Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 10:44
Behavioral task
behavioral1
Sample
2026-08-16_6e8236bb4766a85b93a8c1bfc78ed930_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_6e8236bb4766a85b93a8c1bfc78ed930_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-16_6e8236bb4766a85b93a8c1bfc78ed930_elex_wannacry.exe
- Size 320KB
- Sample260816-ms9jbahn8s
- SHA256 dcfc09c7b11af2d7e42581d0f217a5d9f265b5d2adce837e7366f34f55d18f2e
- MD5 6e8236bb4766a85b93a8c1bfc78ed930
- SHA1 c22ebfd22d8cfe7f4167922f6a1128360c7366ec
- SHA512 79f68746a34c5383bbf1d61f90e42842f6532624f3cf042850d2f8bdac10999e661c31956e415ec68f6e696d471ccee06d6ede53e6b07bcf653a38c66e65880f
- SSDEEP 3072:qVz0050ml9ArlE9yLwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:qVz00zlelvLV/Ah1G/AcQ///NR5fn
- TLSH T1E56432291A3409EADDED1BB5EC026AEC6545E9F018F1E13E6123DFDCD8E4DA2D805F81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Folacfcd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Locbpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pljalipc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bidqddgp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dplebmbl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onkimc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phjdggoj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpodhf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ikokkc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aokceaoa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aihaifam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ccpkblqn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcdnce32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Diccal32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Boqlqd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Illfmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oejijiip.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohkbldfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ohkbldfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oopjchnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Akipdg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fbnflihq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onmfcb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhphfppl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kfehoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mlbbel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ccbhhl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Egjobl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fomfpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hjjnkkjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jipqkopf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qifnaecf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnkbmp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njaakf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnlhhi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkechjib.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngehoqdn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ibffbnjh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phhhbi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbefmopd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Plpqba32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjjnblhi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gpnmka32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkhajq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dbmfje32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gbjegg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ckphamkp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlpeol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Olgdgibf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amodnenk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjjnkkjp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ibhlmgdj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odooqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jlqohhja.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Opnbjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qgkeep32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jncfmgfi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lbkkpb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abmbaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mabnlh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ljibdifc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebiffc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hpaibe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iafogggl.exe - Executes dropped EXE 64 IoCs
