of 2348 1444 Lemjlcgo.exe 113 PID 2348 wrote to memory of 5496 2348 Llgcin32.exe 114 PID 5496 wrote to memory of 2676 5496 Mbqkfhfh.exe 115 PID 2676 wrote to memory of 5584 2676 Mikcbb32.exe 116 PID 5584 wrote to memory of 1920 5584 Moglkikl.exe 117 PID 1920 wrote to memory of 4968 1920 Meadgc32.exe 118 PID 4968 wrote to memory of 2896 4968 Mpghel32.exe 119 PID 2896 wrote to memory of 2380 2896 Medqmb32.exe 120 PID 2380 wrote to memory of 2024 2380 Mpiejkql.exe 121 PID 2024 wrote to memory of 2092 2024 Mfcmge32.exe 122 PID 2092 wrote to memory of 6068 2092 Mlpeol32.exe 123 PID 6068 wrote to memory of 3140 6068 Mbjnlfnn.exe 124 PID 3140 wrote to memory of 3508 3140 Mhgfdmle.exe 125 PID 3508 wrote to memory of 6028 3508 Noaoagca.exe 126 PID 6028 wrote to memory of 1760 6028 Nekgna32.exe 127 PID 1760 wrote to memory of 8 1760 Nppkkj32.exe 128 PID 8 wrote to memory of 5608 8 Ngjcgdba.exe 129 PID 5608 wrote to memory of 2808 5608 Nlglpkpi.exe 130 PID 2808 wrote to memory of 6108 2808 Nbadmege.exe 131 PID 6108 wrote to memory of 5160 6108 Nhnlelfm.exe 132 PID 5160 wrote to memory of 1604 5160 Nohdaf32.exe 133 PID 1604 wrote to memory of 1764 1604 Nebmnqdf.exe 134 PID 1764 wrote to memory of 4100 1764 Nedjdp32.exe 135 PID 4100 wrote to memory of 4324 4100 Ohebek32.exe 136 PID 4324 wrote to memory of 4120 4324 Ogfccchd.exe 137 PID 4120 wrote to memory of 1892 4120 Olcklj32.exe 138 PID 1892 wrote to memory of 4732 1892 Oekpdoll.exe 139 PID 4732 wrote to memory of 6036 4732 Olehai32.exe 140 PID 6036 wrote to memory of 5320 6036 Olgdgibf.exe 141 PID 5320 wrote to memory of 5908 5320 Ogmidbal.exe 142 PID 5908 wrote to memory of 4908 5908 Pohnhdog.exe 143 PID 4908 wrote to memory of 1844 4908 Pokjnd32.exe 144 PID 1844 wrote to memory of 4756 1844 Pfdbknda.exe 145 PID 4756 wrote to memory of 6040 4756 Pgdodq32.exe 146 PID 6040 wrote to memory of 5508 6040 Pplcnf32.exe 147 PID 5508 wrote to memory of 5792 5508 Ppopcf32.exe 148 PID 5792 wrote to memory of 4128 5792 Qqamieno.exe 149 PID 4128 wrote to memory of 5016 4128 Qhlamhkj.exe 150 PID 5016 wrote to memory of 4772 5016 Qfpbfljd.exe 151 PID 4772 wrote to memory of 5044 4772 Aoifoa32.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_717ced8b88c3c062e5cb414a7b650991_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_717ced8b88c3c062e5cb414a7b650991_elex_wannacry.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\SysWOW64\Gddigk32.exeC:\Windows\system32\Gddigk32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\Hbhjqp32.exeC:\Windows\system32\Hbhjqp32.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\Hheoci32.exeC:\Windows\system32\Hheoci32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\Hnddqp32.exeC:\Windows\system32\Hnddqp32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\Hdpicj32.exeC:\Windows\system32\Hdpicj32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\Ibdiln32.exeC:\Windows\system32\Ibdiln32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\Ihnbih32.exeC:\Windows\system32\Ihnbih32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\Igcojdhp.exeC:\Windows\system32\Igcojdhp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\Ibkpmm32.exeC:\Windows\system32\Ibkpmm32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Windows\SysWOW64\Ighhed32.exeC:\Windows\system32\Ighhed32.