Analysis
- max time kernel
56s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 00:34
Behavioral task
behavioral1
Sample
2026-07-28_adfd4eeefeca4e3f4c98356235880290_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_adfd4eeefeca4e3f4c98356235880290_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-28_adfd4eeefeca4e3f4c98356235880290_elex_wannacry.exe
- Size 320KB
- Sample260729-aw2xesstes
- SHA256 db84dd37a76e810a3c55322e0e78e7005f44f53640a3e9ade90bcd98a50a3a1b
- MD5 adfd4eeefeca4e3f4c98356235880290
- SHA1 4d0bfab266c72b214e11abc43821b2d2589937dd
- SHA512 44a5b7f450aa58767072f316e86933c7a3604505ffeaa97889d11819c49e2f113dbca373e98d30f2bbbbc84afe1e4ab227152de630dab3631fba5f377214b821
- SSDEEP 3072:P/oapdyFHZn/nTkaXhrwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:P/oapAFNnTdRrV/Ah1G/AcQ///NR5fn
- TLSH T10264311A2A3009EACEED1FB5AC1259D89141E9F114F1E13EA523DFDCC8E4DA6DC19F81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ehgqed32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jeqbjgoo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jpffgp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pgfljqia.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qleahgff.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpgqik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fbnhjn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qofjjb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Akamol32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hedaoa32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Imbpam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jefbomoe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gnhdea32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hahcfi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgjnpm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Menpgmap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dmjole32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Delnbdao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ighhed32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lnnidjcg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Edemdine.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ddngdj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lagekp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Anbkbe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipmjkh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fjfegl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phmhgmpc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckjbbbga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fblifijc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ddklnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fohobmke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jpkfmfok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gmqgjl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Miabik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nobdlqnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qemhlp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ahpmckpn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmaihekc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ikjapden.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iaaflh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jdbheajp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bncllqhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fhkcfmbp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkfakb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oifekg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cpihmmdo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pedlpgqe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfigib32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efhlan32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dbdjol32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gldgflba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Naaejj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ifbbbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ebcmjqej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bhnidi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lnepbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cipppc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Peahpa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pcijoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qdpmij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kppimogj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lpilcnoo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Miomnaip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Plokgh32.exe - Executes dropped EXE 64 IoCs