pid Process 4408 Fdbdkn32.exe 3252 Fnjhccnd.exe 4872 Fgbmliee.exe 6292 Fnmeic32.exe 4524 Fdfmfmdo.exe 1404 Folacfcd.exe 4220 Fggfghap.exe 6944 Gnaodbhl.exe 5088 Ggicmh32.exe 1296 Gdncfl32.exe 3260 Ghnibj32.exe 3364 Gafmkp32.exe 2080 Hnmnpano.exe 6344 Hdgfmk32.exe 1492 Holjjd32.exe 4520 Hdicbkci.exe 1812 Hnagkp32.exe 6136 Hkehdd32.exe 4340 Hbppaopp.exe 6920 Hgliie32.exe 1300 Hdpicj32.exe 1248 Ikjapden.exe 6488 Ifpemmdd.exe 4880 Igabdekb.exe 6220 Ibffbnjh.exe 1712 Ikokkc32.exe 6284 Ifdohl32.exe 4276 Iomcqa32.exe 4628 Iejlih32.exe 3848 Ioopfa32.exe 4820 Jelioh32.exe 5668 Jfkehk32.exe 5824 Jkhnab32.exe 2752 Jfnbnk32.exe 4396 Jilnjf32.exe 2880 Jnifbmfo.exe 6692 Jecoog32.exe 6680 Jphcmp32.exe 5272 Jfbkijdo.exe 5404 Jpkpbpko.exe 4972 Kfehoj32.exe 7068 Klapgq32.exe 7076 Kfgddi32.exe 7112 Kbneij32.exe 2876 Kihnfdmj.exe 1564 Knefnkla.exe 3820 Keonke32.exe 4464 Kpdbhn32.exe 5424 Keakqeal.exe 1852 Knipik32.exe 4660 Lhbdbpnm.exe 3976 Lnlloj32.exe 4704 Lefdld32.exe 3380 Lpkiim32.exe 4468 Lhfmmp32.exe 4836 Loqejjad.exe 6664 Lifjgb32.exe 6928 Locbpi32.exe 1100 Lihfmb32.exe 5196 Mbqkfhfh.exe 4120 Mikcbb32.exe 6592 Moglkikl.exe 1444 Meadgc32.exe 4292 Mpghel32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Elhdpq32.dll Oclkqihc.exe File created C:\Windows\SysWOW64\Qhbogb32.dll Lkjlciem.exe File created C:\Windows\SysWOW64\Lefllfkj.dll Bkmmkj32.exe File created C:\Windows\SysWOW64\Pbnghq32.dll Ldgclgcl.exe File opened for modification C:\Windows\SysWOW64\Egjobl32.exe Dbmfje32.exe File opened for modification C:\Windows\SysWOW64\Poodicio.exe Phekliab.exe File created C:\Windows\SysWOW64\Kkbhkj32.dll Aflabj32.exe File created C:\Windows\SysWOW64\Phaabm32.exe Pmlmdd32.exe File created C:\Windows\SysWOW64\Feoqiq32.dll Glpmkm32.exe File opened for modification C:\Windows\SysWOW64\Ijnqld32.exe Idahcm32.exe File created C:\Windows\SysWOW64\Caciik32.dll Ijnqld32.exe File created C:\Windows\SysWOW64\Hbpndc32.dll Jkligd32.exe File created C:\Windows\SysWOW64\Mjhepnno.exe Mgjicb32.exe File opened for modification C:\Windows\SysWOW64\Ejklfd32.exe Dabhmo32.exe File created C:\Windows\SysWOW64\Ccpdhfmb.exe Cijpkmml.exe File created C:\Windows\SysWOW64\Clnhlfmc.dll Knfeoobh.exe File created C:\Windows\SysWOW64\Efbllhfb.exe Eohcon32.exe File opened for modification C:\Windows\SysWOW64\Ofhkgeij.exe Opnbjk32.exe File created C:\Windows\SysWOW64\Lihfmb32.exe Locbpi32.exe File created C:\Windows\SysWOW64\Omdaai32.dll Cipppc32.exe File opened for modification C:\Windows\SysWOW64\Ajpqhdkl.exe Acfhkj32.exe File created C:\Windows\SysWOW64\Cobkbhgk.exe Cihcen32.exe File opened for modification C:\Windows\SysWOW64\Akipdg32.exe Qmepkb32.exe File opened for modification C:\Windows\SysWOW64\Cppfgnlj.exe Cifmjd32.exe File created C:\Windows\SysWOW64\Bldljh32.exe Bekdmnio.exe File created C:\Windows\SysWOW64\Gehbcb32.exe Gbjegg32.exe File created C:\Windows\SysWOW64\Iedjfodg.exe Icfnjcec.exe File opened for modification C:\Windows\SysWOW64\Bmfjodgc.exe Aflabj32.exe File created C:\Windows\SysWOW64\Fdamph32.exe Ffmmgceo.exe File opened for modification C:\Windows\SysWOW64\Jcjgeb32.exe Jlqohhja.exe File created C:\Windows\SysWOW64\Encgofhl.exe Egjobl32.exe File created C:\Windows\SysWOW64\Dlmlmiid.dll Kpdbhn32.exe File opened for modification C:\Windows\SysWOW64\Djomjfde.exe Cpihmmdo.exe File created C:\Windows\SysWOW64\Hplimpdi.exe Hkpqdifa.exe File opened for modification C:\Windows\SysWOW64\Geohdago.exe Goepgg32.exe File created C:\Windows\SysWOW64\Kihnfdmj.exe Kbneij32.exe File created C:\Windows\SysWOW64\Hdedfgcg.dll Iocliecb.exe File created C:\Windows\SysWOW64\Mbpkhp32.dll Cifmjd32.exe File created C:\Windows\SysWOW64\Nldhpeop.exe Naodbm32.exe File opened for modification C:\Windows\SysWOW64\Dfjpppbh.exe