Analysis
- max time kernel
149s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 18:45
Behavioral task
behavioral1
Sample
2026-08-04_b00f8189b903201480dfa0291406dd6e_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_b00f8189b903201480dfa0291406dd6e_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-04_b00f8189b903201480dfa0291406dd6e_elex_wannacry.exe
- Size 376KB
- Sample260804-xd3gkack4z
- SHA256 da7847c9e636b1e717e5f29e62158e39266e1bd59e3a3f1e47a444cd1cecb7f9
- MD5 b00f8189b903201480dfa0291406dd6e
- SHA1 d20fc61250a4975f81bb2d6e1b063c20c7d28d6f
- SHA512 138ff7370137bd5bc9eb1c0e62b0f24964c4052e2aea65b80571a73c8970686fa370b6e5950c3c3aea9522cf9157f3f67ecb0ec01846856f2a7a90832bb1a1ff
- SSDEEP 6144:ttSHZ2MgFSDC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:PSpgF550I2mi4lCzb0IF4X
- TLSH T1FA84282D9F36CA85C05810FF80A3169AAA64E7BD0DE5CF76BEE0F6291A361C3DC17154
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://crutop.ru/index.php
-
http://mazafaka.ru/index.php
-
http://color-bank.ru/index.php
-
http://asechka.ru/index.php
-
http://trojan.ru/index.php
-
http://fuck.ru/index.php
-
http://goldensand.ru/index.php
-
http://filesearch.ru/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://lovingod.host.sk/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://mazafaka.ru/index.htm
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
-
http://fethard.biz/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ifplgc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Diafkl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odjeepna.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljloii32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhibgo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmcoflhh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oopjchnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bmeagjbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ajfobfaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bopgdcnc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfabhppm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdnipbbo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbcfan32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lfnfck32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aeiooi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pgdodq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Edjgpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ikpjkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nclida32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fnegqjne.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mmkdlbea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Knefnkla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kckgff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Foifmcoa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fqjolfda.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhemfbnq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnicpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fhbifl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pamikh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfkmdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pnakaa32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ompmie32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdpanj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dfpfokfg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdkhkflh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Coepob32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Midfiq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Faemjl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gnlmai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fblldn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hicihp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njlcdf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ccnnmmbp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Locbpi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Plbmhadm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nfjofg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kgjggkqi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Laqhao32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onkimc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kdnincal.