pid Process 6064 Oijqbh32.exe 5236 Oaeegjeb.exe 4856 Ophbja32.exe 5112 Plocob32.exe 2452 Ppmleagi.exe 2912 Phkmoc32.exe 3528 Pbpall32.exe 3376 Plifea32.exe 1548 Qajhigcj.exe 5624 Abqjci32.exe 1192 Bimoecio.exe 4152 Bbecnipp.exe 1132 Bajqpe32.exe 252 Bbjmih32.exe 3716 Bppjhl32.exe 3908 Ceppfbef.exe 3588 Cpedckdl.exe 4480 Cpgqik32.exe 5432 Clqncl32.exe 4404 Damflb32.exe 4432 Dpnfjjla.exe 3932 Djihhoao.exe 476 Dohmff32.exe 1308 Djnaco32.exe 616 Ejbknnid.exe 5708 Ehhgpj32.exe 1812 Eqalfgll.exe 5224 Ehlakjig.exe 5896 Fcbehbim.exe 1268 Ffbnin32.exe 3964 Fcikhace.exe 2408 Fifdqhal.exe 2008 Fbnhjn32.exe 3208 Godehbed.exe 4176 Gjlfkj32.exe 5316 Gbgkpm32.exe 4372 Gbjhelnp.exe 1844 Hpnhoqmi.exe 744 Hmaihekc.exe 2704 Hihimfag.exe 4680 Hmfbcd32.exe 2404 Hfoflj32.exe 1144 Hfacai32.exe 812 Ibhdgjap.exe 5136 Immhdc32.exe 5972 Iffmmihf.exe 2244 Idjmfmgp.exe 5476 Ibojgikg.exe 2764 Ibagmiie.exe 1364 Jabgkpad.exe 4608 Jmihpa32.exe 3960 Jagqfp32.exe 4128 Jaimko32.exe 5400 Jmpnppap.exe 8 Kfhbifgq.exe 5388 Kgkooeen.exe 4140 Kkihedld.exe 1464 Kgphje32.exe 4188 Kdcicipb.exe 4280 Kmlmlo32.exe 3696 Lajfbmmi.exe 572 Lalchm32.exe 3092 Lkdgqbag.exe 4900 Lcpledob.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Jmpnppap.exe Jaimko32.exe File created C:\Windows\SysWOW64\Aecloegl.dll Doqpkq32.exe File opened for modification C:\Windows\SysWOW64\Nhmejf32.exe Nacmnlkd.exe File opened for modification C:\Windows\SysWOW64\Oboicmhj.exe Oifekg32.exe File created C:\Windows\SysWOW64\Dldlbgbb.exe Djcoko32.exe File opened for modification C:\Windows\SysWOW64\Fbhplnca.exe Flngpc32.exe File created C:\Windows\SysWOW64\Lnadkmhj.exe Lclpmdhd.exe File opened for modification C:\Windows\SysWOW64\Dhgfoioi.exe Dpqonl32.exe File opened for modification C:\Windows\SysWOW64\Edemdine.exe Emkeho32.exe File opened for modification C:\Windows\SysWOW64\Ojpdgjid.exe Oagpne32.exe File opened for modification C:\Windows\SysWOW64\Ahpmckpn.exe Aafefq32.exe File created C:\Windows\SysWOW64\Ckhelb32.exe Cfkmdl32.exe File created C:\Windows\SysWOW64\Dkfanqmd.exe Dnbadlnj.exe File created C:\Windows\SysWOW64\Bekfcj32.dll Acmfel32.exe File created C:\Windows\SysWOW64\Iihkjm32.exe Ibncmchl.exe File created C:\Windows\SysWOW64\Mhjpnibf.exe Lbngfbdo.exe File created C:\Windows\SysWOW64\Eoollocp.exe Edihof32.exe File created C:\Windows\SysWOW64\Jdgjbd32.dll Inpclnnj.exe File created C:\Windows\SysWOW64\Mlpeol32.exe Mfcmge32.exe File opened for modification C:\Windows\SysWOW64\Gdjpff32.exe Gmqgjl32.exe File opened for modification C:\Windows\SysWOW64\Plpqba32.exe Pakleh32.exe File created C:\Windows\SysWOW64\Cfldob32.exe Ckfpai32.exe File opened for modification C:\Windows\SysWOW64\Jabgkpad.exe Ibagmiie.exe File created C:\Windows\SysWOW64\Dfiaomkb.exe Dalhgfmk.exe File opened for modification C:\Windows\SysWOW64\Ohdlke32.exe Obgccn32.exe File opened for modification C:\Windows\SysWOW64\Jimeelkc.exe Jcplle32.exe File created C:\Windows\SysWOW64\Nphhfp32.exe Ncdgmkio.exe File created C:\Windows\SysWOW64\Egdnmbif.dll Ohkbldfa.exe File opened for modification C:\Windows\SysWOW64\Plkpmlfi.exe Peahpa32.exe File created C:\Windows\SysWOW64\Hmfbcd32.exe Hihimfag.exe File created C:\Windows\SysWOW64\Lhdphl32.dll Afhoaahg.exe File created C:\Windows\SysWOW64\Idknol32.dll Nlcaeo32.exe File opened for modification C:\Windows\SysWOW64\Kdnincal.exe Kihdqkaf.exe File created C:\Windows\SysWOW64\Lehhhj32.dll Ldeonbkd.exe File created C:\Windows\SysWOW64\Hpmpgfhd.exe Hjchjl32.exe File created C:\Windows\SysWOW64\Mqdggnfj.dll Cpedckdl.exe File created C:\Windows\SysWOW64\Clolpq32.dll Megdmhbp.exe