Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 12:17
Behavioral task
behavioral1
Sample
2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe
- Size 429KB
- Sample260930-pf91esvsd1
- SHA256 7526ece772f73e29ef6e936297bd17b82346f084b2666bfa3a26709e4f328a4c
- MD5 3a5e5da8ff06c8d566d0d0610c6f8356
- SHA1 ca20518f4ca1fa4df5c23cb41f151a8e3836c3e5
- SHA512 6c78d60511981df5327b3c49fe520cd49a6949012e7d33f47ce8b402b2a2c142bcb8d3a303d8915389c61f6caf395314943034348b31e304eba25253b4acb68f
- SSDEEP 6144:D8/X14q//3V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:D4iIm/NcZ7/N
- TLSH T1BE94746566342AE6EDEEABB9AC1249D881C1E4B114F1F13E6633DFDCC8E5D61CC04B81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjaciafc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Agdcja32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efccfojn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgipmdmn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Peeakakg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebimqi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mqhmbqlh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oplfekdp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pdenghpi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnhgcgbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iciaji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mnhkklbb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mebchf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oclkqihc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cckkmg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgjicb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ohfafn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bkjikd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Klahof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hphpap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nlhkqngo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Klceeejl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nflkkf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpodhf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebejpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fldeie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hgokikan.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Inlibb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Innfgb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ahpmckpn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Anmfkane.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Adfnhlfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oagpne32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gejoib32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kodnfqgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ejaklmpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kgiibnib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lljked32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bnjkbi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgdlqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fpjcpbdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ekkkip32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mogccnfg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oagpne32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oejbpb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Boqlqd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ojajbdde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mmdefi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aeodapcl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iikmlnae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hckeikcl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lknocb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aonokdce.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gnnjgh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Boenam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Elnoifjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ikickgnf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmdefi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mebchf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Olmdln32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdicdi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ckealm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Diafkl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkbohc32.exe - Executes dropped EXE 64 IoCs