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aihaifam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mmdefi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fnpmej32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bgimepmd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lpapiipo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmkcjd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jqhaolli.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnbnaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kjgenjhe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Flgfqb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oncopcqj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kfiajinf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aeodapcl.exe - Executes dropped EXE 64 IoCs
pid Process 6012 Aefcif32.exe 1940 Aiclodaj.exe 4144 Ablahjhj.exe 1368 Aihfjd32.exe 3332 Ahnclp32.exe 1852 Bojhnjgf.exe 1324 Blnhgn32.exe 2244 Boldcj32.exe 4928 Bbjmih32.exe 2384 Bidefbcg.exe 4988 Blbabnbk.exe 3728 Bbljoh32.exe 5448 Bhibgo32.exe 4664 Bocjdiol.exe 2604 Cemcqcgi.exe 4484 Cpbgnlfo.exe 5292 Cadcfd32.exe 296 Chnlbndj.exe 8 Cohdoh32.exe 3980 Cebllbcc.exe 5696 Clldhljp.exe 5792 Ccfmef32.exe 1856 Clnanlhn.exe 5712 Cchikf32.exe 2928 Cibagpgg.exe 2896 Cpljdjnd.exe 716 Damflb32.exe 4492 Dhgoimlo.exe 3424 Doageg32.exe 4084 Dekobaki.exe 1740 Dpqcoj32.exe 2484 Dabpgbpm.exe 1528 Dhlhcl32.exe 1384 Dcalae32.exe 5848 Dhndil32.exe 3220 Dcdifdem.exe 3616 Djnaco32.exe 3752 Dphipidf.exe 4732 Efdbhpbn.exe 1400 Elojej32.exe 1840 Ebkbmqhb.exe 2364 Elagjihh.exe 2412 Ebnocpfp.exe 5512 Ehhgpj32.exe 1348 Ecmlmcmb.exe 5052 Ejgdim32.exe 5100 Eodlad32.exe 4916 Efnennjc.exe 4328 Emhmkh32.exe 712 Fbeeco32.exe 4356 Fhonpi32.exe 1060 Foifmcoa.exe 3960 Fjnjjlog.exe 1944 Fokbbcmo.exe 3064 Ffekom32.exe 5284 Fqjolfda.exe 1080 Fblldn32.exe 5516 Fmapag32.exe 4212 Fbnhjn32.exe 4560 Fihqfh32.exe 4216 Gobicbgf.exe 4892 Gflapl32.exe 4904 Gqaeme32.exe 4956 Gbcaemdg.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Bjlfpchn.dll Bmkjdj32.exe File created C:\Windows\SysWOW64\Edjgpi32.exe Empococc.exe File created C:\Windows\SysWOW64\Njghcg32.dll Mhafoh32.exe File opened for modification C:\Windows\SysWOW64\Nogngp32.exe Neoink32.exe File opened for modification C:\Windows\SysWOW64\Ikkppgld.exe Idahcm32.exe File opened for modification C:\Windows\SysWOW64\Bddjijia.exe Bohbackj.exe File opened for modification C:\Windows\SysWOW64\Kiikkada.exe Kbocng32.exe File opened for modification C:\Windows\SysWOW64\Dejamdca.exe Dkdmpl32.exe File opened for modification C:\Windows\SysWOW64\Ikndpm32.exe Iddlccfp.exe File created C:\Windows\SysWOW64\Kmobdm32.exe Kknfmdko.exe File opened for modification C:\Windows\SysWOW64\Mklkepal.exe Mceccbpj.exe File opened for modification C:\Windows\SysWOW64\Ahbjij32.exe Anmfkane.exe File created C:\Windows\SysWOW64\Hmokkonl.dll Engjol32.exe File created C:\Windows\SysWOW64\Qfilee32.dll Ffqhmf32.exe File created C:\Windows\SysWOW64\Ciinhk32.dll Ddpeigle.exe File created C:\Windows\SysWOW64\Acghpmin.dll Keoeel32.exe File created C:\Windows\SysWOW64\Iemdep32.exe Iocliecb.exe File created C:\Windows\SysWOW64\Akioep32.dll Pcnhfi32.exe File opened for modification C:\Windows\SysWOW64\Pmpoemef.exe Phcgmffo.exe File created C:\Windows\SysWOW64\Fpdmob32.dll Fkmbbajb.exe File created C:\Windows\SysWOW64\Knoonphp.exe Kgefae32.exe File created C:\Windows\SysWOW64\Mpjleadh.exe Medggidb.exe File created C:\Windows\SysWOW64\Nfeqnf32.exe Nphhfp32.exe File opened for modification C:\Windows\SysWOW64\Dpknhfoq.exe Diafkl32.exe File opened for modification C:\Windows\SysWOW64\Blbodh32.exe Aehghn32.exe File created C:\Windows\SysWOW64\Nqmfnp32.exe Nfhbpghl.exe File created C:\Windows\SysWOW64\Aalndaml.exe Aloekjod.exe File opened for modification C:\Windows\SysWOW64\Ldeonbkd.exe Kipkaj32.exe File created C:\Windows\SysWOW64\Kfhohbni.dll Khpgmqpp.exe File created C:\Windows\SysWOW64\Icalij32.exe Ilhcmpeg.exe File opened for modification