File created C:\Windows\SysWOW64\Fcleopbe.dll Ghgbakhb.exe File opened for modification C:\Windows\SysWOW64\Bgpggm32.exe Bfqkmj32.exe File created C:\Windows\SysWOW64\Mdpmkhmc.dll Bpniaool.exe File created C:\Windows\SysWOW64\Bqdbec32.exe Bcpblo32.exe File opened for modification C:\Windows\SysWOW64\Lbgaecjg.exe Lkmihi32.exe File created C:\Windows\SysWOW64\Polpim32.exe Pedlpgqe.exe File opened for modification C:\Windows\SysWOW64\Aljcip32.exe Aadokg32.exe File opened for modification C:\Windows\SysWOW64\Abqjci32.exe Qajhigcj.exe File created C:\Windows\SysWOW64\Goconkah.exe Gdnjabab.exe File created C:\Windows\SysWOW64\Nacdac32.dll Delnbdao.exe File opened for modification C:\Windows\SysWOW64\Okedmp32.exe Oidhehcl.exe File opened for modification C:\Windows\SysWOW64\Fjfegl32.exe Fldeie32.exe File opened for modification C:\Windows\SysWOW64\Plifea32.exe Pbpall32.exe File opened for modification C:\Windows\SysWOW64\Ogqcon32.exe Onfbpi32.exe File opened for modification C:\Windows\SysWOW64\Agcikk32.exe Ankdbf32.exe File created C:\Windows\SysWOW64\Kkfnlack.dll Cfonin32.exe File opened for modification C:\Windows\SysWOW64\Ckhelb32.exe Cfkmdl32.exe File created C:\Windows\SysWOW64\Iecbdhad.dll Eenfff32.exe File created C:\Windows\SysWOW64\Bmiaacma.dll Mlpeol32.exe File opened for modification C:\Windows\SysWOW64\Ghkebd32.exe Gkgeipah.exe File created C:\Windows\SysWOW64\Gngnjk32.exe Ghkebd32.exe File created C:\Windows\SysWOW64\Hakdcjep.dll Pakleh32.exe File created C:\Windows\SysWOW64\Oijqbh32.exe 2026-07-28_adfd4eeefeca4e3f4c98356235880290_elex_wannacry.exe File created C:\Windows\SysWOW64\Ogknhjcn.dll Oijqbh32.exe File opened for modification C:\Windows\SysWOW64\Pnlafaio.exe Pcgmiiii.exe File opened for modification C:\Windows\SysWOW64\Afhoaahg.exe Ajanmqbc.exe File opened for modification C:\Windows\SysWOW64\Pgfljqia.exe Phekliab.exe - Program crash 1 IoCs
pid pid_target Process procid_target 15872 15764 Process not Found 1620 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nblcgpho.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lalchm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hckjjh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emllbe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdmmlf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ipflcnln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbdjol32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jcplle32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jefbomoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlpeol32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Acmfel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Deoabj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mfcmge32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cpihmmdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdbheajp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jklpakam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bjlpcbqo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmpdbh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hmaihekc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkfakb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nohdaf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djcfee32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhmejf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfldob32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlcaeo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pacojc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dohmff32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ldeonbkd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epndddnk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qlbfnk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fppjpmim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djnaco32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qdpmij32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kijjldkh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Niklip32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ccbhhl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aolbedeh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bnfiapfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhidcffq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mbqkfhfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgnqafgk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnhadnpe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eqalfgll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cagolf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlkldmjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qfpbfljd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hplimpdi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aafefq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qajhigcj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ankdbf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ipmjkh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfqkmj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkdhcqcj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oifekg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkdcffci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mgoboake.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dkifkkpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opqdbhlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aompjamo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Abmbaf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbikdbnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhgcdjje.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbjmih32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kgphje32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mbqkfhfh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdmile32.dll" Oidhehcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cenaaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apohdjda.dll" Lhbdbpnm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cajblmci.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fhkcfmbp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhdkih32.dll" Jiageecb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lklbnb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Plkpmlfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iiofhm32.dll" Homadjin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jcplle32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Higjkehf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcqeiilk.dll" Ibncmchl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pnlafaio.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pkngco32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oednclpf.dll" Fpggkbfq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kejepfgd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cjejdglp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jledol32.dll" Gkdhcqcj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nkieab32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jabgkpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cdfbbhdp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oodnao32.dll" Iihkjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kblpnall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Njlcdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhqind32.dll" Ceqngekl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Feoomd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ankfplap.dll" Gflhie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdhmhona.dll" Hihimfag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qiokkook.dll" Nphhfp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ghgbakhb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdgjbd32.dll" Inpclnnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mhgfdmle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihdhon32.dll" Cfigib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gplpfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmiaacma.dll" Mlpeol32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lalnfooo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lqdakjak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hljhbd32.dll" Bhpfjh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mgggaamn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ggpbcaei.