pid Process 4224 Cckkmg32.exe 2332 Ckfpai32.exe 2448 Cijpkmml.exe 5672 Cfnqdale.exe 4632 Cmhial32.exe 3488 Dmjefkap.exe 1400 Diafkl32.exe 2788 Djqbeonf.exe 1492 Dpbdiehi.exe 4124 Dflmep32.exe 3596 Emfebjgb.exe 4076 Ebejpp32.exe 1724 Elnoifjg.exe 3192 Efccfojn.exe 1196 Emmkci32.exe 3816 Ejaklmpd.exe 4712 Ecipeb32.exe 2620 Fldeie32.exe 6008 Fjfegl32.exe 4188 Flgaodbm.exe 3276 Fmfnig32.exe 2692 Fbcfan32.exe 356 Fpggkbfq.exe 1344 Fjmkhkff.exe 6032 Fpjcpbdn.exe 2924 Gibhihko.exe 6020 Gffhbljh.exe 2960 Gbmigm32.exe 6000 Gdleap32.exe 4668 Gmdjjemp.exe 5028 Gljgkb32.exe 1472 Hgokikan.exe 4052 Hphpap32.exe 1340 Hipdjfoo.exe 4320 Hdehho32.exe 1180 Hmnmqdee.exe 2244 Hckeikcl.exe 4696 Hmpjfdcb.exe 4208 Hdjbcnjo.exe 1304 Hkdjph32.exe 5640 Hlefgphj.exe 4524 Ikfgeh32.exe 988 Ilhcmpeg.exe 1448 Ikickgnf.exe 5712 Idahcm32.exe 1676 Ikkppgld.exe 1884 Icfediio.exe 5540 Inlibb32.exe 4520 Iciaji32.exe 4340 Innfgb32.exe 824 Jdhndlno.exe 1336 Jnqbmadp.exe 4752 Jdkkjl32.exe 3840 Jjgcbb32.exe 4144 Jcphkhad.exe 2424 Jjjpgb32.exe 4724 Jpdhdl32.exe 4676 Jgnqafgk.exe 1076 Jnhinq32.exe 4020 Jdaajkfd.exe 5840 Jjoibadl.exe 5648 Jqhaolli.exe 4400 Kknfmdko.exe 2672 Kmobdm32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Ofiima32.dll Jeidan32.exe File created C:\Windows\SysWOW64\Mmcnlc32.exe Lopmbomp.exe File created C:\Windows\SysWOW64\Aojabkqc.dll Ppgeqijb.exe File opened for modification C:\Windows\SysWOW64\Cbmdnmdf.exe Cdicdi32.exe File created C:\Windows\SysWOW64\Kodnfqgm.exe Kgiibnib.exe File created C:\Windows\SysWOW64\Nfohafad.exe Nmfchq32.exe File opened for modification C:\Windows\SysWOW64\Bobalm32.exe Bhhiocdg.exe File created C:\Windows\SysWOW64\Cfnqdale.exe Cijpkmml.exe File created C:\Windows\SysWOW64\Ccoolcnf.dll Innfgb32.exe File opened for modification C:\Windows\SysWOW64\Npnjcm32.exe Nnmmleja.exe File created C:\Windows\SysWOW64\Jnajolfl.dll Gnlmai32.exe File opened for modification C:\Windows\SysWOW64\Gffhbljh.exe Gibhihko.exe File opened for modification C:\Windows\SysWOW64\Jpnhof32.exe Jeidan32.exe File created C:\Windows\SysWOW64\Mopoei32.dll Ikfgeh32.exe File created C:\Windows\SysWOW64\Dndnjllg.exe Dbnmek32.exe File created C:\Windows\SysWOW64\Hneijndb.dll Gbmigm32.exe File created C:\Windows\SysWOW64\Hipdjfoo.exe Hphpap32.exe File created C:\Windows\SysWOW64\Qmccecfp.exe Pdkolm32.exe File created C:\Windows\SysWOW64\Gmfpeoga.exe Gbqlhfgk.exe File created C:\Windows\SysWOW64\Modgnn32.exe Mflbdibj.exe File created C:\Windows\SysWOW64\Pojkjo32.dll Ocjokijf.exe File created C:\Windows\SysWOW64\Ckealm32.exe Cponodge.exe File created C:\Windows\SysWOW64\Dqkmkb32.exe Dojqcjgi.exe File created C:\Windows\SysWOW64\Fpjcpbdn.exe Fjmkhkff.exe File created C:\Windows\SysWOW64\Hlefgphj.exe Hkdjph32.exe File created C:\Windows\SysWOW64\Ohfafn32.exe Onnmmipj.exe File created C:\Windows\SysWOW64\Cbmdnmdf.exe Cdicdi32.exe File opened for modification C:\Windows\SysWOW64\Emldhb32.exe Enkdjkep.exe File opened for modification C:\Windows\SysWOW64\Nfohafad.exe Nmfchq32.exe File opened for modification C:\Windows\SysWOW64\Mmdefi32.exe Leipbg32.exe File opened for modification C:\Windows\SysWOW64\Bnmobopb.exe Bddjijia.exe File created C:\Windows\SysWOW64\Cnaachha.exe Cdhmjc32.exe File created C:\Windows\SysWOW64\Ckfpai32.exe Cckkmg32.exe File created C:\Windows\SysWOW64\Bmijllek.dll Diafkl32.exe File created C:\Windows\SysWOW64\Eqqchjad.dll Gmfpeoga.exe File created C:\Windows\SysWOW64\Cijpkmml.exe Ckfpai32.exe File created C:\Windows\SysWOW64\Aoeleelp.exe Ahkdhk32.exe File created C:\Windows\SysWOW64\Pnkbdqpo.exe Pdenghpi.exe File created C:\Windows\SysWOW64\Dmjefkap.exe Cmhial32.exe File opened for modification C:\Windows\SysWOW64\Fjfegl32.exe Fldeie32.exe File opened for modification C:\Windows\SysWOW64\Fpggkbfq.exe Fbcfan32.exe File created C:\Windows\SysWOW64\Enkdjkep.exe Eiokbd32.exe