C:\Windows\SysWOW64\Banabi32.exe Bgimepmd.exe File created C:\Windows\SysWOW64\Ofimck32.dll Canlfh32.exe File opened for modification C:\Windows\SysWOW64\Ifbbbl32.exe Igabdekb.exe File created C:\Windows\SysWOW64\Dkadnj32.dll Nhicjm32.exe File opened for modification C:\Windows\SysWOW64\Ohlifj32.exe Ogklob32.exe File opened for modification C:\Windows\SysWOW64\Fnegqjne.exe Fihnhc32.exe File opened for modification C:\Windows\SysWOW64\Jcplle32.exe Jfllca32.exe File created C:\Windows\SysWOW64\Npjelo32.exe Nfeqnf32.exe File created C:\Windows\SysWOW64\Kdahkafp.dll Bhnidi32.exe File created C:\Windows\SysWOW64\Mokmnm32.exe Mnjqfeld.exe File created C:\Windows\SysWOW64\Conagl32.exe Chdikajj.exe File created C:\Windows\SysWOW64\Odkaac32.exe Oggqho32.exe File created C:\Windows\SysWOW64\Lamofk32.dll Lplpcc32.exe File created C:\Windows\SysWOW64\Qqnoba32.dll Phhhbi32.exe File created C:\Windows\SysWOW64\Hpkcafjg.exe Haefqjeo.exe File created C:\Windows\SysWOW64\Npbcollj.exe Nnafgd32.exe File created C:\Windows\SysWOW64\Gbdgpfni.exe Gkjocm32.exe File created C:\Windows\SysWOW64\Jianpl32.exe Jmknkk32.exe File created C:\Windows\SysWOW64\Aaghnd32.dll Kpncbemh.exe File created C:\Windows\SysWOW64\Moijhl32.dll Mgfqgkib.exe File opened for modification C:\Windows\SysWOW64\Ogklob32.exe Opqdbhlb.exe File opened for modification C:\Windows\SysWOW64\Eagahnob.exe Ejmild32.exe File created C:\Windows\SysWOW64\Fjhaml32.exe Fdnipbbo.exe File created C:\Windows\SysWOW64\Aiclodaj.exe Aefcif32.exe File created C:\Windows\SysWOW64\Mdfopf32.exe Mjqjbn32.exe File created C:\Windows\SysWOW64\Cahffmel.exe Clknnf32.exe File created C:\Windows\SysWOW64\Inhgja32.dll Jggjpgmc.exe File created C:\Windows\SysWOW64\Bbjmih32.exe Boldcj32.exe File created C:\Windows\SysWOW64\Cpfhij32.dll Mdhkefnj.exe File created C:\Windows\SysWOW64\Fcoipdme.dll Bminokil.exe File created C:\Windows\SysWOW64\Faemjl32.exe Fkkemble.exe File created C:\Windows\SysWOW64\Ponfdf32.exe Pdhbgn32.exe File opened for modification C:\Windows\SysWOW64\Njaakf32.exe Mokmnm32.exe File created C:\Windows\SysWOW64\Fmiajm32.dll Oclkqihc.exe - Program crash 1 IoCs
pid pid_target Process procid_target 15048 14932 Process not Found 1134 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oplkgi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmcoflhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmbaggce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lcimmn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gokdoj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Haefqjeo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjponk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jidkek32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Neoink32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gfhehlhe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ohhnln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ponfdf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ehhgpj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flnlaahl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Anjngp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkmbbajb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cooolhin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmdjjemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kcpqafba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dcalae32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blhhaigj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fneohd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkcfbj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkdcffci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mokmnm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onklkhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bpkllo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oloaamqf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljlagndl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cndidlfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aifdcgcp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnbnaj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cgnogmkl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dejamdca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aobieq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mbenfq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmdlolmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pbpjbe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emniheha.