Dpphcf32.exe File created C:\Windows\SysWOW64\Qmepkb32.exe Qldccjno.exe File created C:\Windows\SysWOW64\Mllqpaej.dll Ckaolcol.exe File created C:\Windows\SysWOW64\Aqmldddb.exe Agdhln32.exe File opened for modification C:\Windows\SysWOW64\Bmkcjd32.exe Bfqkmj32.exe File created C:\Windows\SysWOW64\Menpgmap.exe Mhjpnibf.exe File opened for modification C:\Windows\SysWOW64\Combgh32.exe Bfenncdp.exe File created C:\Windows\SysWOW64\Jgaldkid.dll Gkfnnjnl.exe File created C:\Windows\SysWOW64\Lcmcpl32.dll Lklbnb32.exe File created C:\Windows\SysWOW64\Bjjfnk32.dll Poaqocgl.exe File opened for modification C:\Windows\SysWOW64\Ihnkobpl.exe Inhgaipf.exe File opened for modification C:\Windows\SysWOW64\Hmpclnof.exe Hoobnf32.exe File created C:\Windows\SysWOW64\Mkmcfe32.dll Geohdago.exe File opened for modification C:\Windows\SysWOW64\Imkbglei.exe Iedjfodg.exe File created C:\Windows\SysWOW64\Kaegqh32.dll Nabfcegi.exe File opened for modification C:\Windows\SysWOW64\Bkjikd32.exe Bdpanj32.exe File created C:\Windows\SysWOW64\Kfehoj32.exe Jpkpbpko.exe File created C:\Windows\SysWOW64\Ldjbbc32.dll Naodbm32.exe File opened for modification C:\Windows\SysWOW64\Mgjicb32.exe Mqpqghgn.exe File created C:\Windows\SysWOW64\Jklpnidh.dll Lifjgb32.exe File created C:\Windows\SysWOW64\Nohdaf32.exe Niklip32.exe File created C:\Windows\SysWOW64\Ngaiilfq.dll Bjodch32.exe File created C:\Windows\SysWOW64\Idailabn.dll Jhndepbi.exe File created C:\Windows\SysWOW64\Bjmjinog.dll Ngehoqdn.exe File opened for modification C:\Windows\SysWOW64\Jngbcj32.exe Jcanfakf.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3516 3324 WerFault.exe 782 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebapednb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjccna32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mminaikp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmnhgdjo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdfmfmdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikokkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jhndepbi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajpqhdkl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bjicnbba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eidlhj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjlmmbfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aajggjap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lihfmb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eagahnob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llofnh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dblgja32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dnpdom32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ppeikjle.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bonhqnpi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdamph32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmenmgab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnahmo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chfepa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Egjobl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpkiim32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmehnn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lalnfooo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Peobeh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Headjael.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnjqfeld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghnibj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keakqeal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lkjlciem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Poajdlcq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ecipeb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Clplff32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibadoc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ehlhbn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qmccecfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-16_6e8236bb4766a85b93a8c1bfc78ed930_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bcboan32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgbdml32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjgneg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ifdohl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jilnjf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlnijmhc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Naaqhlmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cjjlep32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jfkehk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bjjjhifm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pkigmiai.