File created C:\Windows\SysWOW64\Giaaoa32.exe Gnlmai32.exe File created C:\Windows\SysWOW64\Ckgmjh32.dll Iibclmkn.exe File opened for modification C:\Windows\SysWOW64\Nmbaggce.exe Ncjmob32.exe File opened for modification C:\Windows\SysWOW64\Iebnqofj.exe Iohede32.exe File opened for modification C:\Windows\SysWOW64\Ppgeqijb.exe Pnfiia32.exe File created C:\Windows\SysWOW64\Joioak32.dll Fbcfan32.exe File created C:\Windows\SysWOW64\Bnjkbi32.exe Bpfkiepp.exe File created C:\Windows\SysWOW64\Himafm32.dll Ejaklmpd.exe File opened for modification C:\Windows\SysWOW64\Fmcjiagf.exe Fbnflihq.exe File created C:\Windows\SysWOW64\Idhdieal.dll Ofaeffpa.exe File opened for modification C:\Windows\SysWOW64\Fbcfan32.exe Fmfnig32.exe File opened for modification C:\Windows\SysWOW64\Aagkaj32.exe Akmbepke.exe File opened for modification C:\Windows\SysWOW64\Cckkmg32.exe 2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe File created C:\Windows\SysWOW64\Mdhbpkgj.dll Lgqfmcge.exe File created C:\Windows\SysWOW64\Kgiibnib.exe Klceeejl.exe File created C:\Windows\SysWOW64\Blamdb32.dll Ahmjce32.exe File opened for modification C:\Windows\SysWOW64\Qmccecfp.exe Pdkolm32.exe File created C:\Windows\SysWOW64\Ehfido32.dll Jgoflpal.exe File opened for modification C:\Windows\SysWOW64\Mflbdibj.exe Mmcnlc32.exe File created C:\Windows\SysWOW64\Nggnjjoo.exe Nmajmaoi.exe File opened for modification C:\Windows\SysWOW64\Fpjcpbdn.exe Fjmkhkff.exe File created C:\Windows\SysWOW64\Hmnmqdee.exe Hdehho32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4168 8628 WerFault.exe 399 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emfebjgb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nndjgjhe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onnmmipj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahkdhk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Adiknkco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpnfak32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lljked32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cponodge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikfgeh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhjbjp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojmhaklf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekhncp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnmmleja.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnlhhi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjfegl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Icfediio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ncjmob32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pdkolm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddgpfgil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ipplmh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kpjgjefj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdjbcnjo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdkkjl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdggoi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eeqclfaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpjcpbdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikkppgld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmdefi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnokhonp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmdjjemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebocpd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kgefae32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Napjnfik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Omegdebp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdleap32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdaajkfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekggijge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Naecieef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bkjikd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iiipfnch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npnjcm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmobdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cckkmg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hckeikcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hmpjfdcb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgnqafgk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jiiiml32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Modgnn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Akmbepke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cijpkmml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmhial32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Inlibb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Plmmbkdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aoeleelp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ipgbngfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgmbmn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pcnhfi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kqmkjk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oagpne32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bekdmnio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkbohc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmbaggce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emldhb32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aoeleelp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dhqoaf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iikmlnae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cponodge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mccfnc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naemmnec.dll" Adfnhlfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nmfchq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ocjokijf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gmdjjemp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ebejpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acnnof32.dll" Icfediio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jdhndlno.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dndnjllg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cgdlqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Baadbo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akemlo32.dll" Blieeglf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kqmkjk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Naecieef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Npnjcm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmeqhd32.dll" 2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eghhea32.dll" Emfebjgb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oeehdcij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Goccbhae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ppgeqijb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojilnl32.dll" Jqhaolli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ebimqi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glndff32.dll" Hpgigj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oggdgb32.dll" Mglfibmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ipplmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jngbcj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ponfdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dabjjipm.dll" Ddjmkg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lnjgpgkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbnjee32.dll" Cnaachha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fjmkhkff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkqokn32.dll" Fbellhbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obhnaa32.dll" Ipgbngfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnbcoe32.dll" Kcfgaq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Napjnfik.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Akmbepke.