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnlmai32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpiemj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nfjofg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onkimc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnicpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cameka32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kgjggkqi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikpjkf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iepako32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bocjdiol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pcepdl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dndnjllg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahacndjo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbmfig32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Boknic32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhnqoo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpjlgp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hlcjaq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iemdep32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahnclp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aalndaml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkhbnm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mkepgp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdmecdlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nbqmbo32.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 7820 Iempingp.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjjlij32.dll" Pklkmo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mchpibng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mfjfoidl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfoece32.dll" Elagjihh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jfpocjfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mpnnek32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Llofnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gejdiaok.dll" Ldpmlh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bohbackj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gpeclq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dnbadlnj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gehbcb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknqppmi.dll" Lqfgfclm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckclgbne.dll" Ojmqgd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edijfd32.dll" 2026-08-04_b00f8189b903201480dfa0291406dd6e_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gcbnopkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Boknic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gkkndp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bcmolimg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gfkbnk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebkolf32.dll" Jidpblik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcmfnf32.dll" Kfgpblda.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdhcmijn.dll" Eeagnc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hoadecal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pokjnd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kaabkj32.dll" Haefqjeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afcafo32.dll" Fbeeco32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ipckqnja.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Odkaac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dehkbkip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ieeihomg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Odhman32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apfodd32.dll" Odhman32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cebllbcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Olhlaoea.