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lqcjqcnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iqmincia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cihcen32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bkibqnah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mgjicb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Folacfcd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghhhmebd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbiede32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhhchi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Plpqba32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pljalipc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edjgpi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nbcjhobg.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jfbkijdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnemabne.dll" Dkpbgh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnjqac32.dll" Elpknehe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gageoman.dll" Gmndjf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oopjchnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcndda32.dll" Fbkblb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfgacigf.dll" Hdicbkci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jdnnjane.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Objphn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbnghq32.dll" Ldgclgcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nmenmgab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hgfaij32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iedjfodg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qfkqcb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dpphcf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojigbcoh.dll" Bkjikd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ckphamkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehcllpla.dll" Fkcgdh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nohdaf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lkjlciem.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Plkpmlfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bcdlgnkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgdjha32.dll" Boflfiai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hpabho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ccbhhl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fphneijl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bbbkmebo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cbnkhcha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iloimopp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bnfiapfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgmbbfja.dll" Fbellhbi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gbjegg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hhoomd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Peobeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmaoao32.dll" Mfqlph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onidqakc.dll" Ppeikjle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mebchf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dnhgcgbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pllggbje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ckaolcol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 2026-08-16_6e8236bb4766a85b93a8c1bfc78ed930_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oldijd32.dll" Jelioh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pedlpgqe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ecipeb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkncmmig.dll" Felbhdgd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bkkofn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gebpgmop.dll" Ccpdhfmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dbikdbnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ffnkggld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paceoa32.dll" Bonhqnpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqhicdkm.dll" Lagekp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ibffbnjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nmenmgab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Efbllhfb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ooaghe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dplebmbl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jnfcbg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ombanm32.dll" Inecac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jflkmqpj.dll" Nalpbf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gppcfk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Inhgaipf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ibhlmgdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnbaba32.dll" Cihcen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laheqjdd.dll" Qldccjno.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6960 wrote to memory of 4408 6960 2026-08-16_6e8236bb4766a85b93a8c1bfc78ed930_elex_wannacry.exe 90 PID 4408 wrote to memory of 3252 4408 Fdbdkn32.exe 91 PID 3252 wrote to memory of 4872 3252 Fnjhccnd.exe 92 PID 4872 wrote to memory of 6292 4872 Fgbmliee.exe 93 PID 6292 wrote to memory of 4524 6292 Fnmeic32.exe 94 PID 4524 wrote to memory of 1404 4524 Fdfmfmdo.exe 95 PID 1404 wrote to memory of 4220 1404 Folacfcd.exe 96 PID 4220 wrote to memory of 6944 4220 Fggfghap.exe 97 PID 6944 wrote to memory of 5088 6944 Gnaodbhl.exe 98 PID 5088 wrote to memory of 1296 5088 Ggicmh32.exe 99 PID 1296 wrote to memory of 3260 1296 Gdncfl32.exe 100 PID 3260 wrote to memory of 3364 3260 Ghnibj32.exe 101 PID 3364 wrote to memory of 2080 3364 Gafmkp32.exe 102 PID 2080 wrote to memory of 6344 2080 Hnmnpano.exe 103 PID 6344 wrote to memory of 1492 6344 Hdgfmk32.exe 104 PID 1492 wrote to memory of 4520 1492 Holjjd32.exe 105 PID 4520 wrote to memory of 1812 4520 Hdicbkci.exe 106 PID 1812 wrote to memory of 6136 1812 Hnagkp32.exe 107 PID 6136 wrote to memory of 4340 6136 Hkehdd32.exe 108 PID 4340 wrote to memory of 6920 4340 Hbppaopp.exe 109 PID 6920 wrote to memory of 1300 6920 Hgliie32.exe 110 PID 1300 wrote to memory of 1248 1300 Hdpicj32.exe 111 PID 1248 wrote to memory of 6488 1248 Ikjapden.exe 112 PID 6488 wrote to memory of 4880 6488 Ifpemmdd.exe 113 PID 4880 wrote to memory of 6220 4880 Igabdekb.exe 114 PID 6220 wrote to memory of 1712 6220 Ibffbnjh.exe 115 PID 1712 wrote to memory of 6284 1712 Ikokkc32.exe 116 PID 6284 wrote to memory of 4276 6284 Ifdohl32.exe 117 PID 4276 wrote to memory of 4628 4276 Iomcqa32.exe 118 PID 4628 wrote to memory of 3848 4628 Iejlih32.exe 119 PID 3848 wrote to memory of 4820 3848 Ioopfa32.exe 120 PID 4820 wrote to memory of 5668 4820 Jelioh32.exe 121 PID 5668 wrote to memory of 5824 5668 Jfkehk32.exe 122 PID 5824 wrote to memory of 2752 5824 Jkhnab32.exe 123 PID 2752 wrote to memory of 4396 2752 Jfnbnk32.exe 124 PID 4396 wrote to memory of 2880 4396 Jilnjf32.exe 125 PID 2880 wrote to memory of 6692 2880 Jnifbmfo.exe 126 PID 6692 wrote to memory of 6680 6692 Jecoog32.exe 127 PID 6680 wrote to memory of 5272 6680 Jphcmp32.exe 128 PID 5272 wrote to memory of 5404 5272 Jfbkijdo.exe 129 PID 5404 wrote to memory of 4972 5404 Jpkpbpko.exe 130 PID 4972 wrote to memory of 7068 4972 Kfehoj32.exe 131 PID 7068 wrote to memory of 7076 7068 Klapgq32.exe 132 PID 7076 wrote to memory of 7112 7076 Kfgddi32.exe 133 PID 7112 wrote to memory of 2876 7112 Kbneij32.exe 134 PID 2876 wrote to memory of 1564 2876 Kihnfdmj.exe 135 PID 1564 wrote to memory of 3820 1564 Knefnkla.exe 136 PID 3820 wrote to memory of 4464 3820 Keonke32.exe 137 PID 4464 wrote to memory of 5424 4464 Kpdbhn32.exe 138 PID 5424 wrote to memory of 1852 5424 Keakqeal.exe 139 PID 1852 wrote to memory of 4660 1852 Knipik32.exe 140 PID 4660 wrote to memory of 3976 4660 Lhbdbpnm.exe 141 PID 3976 wrote to memory of 4704 3976 Lnlloj32.exe 142 PID 4704 wrote to