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Chkokq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Plmmbkdf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ddjmkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Giaaoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iiicin32.dll" Dqkmkb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hckeikcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dehknphd.dll" Dgpllm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mjokpm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dflmep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlbkifhp.dll" Hipdjfoo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eicemccc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lnjgpgkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbnibp32.dll" Aodejohd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cnaachha.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hlefgphj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdmdhmch.dll" Anmfkane.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dfpfokfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jmbhhkoa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Klahof32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jjoibadl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppmammbl.dll" Knoonphp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gonini32.dll" Nlhkqngo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oaigckee.dll" Dbnmek32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5572 wrote to memory of 4224 5572 2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe 88 PID 4224 wrote to memory of 2332 4224 Cckkmg32.exe 89 PID 2332 wrote to memory of 2448 2332 Ckfpai32.exe 90 PID 2448 wrote to memory of 5672 2448 Cijpkmml.exe 91 PID 5672 wrote to memory of 4632 5672 Cfnqdale.exe 92 PID 4632 wrote to memory of 3488 4632 Cmhial32.exe 93 PID 3488 wrote to memory of 1400 3488 Dmjefkap.exe 94 PID 1400 wrote to memory of 2788 1400 Diafkl32.exe 95 PID 2788 wrote to memory of 1492 2788 Djqbeonf.exe 96 PID 1492 wrote to memory of 4124 1492 Dpbdiehi.exe 97 PID 4124 wrote to memory of 3596 4124 Dflmep32.exe 98 PID 3596 wrote to memory of 4076 3596 Emfebjgb.exe 99 PID 4076 wrote to memory of 1724 4076 Ebejpp32.exe 100 PID 1724 wrote to memory of 3192 1724 Elnoifjg.exe 101 PID 3192 wrote to memory of 1196 3192 Efccfojn.exe 102 PID 1196 wrote to memory of 3816 1196 Emmkci32.exe 103 PID 3816 wrote to memory of 4712 3816 Ejaklmpd.exe 104 PID 4712 wrote to memory of 2620 4712 Ecipeb32.exe 105 PID 2620 wrote to memory of 6008 2620 Fldeie32.exe 106 PID 6008 wrote to memory of 4188 6008 Fjfegl32.exe 107 PID 4188 wrote to memory of 3276 4188 Flgaodbm.exe 108 PID 3276 wrote to memory of 2692 3276 Fmfnig32.exe 109 PID 2692 wrote to memory of 356 2692 Fbcfan32.exe 110 PID 356 wrote to memory of 1344 356 Fpggkbfq.exe 111 PID 1344 wrote to memory of 6032 1344 Fjmkhkff.exe 112 PID 6032 wrote to memory of 2924 6032 Fpjcpbdn.exe 113 PID 2924 wrote to memory of 6020 2924 Gibhihko.exe 114 PID 6020 wrote to memory of 2960 6020 Gffhbljh.exe 115 PID 2960 wrote to memory of 6000 2960 Gbmigm32.exe 116 PID 6000 wrote to memory of 4668 6000 Gdleap32.exe 117 PID 4668 wrote to memory of 5028 4668 Gmdjjemp.exe 118 PID 5028 wrote to memory of 1472 5028 Gljgkb32.exe 119 PID 1472 wrote to memory of 4052 1472 Hgokikan.exe 120 PID 4052 wrote to memory of 1340 4052 Hphpap32.exe 121 PID 1340 wrote to memory of 4320 1340 Hipdjfoo.exe 122 PID 4320 wrote to memory of 1180 4320 Hdehho32.exe 123 PID 1180 wrote to memory of 2244 1180 Hmnmqdee.exe 124 PID 2244 wrote to memory of 4696 2244 Hckeikcl.exe 125 PID 4696 wrote to memory of 4208 4696 Hmpjfdcb.exe 126 PID 4208 wrote to memory of 1304 4208 Hdjbcnjo.exe 127 PID 1304 wrote to memory of 5640 1304 Hkdjph32.exe 128 PID 5640 wrote to memory of 4524 5640 Hlefgphj.exe 129 PID 4524 wrote to memory of 988 4524 Ikfgeh32.exe 130 PID 988 wrote to memory of 1448 988 Ilhcmpeg.exe 131 PID 1448 wrote to memory of 5712 1448 Ikickgnf.exe 132 PID 5712 wrote to memory of 1676 5712 Idahcm32.exe 133 PID 1676 wrote to memory of 1884 1676 Ikkppgld.exe 134 PID 1884 wrote to memory of 5540 1884 Icfediio.exe 135 PID 5540 wrote to memory of 4520 5540 Inlibb32.exe 136 PID 4520 wrote to memory of 4340 4520 Iciaji32.exe 137 PID 4340 wrote to memory of 824 4340 Innfgb32.exe 138 PID 824 wrote to memory of 1336 824 Jdhndlno.exe 139 PID 1336 wrote to memory of 4752 1336 Jnqbmadp.exe 140 PID 4752 wrote to memory of 3840 4752 Jdkkjl32.exe 141 PID 3840 wrote to memory of 4144 3840 Jjgcbb32.exe 142 PID 4144 wrote to memory of 2424 4144 Jcphkhad.exe 143 PID 2424 wrote to memory of 4724 2424 Jjjpgb32.exe 144 PID 4724 wrote to memory of 4676 4724 Jpdhdl32.exe 145 PID 4676 wrote to memory of 1076 4676 Jgnqafgk.exe 146 PID 1076 wrote to memory of 4020 1076 Jnhinq32.exe 147 PID 4020 wrote to memory of 5840 4020 Jdaajkfd.exe 148 PID 5840 wrote to memory of 5648 5840 Jjoibadl.exe 149 PID 5648 wrote to memory of 4400 5648 Jqhaolli.exe 150 PID 4400 wrote to memory of 2672 4400 Kknfmdko.