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pnakaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkpjfi32.dll" Ajanmqbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plcbgiaq.dll" Dkkcqj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bikojc32.dll" Ffekom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pghiomqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fachob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aqhcid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cgndikgd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cmhial32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnleolbk.dll" Efepln32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mcdlil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hdmecdlh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icmaan32.dll" Dhgoimlo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pggbdgmm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Acicefid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmmfha32.dll" Bglefdke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhobfffa.dll" Cnicpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfhecfj.dll" Dkgjekai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ohlifj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iggakn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lffhpnhe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aaccdp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcmdjgqg.dll" Kihdqkaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmjjlh32.dll" Iofmpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhkcql32.dll" Epgenk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aomipkic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ikkppgld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcpeehaj.dll" Ghgjlaln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jijaef32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4348 wrote to memory of 6012 4348 2026-08-04_b00f8189b903201480dfa0291406dd6e_elex_wannacry.exe 89 PID 6012 wrote to memory of 1940 6012 Aefcif32.exe 90 PID 1940 wrote to memory of 4144 1940 Aiclodaj.exe 91 PID 4144 wrote to memory of 1368 4144 Ablahjhj.exe 92 PID 1368 wrote to memory of 3332 1368 Aihfjd32.exe 93 PID 3332 wrote to memory of 1852 3332 Ahnclp32.exe 94 PID 1852 wrote to memory of 1324 1852 Bojhnjgf.exe 95 PID 1324 wrote to memory of 2244 1324 Blnhgn32.exe 96 PID 2244 wrote to memory of 4928 2244 Boldcj32.exe 97 PID 4928 wrote to memory of 2384 4928 Bbjmih32.exe 98 PID 2384 wrote to memory of 4988 2384 Bidefbcg.exe 99 PID 4988 wrote to memory of 3728 4988 Blbabnbk.exe 100 PID 3728 wrote to memory of 5448 3728 Bbljoh32.exe 101 PID 5448 wrote to memory of 4664 5448 Bhibgo32.exe 102 PID 4664 wrote to memory of 2604 4664 Bocjdiol.exe 103 PID 2604 wrote to memory of 4484 2604 Cemcqcgi.exe 104 PID 4484 wrote to memory of 5292 4484 Cpbgnlfo.exe 105 PID 5292 wrote to memory of 296 5292 Cadcfd32.exe 106 PID 296 wrote to memory of 8 296 Chnlbndj.exe 107 PID 8 wrote to memory of 3980 8 Cohdoh32.exe 108 PID 3980 wrote to memory of 5696 3980 Cebllbcc.exe 109 PID 5696 wrote to memory of 5792 5696 Clldhljp.exe 110 PID 5792 wrote to memory of 1856 5792 Ccfmef32.exe 111 PID 1856 wrote to memory of 5712 1856 Clnanlhn.exe 112 PID 5712 wrote to memory of 2928 5712 Cchikf32.exe 113 PID 2928 wrote to memory of 2896 2928 Cibagpgg.exe 114 PID 2896 wrote to memory of 716 2896 Cpljdjnd.exe 115 PID 716 wrote to memory of 4492 716 Damflb32.exe 116 PID 4492 wrote to memory of 3424 4492 Dhgoimlo.exe 117 PID 3424 wrote to memory of 4084 3424 Doageg32.exe 118 PID 4084 wrote to memory of 1740 4084 Dekobaki.exe 119 PID 1740 wrote to memory of 2484 1740 Dpqcoj32.exe 120 PID 2484 wrote to memory of 1528 2484 Dabpgbpm.exe 121 PID 1528 wrote to memory of 1384 1528 Dhlhcl32.exe 122 PID 1384 wrote to memory of 5848 1384 Dcalae32.exe 123 PID 5848 wrote to memory of 3220 5848 Dhndil32.exe 124 PID 3220 wrote to memory of 3616 3220 Dcdifdem.exe 125 PID 3616 wrote to memory of 3752 3616 Djnaco32.exe 126 PID 3752 wrote to memory of 4732 3752 Dphipidf.exe 127 PID 4732 wrote to memory of 1400 4732 Efdbhpbn.exe 128 PID 1400 wrote to memory of 