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\Jfkehk32.exeC:\Windows\system32\Jfkehk32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\Jkhnab32.exeC:\Windows\system32\Jkhnab32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\Jpffgp32.exeC:\Windows\system32\Jpffgp32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\Jeekeg32.exeC:\Windows\system32\Jeekeg32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\Knpmcl32.exeC:\Windows\system32\Knpmcl32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\Knbiil32.exeC:\Windows\system32\Knbiil32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\Kelaef32.exeC:\Windows\system32\Kelaef32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\Khmjga32.exeC:\Windows\system32\Khmjga32.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\Kbbodj32.exeC:\Windows\system32\Kbbodj32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\Kpfonnab.exeC:\Windows\system32\Kpfonnab.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\Llpmhodc.exeC:\Windows\system32\Llpmhodc.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\Lfeaegdi.exeC:\Windows\system32\Lfeaegdi.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\SysWOW64\Locbpi32.exeC:\Windows\system32\Locbpi32.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\Lemjlcgo.exeC:\Windows\system32\Lemjlcgo.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\Llgcin32.exeC:\Windows\system32\Llgcin32.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\Mbqkfhfh.exeC:\Windows\system32\Mbqkfhfh.exe27⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Windows\SysWOW64\Mikcbb32.exeC:\Windows\system32\Mikcbb32.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\Moglkikl.exeC:\Windows\system32\Moglkikl.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\Meadgc32.exeC:\Windows\system32\Meadgc32.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\Mpghel32.exeC:\Windows\system32\Mpghel32.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\Medqmb32.exeC:\Windows\system32\Medqmb32.exe32⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\Mpiejkql.exeC:\Windows\system32\Mpiejkql.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\Mfcmge32.exeC:\Windows\system32\Mfcmge32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\Mlpeol32.exeC:\Windows\system32\Mlpeol32.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\Mbjnlfnn.exeC:\Windows\system32\Mbjnlfnn.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Windows\SysWOW64\Mhgfdmle.exeC:\Windows\system32\Mhgfdmle.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\Noaoagca.exeC:\Windows\system32\Noaoagca.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\Nekgna32.exeC:\Windows\system32\Nekgna32.exe39⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\Nppkkj32.exeC:\Windows\system32\Nppkkj32.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\Ngjcgdba.exeC:\Windows\system32\Ngjcgdba.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\Nlglpkpi.exeC:\Windows\system32\Nlglpkpi.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Windows\SysWOW64\Nbadmege.exeC:\Windows\system32\Nbadmege.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\Nhnlelfm.exeC:\Windows\system32\Nhnlelfm.exe44⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\Nohdaf32.exeC:\Windows\system32\Nohdaf32.exe45⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\SysWOW64\Nebmnqdf.exeC:\Windows\system32\Nebmnqdf.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\Nedjdp32.exeC:\Windows\system32\Nedjdp32.