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Windows\SysWOW64\Cckkmg32.exeC:\Windows\system32\Cckkmg32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\Ckfpai32.exeC:\Windows\system32\Ckfpai32.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\Cijpkmml.exeC:\Windows\system32\Cijpkmml.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\Cfnqdale.exeC:\Windows\system32\Cfnqdale.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Windows\SysWOW64\Cmhial32.exeC:\Windows\system32\Cmhial32.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\Dmjefkap.exeC:\Windows\system32\Dmjefkap.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\Diafkl32.exeC:\Windows\system32\Diafkl32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\Djqbeonf.exeC:\Windows\system32\Djqbeonf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\Dpbdiehi.exeC:\Windows\system32\Dpbdiehi.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\Dflmep32.exeC:\Windows\system32\Dflmep32.exe11⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\Emfebjgb.exeC:\Windows\system32\Emfebjgb.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\Ebejpp32.exeC:\Windows\system32\Ebejpp32.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\Elnoifjg.exeC:\Windows\system32\Elnoifjg.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\Efccfojn.exeC:\Windows\system32\Efccfojn.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\Emmkci32.exeC:\Windows\system32\Emmkci32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\Ejaklmpd.exeC:\Windows\system32\Ejaklmpd.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\SysWOW64\Ecipeb32.exeC:\Windows\system32\Ecipeb32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\Fldeie32.exeC:\Windows\system32\Fldeie32.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\Fjfegl32.exeC:\Windows\system32\Fjfegl32.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Windows\SysWOW64\Flgaodbm.exeC:\Windows\system32\Flgaodbm.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\Fmfnig32.exeC:\Windows\system32\Fmfnig32.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\Fbcfan32.exeC:\Windows\system32\Fbcfan32.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\Fpggkbfq.exeC:\Windows\system32\Fpggkbfq.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:356 -
C:\Windows\SysWOW64\Fjmkhkff.exeC:\Windows\system32\Fjmkhkff.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\Fpjcpbdn.exeC:\Windows\system32\Fpjcpbdn.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\Gibhihko.exeC:\Windows\system32\Gibhihko.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\Gffhbljh.exeC:\Windows\system32\Gffhbljh.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\Gbmigm32.exeC:\Windows\system32\Gbmigm32.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\Gdleap32.exeC:\Windows\system32\Gdleap32.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\Gmdjjemp.exeC:\Windows\system32\Gmdjjemp.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\Gljgkb32.exeC:\Windows\system32\Gljgkb32.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\Hgokikan.exeC:\Windows\system32\Hgokikan.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\Hphpap32.exeC:\Windows\system32\Hphpap32.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\Hipdjfoo.exeC:\Windows\system32\Hipdjfoo.exe35⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\Hdehho32.exeC:\Windows\system32\Hdehho32.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\Hmnmqdee.exeC:\Windows\system32\Hmnmqdee.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\Hckeikcl.exeC:\Windows\system32\Hckeikcl.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\Hmpjfdcb.exeC:\Windows\system32\Hmpjfdcb.