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qifnaecf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Codhgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmganc32.dll" Fppjpmim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oboakhmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dkmebh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nnfgmjfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Headjael.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gbgkpm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Didjlnjc.dll" Iifodmak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khfchg32.dll" Fineho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cfldob32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Omnqcfig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ndmepe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bbgiibja.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mekmgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pdhbgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhigoqni.dll" Pfcmpdjp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lankloml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpaigg32.dll" Qmkanmel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhcjmnhi.dll" Nhicjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhpljd32.dll" Dmooak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Chepehne.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Clqncl32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 6064 2336 2026-07-28_adfd4eeefeca4e3f4c98356235880290_elex_wannacry.exe 89 PID 6064 wrote to memory of 5236 6064 Oijqbh32.exe 90 PID 5236 wrote to memory of 4856 5236 Oaeegjeb.exe 91 PID 4856 wrote to memory of 5112 4856 Ophbja32.exe 92 PID 5112 wrote to memory of 2452 5112 Plocob32.exe 93 PID 2452 wrote to memory of 2912 2452 Ppmleagi.exe 94 PID 2912 wrote to memory of 3528 2912 Phkmoc32.exe 95 PID 3528 wrote to memory of 3376 3528 Pbpall32.exe 96 PID 3376 wrote to memory of 1548 3376 Plifea32.exe 97 PID 1548 wrote to memory of 5624 1548 Qajhigcj.exe 98 PID 5624 wrote to memory of 1192 5624 Abqjci32.exe 99 PID 1192 wrote to memory of 4152 1192 Bimoecio.exe 100 PID 4152 wrote to memory of 1132 4152 Bbecnipp.exe 101 PID 1132 wrote to memory of 252 1132 Bajqpe32.exe 102 PID 252 wrote to memory of 3716 252 Bbjmih32.exe 103 PID 3716 wrote to memory of 3908 3716 Bppjhl32.exe 104 PID 3908 wrote to memory of 3588 3908 Ceppfbef.exe 105 PID 3588 wrote to memory of 4480 3588 Cpedckdl.exe 106 PID 4480 wrote to memory of 5432 4480 Cpgqik32.exe 107 PID 5432 wrote to memory of 4404 5432 Clqncl32.exe 108 PID 4404 wrote to memory of 4432 4404 Damflb32.exe 109 PID 4432 wrote to memory of 3932 4432 Dpnfjjla.exe 110 PID 3932 wrote to memory of 476 3932 Djihhoao.exe 111 PID 476 wrote to memory of 1308 476 Dohmff32.exe 112 PID 1308 wrote to memory of 616 1308 Djnaco32.exe 113 PID 616 wrote to memory of 5708 616 Ejbknnid.exe 114 PID 5708 wrote to memory of 1812 5708 Ehhgpj32.exe 115 PID 1812 wrote to memory of 5224 1812 Eqalfgll.exe 116 PID 5224 wrote to memory of 5896 5224 Ehlakjig.exe 117 PID 5896 wrote to memory of 1268 5896 Fcbehbim.exe 118 PID 1268 wrote to memory of 3964 1268 Ffbnin32.exe 119 PID 3964 wrote to memory of 2408 3964 Fcikhace.exe 120 PID 2408 wrote to memory of 2008 2408 Fifdqhal.exe 121 PID 2008 wrote to memory of 3208 2008 Fbnhjn32.exe 122 PID 3208 wrote to memory of 4176 3208 Godehbed.exe 123 PID 4176 wrote to memory of 5316 4176 Gjlfkj32.exe 124 PID 5316 wrote to memory of 4372 5316 Gbgkpm32.exe 125 PID 4372 wrote to memory of 1844 4372 Gbjhelnp.exe 126 PID 1844 wrote to memory of 744 1844 Hpnhoqmi.exe 127 PID 744 wrote to memory of 2704 744 Hmaihekc.exe 128 PID 2704 wrote to memory of 4680 2704 Hihimfag.exe 129 PID 4680 wrote to memory of 2404 4680 Hmfbcd32.exe 130 PID 2404 wrote to memory of 1144 2404 Hfoflj32.exe 131 PID 1144 wrote to memory of 812 1144 Hfacai32.exe 132 PID 812 wrote to memory of 5136 812 Ibhdgjap.exe 133 PID 5136 wrote to memory of 5972 5136 