1840 1400 Elojej32.exe 129 PID 1840 wrote to memory of 2364 1840 Ebkbmqhb.exe 130 PID 2364 wrote to memory of 2412 2364 Elagjihh.exe 131 PID 2412 wrote to memory of 5512 2412 Ebnocpfp.exe 132 PID 5512 wrote to memory of 1348 5512 Ehhgpj32.exe 133 PID 1348 wrote to memory of 5052 1348 Ecmlmcmb.exe 134 PID 5052 wrote to memory of 5100 5052 Ejgdim32.exe 135 PID 5100 wrote to memory of 4916 5100 Eodlad32.exe 136 PID 4916 wrote to memory of 4328 4916 Efnennjc.exe 137 PID 4328 wrote to memory of 712 4328 Emhmkh32.exe 138 PID 712 wrote to memory of 4356 712 Fbeeco32.exe 139 PID 4356 wrote to memory of 1060 4356 Fhonpi32.exe 140 PID 1060 wrote to memory of 3960 1060 Foifmcoa.exe 141 PID 3960 wrote to memory of 1944 3960 Fjnjjlog.exe 142 PID 1944 wrote to memory of 3064 1944 Fokbbcmo.exe 143 PID 3064 wrote to memory of 5284 3064 Ffekom32.exe 144 PID 5284 wrote to memory of 1080 5284 Fqjolfda.exe 145 PID 1080 wrote to memory of 5516 1080 Fblldn32.exe 146 PID 5516 wrote to memory of 4212 5516 Fmapag32.exe 147 PID 4212 wrote to memory of 4560 4212 Fbnhjn32.exe 148 PID 4560 wrote to memory of 4216 4560 Fihqfh32.exe 149 PID 4216 wrote to memory of 4892 4216 Gobicbgf.exe 150 PID 4892 wrote to memory of 4904 4892 Gflapl32.exe 151 PID 4904 wrote to memory of 4956 4904 Gqaeme32.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_b00f8189b903201480dfa0291406dd6e_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_b00f8189b903201480dfa0291406dd6e_elex_wannacry.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\Aefcif32.exeC:\Windows\system32\Aefcif32.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\Aiclodaj.exeC:\Windows\system32\Aiclodaj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\Ablahjhj.exeC:\Windows\system32\Ablahjhj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\Aihfjd32.exeC:\Windows\system32\Aihfjd32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\Ahnclp32.exeC:\Windows\system32\Ahnclp32.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\Bojhnjgf.exeC:\Windows\system32\Bojhnjgf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\Blnhgn32.exeC:\Windows\system32\Blnhgn32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\Boldcj32.exeC:\Windows\system32\Boldcj32.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\Bbjmih32.exeC:\Windows\system32\Bbjmih32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\Bidefbcg.exeC:\Windows\system32\Bidefbcg.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\Blbabnbk.exeC:\Windows\system32\Blbabnbk.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\Bbljoh32.exeC:\Windows\system32\Bbljoh32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\Bhibgo32.exeC:\Windows\system32\Bhibgo32.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\SysWOW64\Bocjdiol.exeC:\Windows\system32\Bocjdiol.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\Cemcqcgi.exeC:\Windows\system32\Cemcqcgi.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\Cpbgnlfo.exeC:\Windows\system32\Cpbgnlfo.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\Cadcfd32.exeC:\Windows\system32\Cadcfd32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Windows\SysWOW64\Chnlbndj.exeC:\Windows\system32\Chnlbndj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\Cohdoh32.exeC:\Windows\system32\Cohdoh32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\Cebllbcc.exeC:\Windows\system32\Cebllbcc.exe21⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\Clldhljp.exeC:\Windows\system32\Clldhljp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Windows\SysWOW64\Ccfmef32.exeC:\Windows\system32\Ccfmef32.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\Clnanlhn.exeC:\Windows\system32\Clnanlhn.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\Cchikf32.exeC:\Windows\system32\Cchikf32.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\SysWOW64\Cibagpgg.exeC:\Windows\system32\Cibagpgg.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\Cpljdjnd.exeC:\Windows\system32\Cpljdjnd.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\Damflb32.exeC:\Windows\system32\Damflb32.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\Dhgoimlo.exeC:\Windows\system32\Dhgoimlo.exe29⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\Doageg32.exeC:\Windows\system32\Doageg32.