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\Hdjbcnjo.exeC:\Windows\system32\Hdjbcnjo.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\Hkdjph32.exeC:\Windows\system32\Hkdjph32.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\Hlefgphj.exeC:\Windows\system32\Hlefgphj.exe42⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\Ikfgeh32.exeC:\Windows\system32\Ikfgeh32.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\Ilhcmpeg.exeC:\Windows\system32\Ilhcmpeg.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\Ikickgnf.exeC:\Windows\system32\Ikickgnf.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\Idahcm32.exeC:\Windows\system32\Idahcm32.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\SysWOW64\Ikkppgld.exeC:\Windows\system32\Ikkppgld.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\Icfediio.exeC:\Windows\system32\Icfediio.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\Inlibb32.exeC:\Windows\system32\Inlibb32.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Windows\SysWOW64\Iciaji32.exeC:\Windows\system32\Iciaji32.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\Innfgb32.exeC:\Windows\system32\Innfgb32.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\Jdhndlno.exeC:\Windows\system32\Jdhndlno.exe52⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\Jnqbmadp.exeC:\Windows\system32\Jnqbmadp.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\Jdkkjl32.exeC:\Windows\system32\Jdkkjl32.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\Jjgcbb32.exeC:\Windows\system32\Jjgcbb32.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\Jcphkhad.exeC:\Windows\system32\Jcphkhad.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\Jjjpgb32.exeC:\Windows\system32\Jjjpgb32.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\Jpdhdl32.exeC:\Windows\system32\Jpdhdl32.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\Jgnqafgk.exeC:\Windows\system32\Jgnqafgk.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\Jnhinq32.exeC:\Windows\system32\Jnhinq32.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\Jdaajkfd.exeC:\Windows\system32\Jdaajkfd.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\Jjoibadl.exeC:\Windows\system32\Jjoibadl.exe62⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\SysWOW64\Jqhaolli.exeC:\Windows\system32\Jqhaolli.exe63⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Windows\SysWOW64\Kknfmdko.exeC:\Windows\system32\Kknfmdko.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\Kmobdm32.exeC:\Windows\system32\Kmobdm32.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2672 -
C:\Windows\SysWOW64\Kgefae32.exeC:\Windows\system32\Kgefae32.exe66⤵
- System Location Discovery: System Language Discovery
PID:5448 -
C:\Windows\SysWOW64\Knoonphp.exeC:\Windows\system32\Knoonphp.exe67⤵
- Modifies registry class
PID:992 -
C:\Windows\SysWOW64\Kqmkjk32.exeC:\Windows\system32\Kqmkjk32.exe68⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2904 -
C:\Windows\SysWOW64\Kkbohc32.exeC:\Windows\system32\Kkbohc32.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:1276 -
C:\Windows\SysWOW64\Kqphpk32.exeC:\Windows\system32\Kqphpk32.exe70⤵PID:2772
-
C:\Windows\SysWOW64\Kgipmdmn.exeC:\Windows\system32\Kgipmdmn.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1476 -
C:\Windows\SysWOW64\Knchio32.exeC:\Windows\system32\Knchio32.exe72⤵PID:2556
-
C:\Windows\SysWOW64\Kcpqafba.exeC:\Windows\system32\Kcpqafba.exe73⤵PID:2832
-
C:\Windows\SysWOW64\Knfeoobh.exeC:\Windows\system32\Knfeoobh.exe74⤵PID:4736
-
C:\Windows\SysWOW64\Ldpmlh32.exeC:\Windows\system32\Ldpmlh32.exe75⤵PID:2604
-
C:\Windows\SysWOW64\Lkjehbaa.exeC:\Windows\system32\Lkjehbaa.exe76⤵PID:2444
-
C:\Windows\SysWOW64\Lqfnqjpi.exeC:\Windows\system32\Lqfnqjpi.exe77⤵PID:1628
-
C:\Windows\SysWOW64\Lgqfmcge.exeC:\Windows\system32\Lgqfmcge.exe78⤵
- Drops file in System32 directory
PID:5012 -
C:\Windows\SysWOW64\Lmmoekem.exeC:\Windows\system32\Lmmoekem.exe79⤵PID:1660
-
C:\Windows\SysWOW64\Lcggbd32.exeC:\Windows\system32\Lcggbd32.exe80⤵PID:4820
-
C:\Windows\SysWOW64\Lknocb32.exeC:\Windows\system32\Lknocb32.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4464 -
C:\Windows\SysWOW64\Ldgclgcl.exeC:\Windows\system32\Ldgclgcl.exe82⤵PID:5172