Immhdc32.exe 134 PID 5972 wrote to memory of 2244 5972 Iffmmihf.exe 135 PID 2244 wrote to memory of 5476 2244 Idjmfmgp.exe 136 PID 5476 wrote to memory of 2764 5476 Ibojgikg.exe 137 PID 2764 wrote to memory of 1364 2764 Ibagmiie.exe 138 PID 1364 wrote to memory of 4608 1364 Jabgkpad.exe 139 PID 4608 wrote to memory of 3960 4608 Jmihpa32.exe 140 PID 3960 wrote to memory of 4128 3960 Jagqfp32.exe 141 PID 4128 wrote to memory of 5400 4128 Jaimko32.exe 142 PID 5400 wrote to memory of 8 5400 Jmpnppap.exe 143 PID 8 wrote to memory of 5388 8 Kfhbifgq.exe 144 PID 5388 wrote to memory of 4140 5388 Kgkooeen.exe 145 PID 4140 wrote to memory of 1464 4140 Kkihedld.exe 146 PID 1464 wrote to memory of 4188 1464 Kgphje32.exe 147 PID 4188 wrote to memory of 4280 4188 Kdcicipb.exe 148 PID 4280 wrote to memory of 3696 4280 Kmlmlo32.exe 149 PID 3696 wrote to memory of 572 3696 Lajfbmmi.exe 150 PID 572 wrote to memory of 3092 572 Lalchm32.exe 151 PID 3092 wrote to memory of 4900 3092 Lkdgqbag.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_adfd4eeefeca4e3f4c98356235880290_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_adfd4eeefeca4e3f4c98356235880290_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\Oijqbh32.exeC:\Windows\system32\Oijqbh32.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\SysWOW64\Oaeegjeb.exeC:\Windows\system32\Oaeegjeb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Windows\SysWOW64\Ophbja32.exeC:\Windows\system32\Ophbja32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\Plocob32.exeC:\Windows\system32\Plocob32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\Ppmleagi.exeC:\Windows\system32\Ppmleagi.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\Phkmoc32.exeC:\Windows\system32\Phkmoc32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\Pbpall32.exeC:\Windows\system32\Pbpall32.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\Plifea32.exeC:\Windows\system32\Plifea32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\Qajhigcj.exeC:\Windows\system32\Qajhigcj.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\Abqjci32.exeC:\Windows\system32\Abqjci32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\Bimoecio.exeC:\Windows\system32\Bimoecio.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\Bbecnipp.exeC:\Windows\system32\Bbecnipp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\Bajqpe32.exeC:\Windows\system32\Bajqpe32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\Bbjmih32.exeC:\Windows\system32\Bbjmih32.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\Bppjhl32.exeC:\Windows\system32\Bppjhl32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\Ceppfbef.exeC:\Windows\system32\Ceppfbef.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\Cpedckdl.exeC:\Windows\system32\Cpedckdl.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\Cpgqik32.exeC:\Windows\system32\Cpgqik32.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\Clqncl32.exeC:\Windows\system32\Clqncl32.exe20⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Windows\SysWOW64\Damflb32.exeC:\Windows\system32\Damflb32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\Dpnfjjla.exeC:\Windows\system32\Dpnfjjla.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\Djihhoao.exeC:\Windows\system32\Djihhoao.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\Dohmff32.exeC:\Windows\system32\Dohmff32.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Windows\SysWOW64\Djnaco32.exeC:\Windows\system32\Djnaco32.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\Ejbknnid.exeC:\Windows\system32\Ejbknnid.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\Ehhgpj32.exeC:\Windows\system32\Ehhgpj32.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\SysWOW64\Eqalfgll.exeC:\Windows\system32\Eqalfgll.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\Ehlakjig.exeC:\Windows\system32\Ehlakjig.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Windows\SysWOW64\Fcbehbim.exeC:\Windows\system32\Fcbehbim.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Windows\SysWOW64\Ffbnin32.exeC:\Windows\system32\Ffbnin32.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\Fcikhace.exeC:\Windows\system32\Fcikhace.