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\Ohebek32.exeC:\Windows\system32\Ohebek32.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\Ogfccchd.exeC:\Windows\system32\Ogfccchd.exe49⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\Olcklj32.exeC:\Windows\system32\Olcklj32.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\Oekpdoll.exeC:\Windows\system32\Oekpdoll.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\Olehai32.exeC:\Windows\system32\Olehai32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\Olgdgibf.exeC:\Windows\system32\Olgdgibf.exe53⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\Ogmidbal.exeC:\Windows\system32\Ogmidbal.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Windows\SysWOW64\Pohnhdog.exeC:\Windows\system32\Pohnhdog.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Windows\SysWOW64\Pokjnd32.exeC:\Windows\system32\Pokjnd32.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\Pfdbknda.exeC:\Windows\system32\Pfdbknda.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\Pgdodq32.exeC:\Windows\system32\Pgdodq32.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\Pplcnf32.exeC:\Windows\system32\Pplcnf32.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Windows\SysWOW64\Ppopcf32.exeC:\Windows\system32\Ppopcf32.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\SysWOW64\Qqamieno.exeC:\Windows\system32\Qqamieno.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\Qhlamhkj.exeC:\Windows\system32\Qhlamhkj.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\Qfpbfljd.exeC:\Windows\system32\Qfpbfljd.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\Aoifoa32.exeC:\Windows\system32\Aoifoa32.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\Ajnkmjqj.exeC:\Windows\system32\Ajnkmjqj.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:5044 -
C:\Windows\SysWOW64\Afelal32.exeC:\Windows\system32\Afelal32.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3044 -
C:\Windows\SysWOW64\Aqjpod32.exeC:\Windows\system32\Aqjpod32.exe67⤵
- Drops file in System32 directory
PID:4540 -
C:\Windows\SysWOW64\Aifdcgcp.exeC:\Windows\system32\Aifdcgcp.exe68⤵PID:4116
-
C:\Windows\SysWOW64\Afjemkbi.exeC:\Windows\system32\Afjemkbi.exe69⤵
- Drops file in System32 directory
PID:1320 -
C:\Windows\SysWOW64\Amcmie32.exeC:\Windows\system32\Amcmie32.exe70⤵
- Modifies registry class
PID:1944 -
C:\Windows\SysWOW64\Bijnnf32.exeC:\Windows\system32\Bijnnf32.exe71⤵PID:4760
-
C:\Windows\SysWOW64\Bfnnhj32.exeC:\Windows\system32\Bfnnhj32.exe72⤵PID:5476
-
C:\Windows\SysWOW64\Bfqkmj32.exeC:\Windows\system32\Bfqkmj32.exe73⤵PID:5040
-
C:\Windows\SysWOW64\Bqfokblg.exeC:\Windows\system32\Bqfokblg.exe74⤵PID:1508
-
C:\Windows\SysWOW64\Bcdlgnkk.exeC:\Windows\system32\Bcdlgnkk.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2468 -
C:\Windows\SysWOW64\Bqhlpbjd.exeC:\Windows\system32\Bqhlpbjd.exe76⤵PID:2352
-
C:\Windows\SysWOW64\Bfedhihl.exeC:\Windows\system32\Bfedhihl.exe77⤵
- System Location Discovery: System Language Discovery
PID:4084 -
C:\Windows\SysWOW64\Bgeabloo.exeC:\Windows\system32\Bgeabloo.exe78⤵
- Modifies registry class
PID:3816 -
C:\Windows\SysWOW64\Cggnhlml.exeC:\Windows\system32\Cggnhlml.exe79⤵PID:2900
-
C:\Windows\SysWOW64\Ccnnmmbp.exeC:\Windows\system32\Ccnnmmbp.exe80⤵PID:3244
-
C:\Windows\SysWOW64\Cikgecag.exeC:\Windows\system32\Cikgecag.exe81⤵
- System Location Discovery: System Language Discovery
PID:3196 -