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\Dekobaki.exeC:\Windows\system32\Dekobaki.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\Dpqcoj32.exeC:\Windows\system32\Dpqcoj32.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\Dabpgbpm.exeC:\Windows\system32\Dabpgbpm.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\Dhlhcl32.exeC:\Windows\system32\Dhlhcl32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\Dcalae32.exeC:\Windows\system32\Dcalae32.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\Dhndil32.exeC:\Windows\system32\Dhndil32.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Windows\SysWOW64\Dcdifdem.exeC:\Windows\system32\Dcdifdem.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\Djnaco32.exeC:\Windows\system32\Djnaco32.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\Dphipidf.exeC:\Windows\system32\Dphipidf.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\Efdbhpbn.exeC:\Windows\system32\Efdbhpbn.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\Elojej32.exeC:\Windows\system32\Elojej32.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\Ebkbmqhb.exeC:\Windows\system32\Ebkbmqhb.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\Elagjihh.exeC:\Windows\system32\Elagjihh.exe43⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\Ebnocpfp.exeC:\Windows\system32\Ebnocpfp.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\Ehhgpj32.exeC:\Windows\system32\Ehhgpj32.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Windows\SysWOW64\Ecmlmcmb.exeC:\Windows\system32\Ecmlmcmb.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\Ejgdim32.exeC:\Windows\system32\Ejgdim32.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\Eodlad32.exeC:\Windows\system32\Eodlad32.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\Efnennjc.exeC:\Windows\system32\Efnennjc.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\Emhmkh32.exeC:\Windows\system32\Emhmkh32.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\Fbeeco32.exeC:\Windows\system32\Fbeeco32.exe51⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\Fhonpi32.exeC:\Windows\system32\Fhonpi32.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\Foifmcoa.exeC:\Windows\system32\Foifmcoa.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\Fjnjjlog.exeC:\Windows\system32\Fjnjjlog.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\Fokbbcmo.exeC:\Windows\system32\Fokbbcmo.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\Ffekom32.exeC:\Windows\system32\Ffekom32.exe56⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\Fqjolfda.exeC:\Windows\system32\Fqjolfda.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Windows\SysWOW64\Fblldn32.exeC:\Windows\system32\Fblldn32.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\Fmapag32.exeC:\Windows\system32\Fmapag32.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Windows\SysWOW64\Fbnhjn32.exeC:\Windows\system32\Fbnhjn32.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\Fihqfh32.exeC:\Windows\system32\Fihqfh32.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\Gobicbgf.exeC:\Windows\system32\Gobicbgf.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\Gflapl32.exeC:\Windows\system32\Gflapl32.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\Gqaeme32.exeC:\Windows\system32\Gqaeme32.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\Gbcaemdg.exeC:\Windows\system32\Gbcaemdg.exe65⤵
- Executes dropped EXE
PID:4956 -
C:\Windows\SysWOW64\Gmhfbf32.exeC:\Windows\system32\Gmhfbf32.exe66⤵PID:5836
-
C:\Windows\SysWOW64\Gcbnopkj.exeC:\Windows\system32\Gcbnopkj.exe67⤵
- Modifies registry class
PID:4584 -
C:\Windows\SysWOW64\Giofggia.exeC:\Windows\system32\Giofggia.exe68⤵PID:5476
-
C:\Windows\SysWOW64\Gpioca32.exeC:\Windows\system32\Gpioca32.exe69⤵PID:1236
-
C:\Windows\SysWOW64\Gjocaj32.exeC:\Windows\system32\Gjocaj32.exe70⤵PID:4792
-
C:\Windows\SysWOW64\Gjapfjnb.exeC:\Windows\system32\Gjapfjnb.exe71⤵PID:5136
-
C:\Windows\SysWOW64\Hfacai32.exeC:\Windows\system32\Hfacai32.exe72⤵PID:4944
-
C:\Windows\SysWOW64\Iafgob32.exeC:\Windows\system32\Iafgob32.exe73⤵PID:1196
-