memory of 3380 4704 Lefdld32.exe 143 PID 3380 wrote to memory of 4468 3380 Lpkiim32.exe 144 PID 4468 wrote to memory of 4836 4468 Lhfmmp32.exe 145 PID 4836 wrote to memory of 6664 4836 Loqejjad.exe 146 PID 6664 wrote to memory of 6928 6664 Lifjgb32.exe 147 PID 6928 wrote to memory of 1100 6928 Locbpi32.exe 148 PID 1100 wrote to memory of 5196 1100 Lihfmb32.exe 149 PID 5196 wrote to memory of 4120 5196 Mbqkfhfh.exe 150 PID 4120 wrote to memory of 6592 4120 Mikcbb32.exe 151 PID 6592 wrote to memory of 1444 6592 Moglkikl.exe 152 PID 1444 wrote to memory of 4292 1444 Meadgc32.exe 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_6e8236bb4766a85b93a8c1bfc78ed930_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_6e8236bb4766a85b93a8c1bfc78ed930_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6960 -
C:\Windows\SysWOW64\Fdbdkn32.exeC:\Windows\system32\Fdbdkn32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\Fnjhccnd.exeC:\Windows\system32\Fnjhccnd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\Fgbmliee.exeC:\Windows\system32\Fgbmliee.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\Fnmeic32.exeC:\Windows\system32\Fnmeic32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6292 -
C:\Windows\SysWOW64\Fdfmfmdo.exeC:\Windows\system32\Fdfmfmdo.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\Folacfcd.exeC:\Windows\system32\Folacfcd.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\Fggfghap.exeC:\Windows\system32\Fggfghap.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\Gnaodbhl.exeC:\Windows\system32\Gnaodbhl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6944 -
C:\Windows\SysWOW64\Ggicmh32.exeC:\Windows\system32\Ggicmh32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\Gdncfl32.exeC:\Windows\system32\Gdncfl32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\Ghnibj32.exeC:\Windows\system32\Ghnibj32.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\Gafmkp32.exeC:\Windows\system32\Gafmkp32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\Hnmnpano.exeC:\Windows\system32\Hnmnpano.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\Hdgfmk32.exeC:\Windows\system32\Hdgfmk32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6344 -
C:\Windows\SysWOW64\Holjjd32.exeC:\Windows\system32\Holjjd32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\Hdicbkci.exeC:\Windows\system32\Hdicbkci.exe17⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\Hnagkp32.exeC:\Windows\system32\Hnagkp32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\Hkehdd32.exeC:\Windows\system32\Hkehdd32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Windows\SysWOW64\Hbppaopp.exeC:\Windows\system32\Hbppaopp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\Hgliie32.exeC:\Windows\system32\Hgliie32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6920 -
C:\Windows\SysWOW64\Hdpicj32.exeC:\Windows\system32\Hdpicj32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\Ikjapden.exeC:\Windows\system32\Ikjapden.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\Ifpemmdd.exeC:\Windows\system32\Ifpemmdd.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6488 -
C:\Windows\SysWOW64\Igabdekb.exeC:\Windows\system32\Igabdekb.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\Ibffbnjh.exeC:\Windows\system32\Ibffbnjh.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6220 -
C:\Windows\SysWOW64\Ikokkc32.exeC:\Windows\system32\Ikokkc32.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\Ifdohl32.exeC:\Windows\system32\Ifdohl32.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6284 -
C:\Windows\SysWOW64\Iomcqa32.exeC:\Windows\system32\Iomcqa32.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\Iejlih32.exeC:\Windows\system32\Iejlih32.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\Ioopfa32.exeC:\Windows\system32\Ioopfa32.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\Jelioh32.exeC:\Windows\system32\Jelioh32.exe32⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\Jfkehk32.exeC:\Windows\system32\Jfkehk32.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\Jkhnab32.exeC:\Windows\system32\Jkhnab32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\Jfnbnk32.exeC:\Windows\system32\Jfnbnk32.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\Jilnjf32.exeC:\Windows\system32\Jilnjf32.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\Jnifbmfo.exeC:\Windows\system32\Jnifbmfo.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\Jecoog32.exeC:\Windows\system32\Jecoog32.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6692 -