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\Fifdqhal.exeC:\Windows\system32\Fifdqhal.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\Fbnhjn32.exeC:\Windows\system32\Fbnhjn32.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\Godehbed.exeC:\Windows\system32\Godehbed.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\Gjlfkj32.exeC:\Windows\system32\Gjlfkj32.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\Gbgkpm32.exeC:\Windows\system32\Gbgkpm32.exe37⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Windows\SysWOW64\Gbjhelnp.exeC:\Windows\system32\Gbjhelnp.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\Hpnhoqmi.exeC:\Windows\system32\Hpnhoqmi.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\Hmaihekc.exeC:\Windows\system32\Hmaihekc.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\Hihimfag.exeC:\Windows\system32\Hihimfag.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\Hmfbcd32.exeC:\Windows\system32\Hmfbcd32.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\Hfoflj32.exeC:\Windows\system32\Hfoflj32.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\Hfacai32.exeC:\Windows\system32\Hfacai32.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\Ibhdgjap.exeC:\Windows\system32\Ibhdgjap.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\SysWOW64\Immhdc32.exeC:\Windows\system32\Immhdc32.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Windows\SysWOW64\Iffmmihf.exeC:\Windows\system32\Iffmmihf.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\Idjmfmgp.exeC:\Windows\system32\Idjmfmgp.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\Ibojgikg.exeC:\Windows\system32\Ibojgikg.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Windows\SysWOW64\Ibagmiie.exeC:\Windows\system32\Ibagmiie.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\Jabgkpad.exeC:\Windows\system32\Jabgkpad.exe51⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\Jmihpa32.exeC:\Windows\system32\Jmihpa32.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\Jagqfp32.exeC:\Windows\system32\Jagqfp32.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\Jaimko32.exeC:\Windows\system32\Jaimko32.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\Jmpnppap.exeC:\Windows\system32\Jmpnppap.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Windows\SysWOW64\Kfhbifgq.exeC:\Windows\system32\Kfhbifgq.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\Kgkooeen.exeC:\Windows\system32\Kgkooeen.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Windows\SysWOW64\Kkihedld.exeC:\Windows\system32\Kkihedld.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\Kgphje32.exeC:\Windows\system32\Kgphje32.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\Kdcicipb.exeC:\Windows\system32\Kdcicipb.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\Kmlmlo32.exeC:\Windows\system32\Kmlmlo32.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\Lajfbmmi.exeC:\Windows\system32\Lajfbmmi.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\Lalchm32.exeC:\Windows\system32\Lalchm32.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\Lkdgqbag.exeC:\Windows\system32\Lkdgqbag.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\Lcpledob.exeC:\Windows\system32\Lcpledob.exe65⤵
- Executes dropped EXE
PID:4900 -
C:\Windows\SysWOW64\Lnepbm32.exeC:\Windows\system32\Lnepbm32.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:700 -
C:\Windows\SysWOW64\Lngmhm32.exeC:\Windows\system32\Lngmhm32.exe67⤵PID:5428
-
C:\Windows\SysWOW64\Maefnk32.exeC:\Windows\system32\Maefnk32.exe68⤵PID:5868
-
C:\Windows\SysWOW64\Mgbnfb32.exeC:\Windows\system32\Mgbnfb32.exe69⤵PID:5072
-
C:\Windows\SysWOW64\Mnochl32.exeC:\Windows\system32\Mnochl32.exe70⤵PID:1388
-
C:\Windows\SysWOW64\Mgggaamn.exeC:\Windows\system32\Mgggaamn.exe71⤵
- Modifies registry class
PID:4700 -
C:\Windows\SysWOW64\Mdkhkflh.exeC:\Windows\system32\Mdkhkflh.exe72⤵PID:6112
-
C:\Windows\SysWOW64\Ndmepe32.exeC:\Windows\system32\Ndmepe32.exe73⤵
- Modifies registry class
PID:3240 -
C:\Windows\SysWOW64\Naaejj32.exeC:\Windows\system32\Naaejj32.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5292 -
C:\Windows\SysWOW64\Njljnl32.exeC:\Windows\system32\Njljnl32.exe75⤵PID:4528