C:\Windows\SysWOW64\Ifcpgiji.exeC:\Windows\system32\Ifcpgiji.exe74⤵PID:2800
-
C:\Windows\SysWOW64\Immhdc32.exeC:\Windows\system32\Immhdc32.exe75⤵PID:3588
-
C:\Windows\SysWOW64\Iidiidgj.exeC:\Windows\system32\Iidiidgj.exe76⤵PID:1904
-
C:\Windows\SysWOW64\Iakajagl.exeC:\Windows\system32\Iakajagl.exe77⤵PID:248
-
C:\Windows\SysWOW64\Ijcecgnl.exeC:\Windows\system32\Ijcecgnl.exe78⤵PID:3940
-
C:\Windows\SysWOW64\Ipqnknld.exeC:\Windows\system32\Ipqnknld.exe79⤵PID:2424
-
C:\Windows\SysWOW64\Ijfbhflj.exeC:\Windows\system32\Ijfbhflj.exe80⤵PID:1988
-
C:\Windows\SysWOW64\Ipckqnja.exeC:\Windows\system32\Ipckqnja.exe81⤵
- Modifies registry class
PID:4772 -
C:\Windows\SysWOW64\Jjhonfjg.exeC:\Windows\system32\Jjhonfjg.exe82⤵PID:4228
-
C:\Windows\SysWOW64\Jmihpa32.exeC:\Windows\system32\Jmihpa32.exe83⤵PID:5372
-
C:\Windows\SysWOW64\Jdcplkoe.exeC:\Windows\system32\Jdcplkoe.exe84⤵PID:848
-
C:\Windows\SysWOW64\Jfdinf32.exeC:\Windows\system32\Jfdinf32.exe85⤵PID:3360
-
C:\Windows\SysWOW64\Jbkjcgaj.exeC:\Windows\system32\Jbkjcgaj.exe86⤵PID:3952
-
C:\Windows\SysWOW64\Jmpnppap.exeC:\Windows\system32\Jmpnppap.exe87⤵PID:1332
-
C:\Windows\SysWOW64\Jbmfig32.exeC:\Windows\system32\Jbmfig32.exe88⤵
- System Location Discovery: System Language Discovery
PID:1696 -
C:\Windows\SysWOW64\Kbocng32.exeC:\Windows\system32\Kbocng32.exe89⤵
- Drops file in System32 directory
PID:2860 -
C:\Windows\SysWOW64\Kiikkada.exeC:\Windows\system32\Kiikkada.exe90⤵PID:4592
-
C:\Windows\SysWOW64\Kdophj32.exeC:\Windows\system32\Kdophj32.exe91⤵PID:2396
-
C:\Windows\SysWOW64\Kmgdaokh.exeC:\Windows\system32\Kmgdaokh.exe92⤵PID:1072
-
C:\Windows\SysWOW64\Kdalni32.exeC:\Windows\system32\Kdalni32.exe93⤵PID:468
-
C:\Windows\SysWOW64\Kphmbjhi.exeC:\Windows\system32\Kphmbjhi.exe94⤵PID:3372
-
C:\Windows\SysWOW64\Kgbepdpf.exeC:\Windows\system32\Kgbepdpf.exe95⤵PID:4760
-
C:\Windows\SysWOW64\Kpjjhj32.exeC:\Windows\system32\Kpjjhj32.exe96⤵PID:4500
-
C:\Windows\SysWOW64\Lkpnec32.exeC:\Windows\system32\Lkpnec32.exe97⤵PID:6016
-
C:\Windows\SysWOW64\Lgfojd32.exeC:\Windows\system32\Lgfojd32.exe98⤵PID:3520
-
C:\Windows\SysWOW64\Lalchm32.exeC:\Windows\system32\Lalchm32.exe99⤵PID:4456
-
C:\Windows\SysWOW64\Lpapiipo.exeC:\Windows\system32\Lpapiipo.exe100⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2512 -
C:\Windows\SysWOW64\Lkgdfb32.exeC:\Windows\system32\Lkgdfb32.exe101⤵PID:5064
-
C:\Windows\SysWOW64\Laqlclga.exeC:\Windows\system32\Laqlclga.exe102⤵PID:1968
-
C:\Windows\SysWOW64\Ljlagndl.exeC:\Windows\system32\Ljlagndl.exe103⤵
- System Location Discovery: System Language Discovery
PID:2696 -
C:\Windows\SysWOW64\Mdaedgdb.exeC:\Windows\system32\Mdaedgdb.exe104⤵PID:3600
-
C:\Windows\SysWOW64\Mjnnmn32.exeC:\Windows\system32\Mjnnmn32.exe105⤵PID:5736
-
C:\Windows\SysWOW64\Mddbjg32.exeC:\Windows\system32\Mddbjg32.exe106⤵PID:3276
-
C:\Windows\SysWOW64\Mjqjbn32.exeC:\Windows\system32\Mjqjbn32.exe107⤵
- Drops file in System32 directory
PID:5420 -
C:\Windows\SysWOW64\Mdfopf32.exeC:\Windows\system32\Mdfopf32.exe108⤵PID:3796
-
C:\Windows\SysWOW64\Mjcghm32.exeC:\Windows\system32\Mjcghm32.exe109⤵PID:2836
-
C:\Windows\SysWOW64\Mdhkefnj.exeC:\Windows\system32\Mdhkefnj.exe110⤵
- Drops file in System32 directory
PID:5936 -
C:\Windows\SysWOW64\Mnapnl32.exeC:\Windows\system32\Mnapnl32.exe111⤵PID:1700
-
C:\Windows\SysWOW64\Mdkhkflh.exeC:\Windows\system32\Mdkhkflh.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3052 -
C:\Windows\SysWOW64\Mkepgp32.exeC:\Windows\system32\Mkepgp32.exe113⤵
- System Location Discovery: System Language Discovery
PID:5768 -
C:\Windows\SysWOW64\Nqaipgal.exeC:\Windows\system32\Nqaipgal.exe114⤵PID:5384
-
C:\Windows\SysWOW64\Nneiikqe.exeC:\Windows\system32\Nneiikqe.exe115⤵PID:2528
-
C:\Windows\SysWOW64\Ngnnbq32.exeC:\Windows\system32\Ngnnbq32.exe116⤵PID:4628
-
C:\Windows\SysWOW64\Nnhfokoc.exeC:\Windows\system32\Nnhfokoc.exe117⤵PID:1272
-
C:\Windows\SysWOW64\Ncenga32.exeC:\Windows\system32\Ncenga32.exe118⤵PID:3316
-
C:\Windows\SysWOW64\Nbfoeiei.exeC:\Windows\system32\Nbfoeiei.exe119⤵PID:5392
-
C:\Windows\SysWOW64\Ngbgmpcq.exeC:\Windows\system32\Ngbgmpcq.exe120⤵PID:5640
-
C:\Windows\SysWOW64\Nbhkjicf.exeC:\Windows\system32\Nbhkjicf.exe121⤵PID:252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-