-
C:\Windows\SysWOW64\Lnohemjm.exeC:\Windows\system32\Lnohemjm.exe83⤵PID:1204
-
C:\Windows\SysWOW64\Leipbg32.exeC:\Windows\system32\Leipbg32.exe84⤵
- Drops file in System32 directory
PID:1744 -
C:\Windows\SysWOW64\Mmdefi32.exeC:\Windows\system32\Mmdefi32.exe85⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:4584 -
C:\Windows\SysWOW64\Mgjicb32.exeC:\Windows\system32\Mgjicb32.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4264 -
C:\Windows\SysWOW64\Mmfalimb.exeC:\Windows\system32\Mmfalimb.exe87⤵PID:2476
-
C:\Windows\SysWOW64\Mglfibmh.exeC:\Windows\system32\Mglfibmh.exe88⤵
- Modifies registry class
PID:5288 -
C:\Windows\SysWOW64\Mminaikp.exeC:\Windows\system32\Mminaikp.exe89⤵PID:2848
-
C:\Windows\SysWOW64\Mccfnc32.exeC:\Windows\system32\Mccfnc32.exe90⤵
- Modifies registry class
PID:5484 -
C:\Windows\SysWOW64\Mnhkklbb.exeC:\Windows\system32\Mnhkklbb.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5300 -
C:\Windows\SysWOW64\Mebchf32.exeC:\Windows\system32\Mebchf32.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4756 -
C:\Windows\SysWOW64\Mjokpm32.exeC:\Windows\system32\Mjokpm32.exe93⤵
- Modifies registry class
PID:3348 -
C:\Windows\SysWOW64\Maicmgoc.exeC:\Windows\system32\Maicmgoc.exe94⤵PID:1596
-
C:\Windows\SysWOW64\Mgclja32.exeC:\Windows\system32\Mgclja32.exe95⤵PID:5636
-
C:\Windows\SysWOW64\Nmpdbh32.exeC:\Windows\system32\Nmpdbh32.exe96⤵PID:2480
-
C:\Windows\SysWOW64\Ncjmob32.exeC:\Windows\system32\Ncjmob32.exe97⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5220 -
C:\Windows\SysWOW64\Nmbaggce.exeC:\Windows\system32\Nmbaggce.exe98⤵
- System Location Discovery: System Language Discovery
PID:4200 -
C:\Windows\SysWOW64\Njfaalao.exeC:\Windows\system32\Njfaalao.exe99⤵PID:4056
-
C:\Windows\SysWOW64\Napjnfik.exeC:\Windows\system32\Napjnfik.exe100⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5884 -
C:\Windows\SysWOW64\Nhjbjp32.exeC:\Windows\system32\Nhjbjp32.exe101⤵
- System Location Discovery: System Language Discovery
PID:3312 -
C:\Windows\SysWOW64\Nndjgjhe.exeC:\Windows\system32\Nndjgjhe.exe102⤵
- System Location Discovery: System Language Discovery
PID:1088 -
C:\Windows\SysWOW64\Nabfcegi.exeC:\Windows\system32\Nabfcegi.exe103⤵PID:4268
-
C:\Windows\SysWOW64\Nlhkqngo.exeC:\Windows\system32\Nlhkqngo.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:4636 -
C:\Windows\SysWOW64\Naecieef.exeC:\Windows\system32\Naecieef.exe105⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3224 -
C:\Windows\SysWOW64\Ojmhaklf.exeC:\Windows\system32\Ojmhaklf.exe106⤵
- System Location Discovery: System Language Discovery
PID:2644 -
C:\Windows\SysWOW64\Oagpne32.exeC:\Windows\system32\Oagpne32.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2864 -
C:\Windows\SysWOW64\Olmdln32.exeC:\Windows\system32\Olmdln32.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3380 -
C:\Windows\SysWOW64\Oeehdcij.exeC:\Windows\system32\Oeehdcij.exe109⤵
- Modifies registry class
PID:2656 -
C:\Windows\SysWOW64\Onnmmipj.exeC:\Windows\system32\Onnmmipj.exe110⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5108 -
C:\Windows\SysWOW64\Ohfafn32.exeC:\Windows\system32\Ohfafn32.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4744 -
C:\Windows\SysWOW64\Oejbpb32.exeC:\Windows\system32\Oejbpb32.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1480 -
C:\Windows\SysWOW64\Omegdebp.exeC:\Windows\system32\Omegdebp.exe113⤵
- System Location Discovery: System Language Discovery
PID:4856 -
C:\Windows\SysWOW64\Pkigmiai.exeC:\Windows\system32\Pkigmiai.exe114⤵PID:4476
-
C:\Windows\SysWOW64\Pacojc32.exeC:\Windows\system32\Pacojc32.exe115⤵PID:5000
-
C:\Windows\SysWOW64\Plhcglil.exeC:\Windows\system32\Plhcglil.exe116⤵PID:1648
-
C:\Windows\SysWOW64\Paelpcgc.exeC:\Windows\system32\Paelpcgc.exe117⤵PID:1788
-
C:\Windows\SysWOW64\Plkpmlfi.exeC:\Windows\system32\Plkpmlfi.exe118⤵PID:2576
-
C:\Windows\SysWOW64\Pahiebeq.exeC:\Windows\system32\Pahiebeq.exe119⤵PID:3568
-
C:\Windows\SysWOW64\Plmmbkdf.exeC:\Windows\system32\Plmmbkdf.exe120⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5804 -
C:\Windows\SysWOW64\Peeakakg.exeC:\Windows\system32\Peeakakg.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-