C:\Windows\SysWOW64\Jphcmp32.exeC:\Windows\system32\Jphcmp32.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6680 -
C:\Windows\SysWOW64\Jfbkijdo.exeC:\Windows\system32\Jfbkijdo.exe40⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Windows\SysWOW64\Jpkpbpko.exeC:\Windows\system32\Jpkpbpko.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\SysWOW64\Kfehoj32.exeC:\Windows\system32\Kfehoj32.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\Klapgq32.exeC:\Windows\system32\Klapgq32.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7068 -
C:\Windows\SysWOW64\Kfgddi32.exeC:\Windows\system32\Kfgddi32.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7076 -
C:\Windows\SysWOW64\Kbneij32.exeC:\Windows\system32\Kbneij32.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:7112 -
C:\Windows\SysWOW64\Kihnfdmj.exeC:\Windows\system32\Kihnfdmj.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\Knefnkla.exeC:\Windows\system32\Knefnkla.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\Keonke32.exeC:\Windows\system32\Keonke32.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\Kpdbhn32.exeC:\Windows\system32\Kpdbhn32.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\Keakqeal.exeC:\Windows\system32\Keakqeal.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Windows\SysWOW64\Knipik32.exeC:\Windows\system32\Knipik32.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\Lhbdbpnm.exeC:\Windows\system32\Lhbdbpnm.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\Lnlloj32.exeC:\Windows\system32\Lnlloj32.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\Lefdld32.exeC:\Windows\system32\Lefdld32.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\Lpkiim32.exeC:\Windows\system32\Lpkiim32.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\Lhfmmp32.exeC:\Windows\system32\Lhfmmp32.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\Loqejjad.exeC:\Windows\system32\Loqejjad.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\Lifjgb32.exeC:\Windows\system32\Lifjgb32.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:6664 -
C:\Windows\SysWOW64\Locbpi32.exeC:\Windows\system32\Locbpi32.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:6928 -
C:\Windows\SysWOW64\Lihfmb32.exeC:\Windows\system32\Lihfmb32.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\Mbqkfhfh.exeC:\Windows\system32\Mbqkfhfh.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Windows\SysWOW64\Mikcbb32.exeC:\Windows\system32\Mikcbb32.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\Moglkikl.exeC:\Windows\system32\Moglkikl.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6592 -
C:\Windows\SysWOW64\Meadgc32.exeC:\Windows\system32\Meadgc32.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\Mpghel32.exeC:\Windows\system32\Mpghel32.exe65⤵
- Executes dropped EXE
PID:4292 -
C:\Windows\SysWOW64\Mfaqafjl.exeC:\Windows\system32\Mfaqafjl.exe66⤵PID:2612
-
C:\Windows\SysWOW64\Mlnijmhc.exeC:\Windows\system32\Mlnijmhc.exe67⤵
- System Location Discovery: System Language Discovery
PID:3904 -
C:\Windows\SysWOW64\Mefmbbod.exeC:\Windows\system32\Mefmbbod.exe68⤵PID:5448
-
C:\Windows\SysWOW64\Mlpeol32.exeC:\Windows\system32\Mlpeol32.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2236 -
C:\Windows\SysWOW64\Mfejme32.exeC:\Windows\system32\Mfejme32.exe70⤵PID:5524
-
C:\Windows\SysWOW64\Mlbbel32.exeC:\Windows\system32\Mlbbel32.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5420 -
C:\Windows\SysWOW64\Nfhfbedd.exeC:\Windows\system32\Nfhfbedd.exe72⤵PID:6516
-
C:\Windows\SysWOW64\Nockfgao.exeC:\Windows\system32\Nockfgao.exe73⤵PID:5860
-
C:\Windows\SysWOW64\Niipdpae.exeC:\Windows\system32\Niipdpae.exe74⤵PID:2424
-
C:\Windows\SysWOW64\Npbhqj32.exeC:\Windows\system32\Npbhqj32.exe75⤵PID:1704
-
C:\Windows\SysWOW64\Nbadmege.exeC:\Windows\system32\Nbadmege.exe76⤵PID:2704
-
C:\Windows\SysWOW64\Niklip32.exeC:\Windows\system32\Niklip32.exe77⤵
- Drops file in System32 directory