-
C:\Windows\SysWOW64\Ngpjgpec.exeC:\Windows\system32\Ngpjgpec.exe76⤵PID:1032
-
C:\Windows\SysWOW64\Nnmojj32.exeC:\Windows\system32\Nnmojj32.exe77⤵PID:1316
-
C:\Windows\SysWOW64\Njcpok32.exeC:\Windows\system32\Njcpok32.exe78⤵PID:2836
-
C:\Windows\SysWOW64\Ojfmdk32.exeC:\Windows\system32\Ojfmdk32.exe79⤵PID:3780
-
C:\Windows\SysWOW64\Odkaac32.exeC:\Windows\system32\Odkaac32.exe80⤵PID:1136
-
C:\Windows\SysWOW64\Oboakhmo.exeC:\Windows\system32\Oboakhmo.exe81⤵
- Modifies registry class
PID:3660 -
C:\Windows\SysWOW64\Onfbpi32.exeC:\Windows\system32\Onfbpi32.exe82⤵
- Drops file in System32 directory
PID:2964 -
C:\Windows\SysWOW64\Ogqcon32.exeC:\Windows\system32\Ogqcon32.exe83⤵PID:1200
-
C:\Windows\SysWOW64\Pcgdcome.exeC:\Windows\system32\Pcgdcome.exe84⤵PID:1968
-
C:\Windows\SysWOW64\Panabc32.exeC:\Windows\system32\Panabc32.exe85⤵PID:4336
-
C:\Windows\SysWOW64\Pcojdnfm.exeC:\Windows\system32\Pcojdnfm.exe86⤵PID:4476
-
C:\Windows\SysWOW64\Pbpjbe32.exeC:\Windows\system32\Pbpjbe32.exe87⤵PID:1616
-
C:\Windows\SysWOW64\Pjkofh32.exeC:\Windows\system32\Pjkofh32.exe88⤵PID:4836
-
C:\Windows\SysWOW64\Qcccom32.exeC:\Windows\system32\Qcccom32.exe89⤵PID:2928
-
C:\Windows\SysWOW64\Qebpipij.exeC:\Windows\system32\Qebpipij.exe90⤵PID:5716
-
C:\Windows\SysWOW64\Ankdbf32.exeC:\Windows\system32\Ankdbf32.exe91⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5652 -
C:\Windows\SysWOW64\Agcikk32.exeC:\Windows\system32\Agcikk32.exe92⤵PID:5460
-
C:\Windows\SysWOW64\Abimhd32.exeC:\Windows\system32\Abimhd32.exe93⤵PID:5332
-
C:\Windows\SysWOW64\Ajdbmf32.exeC:\Windows\system32\Ajdbmf32.exe94⤵PID:4156
-
C:\Windows\SysWOW64\Acmfel32.exeC:\Windows\system32\Acmfel32.exe95⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3084 -
C:\Windows\SysWOW64\Anbkbe32.exeC:\Windows\system32\Anbkbe32.exe96⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5580 -
C:\Windows\SysWOW64\Ahjoljqc.exeC:\Windows\system32\Ahjoljqc.exe97⤵PID:5860
-
C:\Windows\SysWOW64\Adapqk32.exeC:\Windows\system32\Adapqk32.exe98⤵PID:3196
-
C:\Windows\SysWOW64\Baepjpea.exeC:\Windows\system32\Baepjpea.exe99⤵PID:4848
-
C:\Windows\SysWOW64\Bniacddk.exeC:\Windows\system32\Bniacddk.exe100⤵PID:3804
-
C:\Windows\SysWOW64\Bdfilkbb.exeC:\Windows\system32\Bdfilkbb.exe101⤵PID:5976
-
C:\Windows\SysWOW64\Bbgiibja.exeC:\Windows\system32\Bbgiibja.exe102⤵
- Modifies registry class
PID:3400 -
C:\Windows\SysWOW64\Blonbh32.exeC:\Windows\system32\Blonbh32.exe103⤵PID:1700
-
C:\Windows\SysWOW64\Behbkmgb.exeC:\Windows\system32\Behbkmgb.exe104⤵PID:5272
-
C:\Windows\SysWOW64\Bopgdcnc.exeC:\Windows\system32\Bopgdcnc.exe105⤵PID:4852
-
C:\Windows\SysWOW64\Bdmpljlj.exeC:\Windows\system32\Bdmpljlj.exe106⤵PID:4144
-
C:\Windows\SysWOW64\Caapfnkd.exeC:\Windows\system32\Caapfnkd.exe107⤵PID:2052
-
C:\Windows\SysWOW64\Chkhbh32.exeC:\Windows\system32\Chkhbh32.exe108⤵PID:4524
-
C:\Windows\SysWOW64\Cbqlpabf.exeC:\Windows\system32\Cbqlpabf.exe109⤵PID:4896
-
C:\Windows\SysWOW64\Cliahf32.exeC:\Windows\system32\Cliahf32.exe110⤵PID:2476
-
C:\Windows\SysWOW64\Ceaealoh.exeC:\Windows\system32\Ceaealoh.exe111⤵PID:2488
-
C:\Windows\SysWOW64\Coijja32.exeC:\Windows\system32\Coijja32.exe112⤵PID:1824
-
C:\Windows\SysWOW64\Cdfbbhdp.exeC:\Windows\system32\Cdfbbhdp.exe113⤵
- Modifies registry class
PID:3392 -
C:\Windows\SysWOW64\Cajblmci.exeC:\Windows\system32\Cajblmci.exe114⤵
- Modifies registry class
PID:5504 -
C:\Windows\SysWOW64\Dlpgiebo.exeC:\Windows\system32\Dlpgiebo.exe115⤵PID:4560
-
C:\Windows\SysWOW64\Ddklnh32.exeC:\Windows\system32\Ddklnh32.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5444 -
C:\Windows\SysWOW64\Doqpkq32.exeC:\Windows\system32\Doqpkq32.exe117⤵
- Drops file in System32 directory
PID:5004 -
C:\Windows\SysWOW64\Dhidcffq.exeC:\Windows\system32\Dhidcffq.exe118⤵
- System Location Discovery: System Language Discovery
PID:1964 -
C:\Windows\SysWOW64\Dememj32.exeC:\Windows\system32\Dememj32.exe119⤵PID:5244
-
C:\Windows\SysWOW64\Deoabj32.exeC:\Windows\system32\Deoabj32.exe120⤵
- System Location Discovery: System Language Discovery
PID:3824 -
C:\Windows\SysWOW64\Dogfkpih.exeC:\Windows\system32\Dogfkpih.exe121⤵PID:2548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-