C:\Windows\SysWOW64\Cadllq32.exeC:\Windows\system32\Cadllq32.exe82⤵PID:5996
-
C:\Windows\SysWOW64\Cafhap32.exeC:\Windows\system32\Cafhap32.exe83⤵PID:596
-
C:\Windows\SysWOW64\Dfcqjg32.exeC:\Windows\system32\Dfcqjg32.exe84⤵PID:3216
-
C:\Windows\SysWOW64\Dffmogji.exeC:\Windows\system32\Dffmogji.exe85⤵PID:5928
-
C:\Windows\SysWOW64\Djcfee32.exeC:\Windows\system32\Djcfee32.exe86⤵PID:3192
-
C:\Windows\SysWOW64\Dfjgjf32.exeC:\Windows\system32\Dfjgjf32.exe87⤵PID:1828
-
C:\Windows\SysWOW64\Dhjcdimf.exeC:\Windows\system32\Dhjcdimf.exe88⤵PID:3360
-
C:\Windows\SysWOW64\Emihbp32.exeC:\Windows\system32\Emihbp32.exe89⤵PID:2088
-
C:\Windows\SysWOW64\Edcqojqh.exeC:\Windows\system32\Edcqojqh.exe90⤵PID:3844
-
C:\Windows\SysWOW64\Eipigqop.exeC:\Windows\system32\Eipigqop.exe91⤵
- Modifies registry class
PID:200 -
C:\Windows\SysWOW64\Efdjqeni.exeC:\Windows\system32\Efdjqeni.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2744 -
C:\Windows\SysWOW64\Emnbmoef.exeC:\Windows\system32\Emnbmoef.exe93⤵PID:3604
-
C:\Windows\SysWOW64\Edhjji32.exeC:\Windows\system32\Edhjji32.exe94⤵PID:3412
-
C:\Windows\SysWOW64\Ealkcm32.exeC:\Windows\system32\Ealkcm32.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4812 -
C:\Windows\SysWOW64\Ehecpgbi.exeC:\Windows\system32\Ehecpgbi.exe96⤵PID:4268
-
C:\Windows\SysWOW64\Embkhn32.exeC:\Windows\system32\Embkhn32.exe97⤵PID:3756
-
C:\Windows\SysWOW64\Fkflbb32.exeC:\Windows\system32\Fkflbb32.exe98⤵PID:1124
-
C:\Windows\SysWOW64\Fkihgb32.exeC:\Windows\system32\Fkihgb32.exe99⤵PID:424
-
C:\Windows\SysWOW64\Fpeapilo.exeC:\Windows\system32\Fpeapilo.exe100⤵PID:2848
-
C:\Windows\SysWOW64\Fhofffjo.exeC:\Windows\system32\Fhofffjo.exe101⤵PID:2120
-
C:\Windows\SysWOW64\Fmlnomif.exeC:\Windows\system32\Fmlnomif.exe102⤵PID:1696
-
C:\Windows\SysWOW64\Fhablf32.exeC:\Windows\system32\Fhablf32.exe103⤵PID:5196
-
C:\Windows\SysWOW64\Fajgekol.exeC:\Windows\system32\Fajgekol.exe104⤵PID:5960
-
C:\Windows\SysWOW64\Gkbkna32.exeC:\Windows\system32\Gkbkna32.exe105⤵PID:5060
-
C:\Windows\SysWOW64\Galcjkmj.exeC:\Windows\system32\Galcjkmj.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:4224 -
C:\Windows\SysWOW64\Ggilbb32.exeC:\Windows\system32\Ggilbb32.exe107⤵PID:1740
-
C:\Windows\SysWOW64\Gmcdolbn.exeC:\Windows\system32\Gmcdolbn.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2584 -
C:\Windows\SysWOW64\Ggkiha32.exeC:\Windows\system32\Ggkiha32.exe109⤵PID:1336
-
C:\Windows\SysWOW64\Gaqmej32.exeC:\Windows\system32\Gaqmej32.exe110⤵PID:4480
-
C:\Windows\SysWOW64\Ghkebd32.exeC:\Windows\system32\Ghkebd32.exe111⤵PID:3364
-
C:\Windows\SysWOW64\Gilajmfp.exeC:\Windows\system32\Gilajmfp.exe112⤵PID:1432
-
C:\Windows\SysWOW64\Ggpbcaei.exeC:\Windows\system32\Ggpbcaei.exe113⤵PID:6052
-
C:\Windows\SysWOW64\Haefqjeo.exeC:\Windows\system32\Haefqjeo.exe114⤵PID:1848
-
C:\Windows\SysWOW64\Hhoomd32.exeC:\Windows\system32\Hhoomd32.exe115⤵PID:1328
-
C:\Windows\SysWOW64\Hnlgekkc.exeC:\Windows\system32\Hnlgekkc.exe116⤵
- Modifies registry class
PID:5776 -
C:\Windows\SysWOW64\Hhbkccji.exeC:\Windows\system32\Hhbkccji.exe117⤵PID:6048
-
C:\Windows\SysWOW64\Hjchjl32.exeC:\Windows\system32\Hjchjl32.exe118⤵PID:828
-
C:\Windows\SysWOW64\Hpmpgfhd.exeC:\Windows\system32\Hpmpgfhd.exe119⤵PID:2644
-
C:\Windows\SysWOW64\Hkbddo32.exeC:\Windows\system32\Hkbddo32.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4984 -
C:\Windows\SysWOW64\Hdkimdnk.exeC:\Windows\system32\Hdkimdnk.exe121⤵PID:4348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-