PID:4516 -
C:\Windows\SysWOW64\Nohdaf32.exeC:\Windows\system32\Nohdaf32.exe78⤵
- Modifies registry class
PID:3264 -
C:\Windows\SysWOW64\Nebmnqdf.exeC:\Windows\system32\Nebmnqdf.exe79⤵PID:1868
-
C:\Windows\SysWOW64\Nllekk32.exeC:\Windows\system32\Nllekk32.exe80⤵PID:4868
-
C:\Windows\SysWOW64\Nedjdp32.exeC:\Windows\system32\Nedjdp32.exe81⤵PID:5396
-
C:\Windows\SysWOW64\Nlnbqjjq.exeC:\Windows\system32\Nlnbqjjq.exe82⤵PID:5512
-
C:\Windows\SysWOW64\Oeffip32.exeC:\Windows\system32\Oeffip32.exe83⤵PID:4100
-
C:\Windows\SysWOW64\Oplkgi32.exeC:\Windows\system32\Oplkgi32.exe84⤵PID:2288
-
C:\Windows\SysWOW64\Ogfccchd.exeC:\Windows\system32\Ogfccchd.exe85⤵PID:4144
-
C:\Windows\SysWOW64\Ohgokknb.exeC:\Windows\system32\Ohgokknb.exe86⤵PID:2832
-
C:\Windows\SysWOW64\Ooaghe32.exeC:\Windows\system32\Ooaghe32.exe87⤵
- Modifies registry class
PID:4484 -
C:\Windows\SysWOW64\Ohjlqklp.exeC:\Windows\system32\Ohjlqklp.exe88⤵PID:6176
-
C:\Windows\SysWOW64\Ocopncke.exeC:\Windows\system32\Ocopncke.exe89⤵PID:6732
-
C:\Windows\SysWOW64\Olgdgibf.exeC:\Windows\system32\Olgdgibf.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4624 -
C:\Windows\SysWOW64\Ogmidbal.exeC:\Windows\system32\Ogmidbal.exe91⤵PID:1884
-
C:\Windows\SysWOW64\Pljalipc.exeC:\Windows\system32\Pljalipc.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:6184 -
C:\Windows\SysWOW64\Pebfen32.exeC:\Windows\system32\Pebfen32.exe93⤵PID:5728
-
C:\Windows\SysWOW64\Pphjbgfj.exeC:\Windows\system32\Pphjbgfj.exe94⤵PID:4860
-
C:\Windows\SysWOW64\Pjpokm32.exeC:\Windows\system32\Pjpokm32.exe95⤵PID:3312
-
C:\Windows\SysWOW64\Pomgcc32.exeC:\Windows\system32\Pomgcc32.exe96⤵PID:5300
-
C:\Windows\SysWOW64\Phekliab.exeC:\Windows\system32\Phekliab.exe97⤵
- Drops file in System32 directory
PID:1520 -
C:\Windows\SysWOW64\Poodicio.exeC:\Windows\system32\Poodicio.exe98⤵PID:6392
-
C:\Windows\SysWOW64\Phhhbi32.exeC:\Windows\system32\Phhhbi32.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4688 -
C:\Windows\SysWOW64\Poaqocgl.exeC:\Windows\system32\Poaqocgl.exe100⤵
- Drops file in System32 directory
PID:6204 -
C:\Windows\SysWOW64\Pflikm32.exeC:\Windows\system32\Pflikm32.exe101⤵PID:5116
-
C:\Windows\SysWOW64\Qleahgff.exeC:\Windows\system32\Qleahgff.exe102⤵PID:5452
-
C:\Windows\SysWOW64\Qgkeep32.exeC:\Windows\system32\Qgkeep32.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5564 -
C:\Windows\SysWOW64\Qlhnng32.exeC:\Windows\system32\Qlhnng32.exe104⤵PID:4728
-
C:\Windows\SysWOW64\Acdbpq32.exeC:\Windows\system32\Acdbpq32.exe105⤵PID:7020
-
C:\Windows\SysWOW64\Aokceaoa.exeC:\Windows\system32\Aokceaoa.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6232 -
C:\Windows\SysWOW64\Amodnenk.exeC:\Windows\system32\Amodnenk.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5984 -
C:\Windows\SysWOW64\Agdhln32.exeC:\Windows\system32\Agdhln32.exe108⤵
- Drops file in System32 directory
PID:6820 -
C:\Windows\SysWOW64\Aqmldddb.exeC:\Windows\system32\Aqmldddb.exe109⤵PID:4960
-
C:\Windows\SysWOW64\Aggean32.exeC:\Windows\system32\Aggean32.exe110⤵PID:6364
-
C:\Windows\SysWOW64\Aihaifam.exeC:\Windows\system32\Aihaifam.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7124 -
C:\Windows\SysWOW64\Aobieq32.exeC:\Windows\system32\Aobieq32.exe112⤵PID:3156
-
C:\Windows\SysWOW64\Aflabj32.exeC:\Windows\system32\Aflabj32.exe113⤵
- Drops file in System32 directory
PID:6596 -
C:\Windows\SysWOW64\Bmfjodgc.exeC:\Windows\system32\Bmfjodgc.exe114⤵PID:6688
-
C:\Windows\SysWOW64\Bgknlmgi.exeC:\Windows\system32\Bgknlmgi.exe115⤵PID:6164
-
C:\Windows\SysWOW64\Bjjjhifm.exeC:\Windows\system32\Bjjjhifm.exe116⤵
- System Location Discovery: System Language Discovery
PID:4608 -
C:\Windows\SysWOW64\Bcboan32.exeC:\Windows\system32\Bcboan32.exe117⤵
- System Location Discovery: System Language Discovery
PID:5688 -
C:\Windows\SysWOW64\Bfqkmj32.exeC:\Windows\system32\Bfqkmj32.exe118⤵
- Drops file in System32 directory
PID:6320 -
C:\Windows\SysWOW64\Bmkcjd32.exeC:\Windows\system32\Bmkcjd32.exe119⤵PID:6824
-
C:\Windows\SysWOW64\Bcdlgnkk.exeC:\Windows\system32\Bcdlgnkk.exe120⤵
- Modifies registry class
PID:5960 -
C:\Windows\SysWOW64\Bjodch32.exeC:\Windows\system32\Bjodch32.exe121⤵
- Drops file in System32 directory
PID:3960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-