Analysis
- max time kernel
58s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/10/2026, 15:02
Behavioral task
behavioral1
Sample
2026-10-21_a1db4ef4c60e49041cbfe30b8109f43e_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-21_a1db4ef4c60e49041cbfe30b8109f43e_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-10-21_a1db4ef4c60e49041cbfe30b8109f43e_elex_wannacry.exe
- Size 429KB
- Sample261022-seqf6svv5m
- SHA256 4f313600c7a4df536c60859e2377da6f6522baab77aa5438d492394212542d9e
- MD5 a1db4ef4c60e49041cbfe30b8109f43e
- SHA1 ea6ecbb53c41596dcf37aaf67f3ba6cfd7b0c463
- SHA512 65bc49324ffd8d3cfdf1d33dcb8f55b9e5488989fa704845070a3617ad39e0d7fa2149de28ac217df958edc4f5ffe6d5b78e96c8f2e7fa76a75644f4a67abe52
- SSDEEP 6144:z3Fg9nVldypV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:G9nVHZ/NcZ7/N
- TLSH T1BB9461256E3029E5EDEE6BB5AC124AD88182E5B104F5F17F9A23DFDDC8E4D61CC14B80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jbpihlbn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjeflc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhlkep32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofgdmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ejjelnfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ekoniian.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jhnocbfa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kqphpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jialbf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfpocjfa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbadmege.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kifodcej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mhnjgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ohcmid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jfpocjfa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pogpcghp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kdffdlfg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oopjchnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dflmep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nflkkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qidljhia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aadgadai.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Blieeglf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hhojlfpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ecphmfbg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hkbddo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Poajdlcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Neqoidmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mmmqbb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cglgck32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kijcanhl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfdjccol.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Laachfbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hdnlmj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bqkifb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epokojbg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aeaagoaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Domdcpib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Afpjoaeo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lllaqn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnkajg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lgcjmjho.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Obebla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fkkemble.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kbbhjc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gbabblkg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iohjebkd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpkllo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Idceim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Glpmkm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ghpehjph.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebapednb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jaljlb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qcfmgkgo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jobgkfnh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amanfpkl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gikkof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ebiffc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ledeicdf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bapgmb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hccgqa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ggnenagl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lqdakjak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bdbndjld.exe - Executes dropped EXE 64 IoCs
pid Process 2340 Gamjea32.exe 3364 Gaogja32.exe 4856 Gkglcfec.exe 3608 Ghklmk32.exe 5392 Gafmkp32.exe 4068 Ghpehjph.exe 4256 Hojndd32.exe 2696 Hhbbmjne.exe 204 Hbkgfode.exe 3356 Hheoci32.exe 5916 Hnagkp32.exe 6076 Hdlphjaf.exe 5048 Hoadecal.exe 3548 Hdnlmj32.exe 5672 Hkhdjdgq.exe 3760 Hfmigmgf.exe 4700 Igoeoe32.exe 1432 Ibdiln32.exe 1336 Ihnbih32.exe 5908 Iohjebkd.exe 5200 Idebniil.exe 1756 Iojgkbib.exe 3756 Idgocigi.exe 5592 Iomcqa32.exe 5044 Ikcdfbmc.exe 2772 Ibnlbm32.exe 2600 Jgjekc32.exe 5732 Jbpihlbn.exe 1900 Jijaef32.exe 704 Jodiaqag.exe 6108 Jeqbjgoo.exe 4608 Jpffgp32.exe 5848 Jfpocjfa.exe 5576 Jgakkb32.exe 3400 Jnkchmdl.exe 6036 Jeekeg32.exe 2336 Jlocaabf.exe 5776 Kfehoj32.exe 4120 Klapgq32.exe 4892 Kfgddi32.exe 2092 Kppimogj.exe 4996 Kelaef32.exe 3648 Klfjbpmn.exe 2732 Knefnkla.exe 2652 Klifhpjk.exe 4308 Kbbodj32.exe 3404 Kimgad32.exe 3160 Klkcmo32.exe 1512 Lbekjipe.exe 2912 Liocgc32.exe 5068 Lpilcnoo.exe 2560 Lfcdph32.exe 1396 Lhdqhp32.exe 5280 Lbjeei32.exe 5524 Lhfmmp32.exe 2436 Loqejjad.exe 4732 Lejngd32.exe 2344 Lldfcn32.exe 5880 Lbnnphhk.exe 1132 Lihfmb32.exe 3576 Lpbojlfd.exe 2700 Meogbcel.exe 3252 Mlipomli.exe 2608 Mbchkg32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Kelaef32.exe Kppimogj.exe File created C:\Windows\SysWOW64\Qgmnmagm.dll Pllggbje.exe File opened for modification C:\Windows\SysWOW64\Lgephccp.exe Lqkgli32.exe File opened for modification C:\Windows\SysWOW64\Kodnfqgm.exe Kjgenjhe.exe File opened for modification C:\Windows\SysWOW64\Dafpjf32.exe Dklhmlac.exe File created C:\Windows\SysWOW64\Aoaggnkj.dll Ijioijao.exe File created C:\Windows\SysWOW64\Jgoflpal.exe Jljbogaf.exe File created C:\Windows\SysWOW64\Plpqba32.exe Polpim32.exe File opened for modification C:\Windows\SysWOW64\Bjpjoa32.exe Bokeai32.exe File created C:\Windows\SysWOW64\Lqmmgb32.exe Ljcejhnh.exe File created C:\Windows\SysWOW64\Kdkjlboj.dll Pfdjccol.exe File created C:\Windows\SysWOW64\Gjomaada.dll Jhhonl32.exe File created C:\Windows\SysWOW64\Obphmnpb.dll Plpqba32.exe File opened for modification C:\Windows\SysWOW64\Hdjbcnjo.exe Hienee32.exe File created C:\Windows\SysWOW64\Leipbg32.exe Lnohemjm.exe File created C:\Windows\SysWOW64\Pfdjccol.exe Ppjbfi32.exe File created C:\Windows\SysWOW64\Obmichdq.dll Ennqpkcm.exe File opened for modification C:\Windows\SysWOW64\Ibqndm32.exe Ipbahb32.exe File created C:\Windows\SysWOW64\Mkhfig32.dll Fqbehh32.exe File opened for modification C:\Windows\SysWOW64\Gcnnebhe.exe Gnaemkjn.exe File opened for modification C:\Windows\SysWOW64\Molefh32.exe Mhbmin32.exe File opened for modification C:\Windows\SysWOW64\Jnjecp32.exe Jcdafg32.exe File created C:\Windows\SysWOW64\Edkail32.dll Bhpopb32.exe File created C:\Windows\SysWOW64\Oehegkch.dll Klbnjo32.exe File created C:\Windows\SysWOW64\Cmipkb32.exe Cglgck32.exe File opened for modification C:\Windows\SysWOW64\Kkaimj32.exe Knmicfnn.exe File opened for modification C:\Windows\SysWOW64\Cfqmjajc.exe Cilmpmki.exe File created C:\Windows\SysWOW64\Mfjfoidl.exe Lqmmgb32.exe File created C:\Windows\SysWOW64\Ebiffc32.exe Ekoniian.exe File created C:\Windows\SysWOW64\Jfqlfp32.dll Jdkkjl32.exe File opened for modification C:\Windows\SysWOW64\Dfglpjqo.exe Domdcpib.exe File created C:\Windows\SysWOW64\Coepkfcl.dll Jejbba32.exe File created C:\Windows\SysWOW64\Emahon32.dll Loqejjad.exe File created C:\Windows\SysWOW64\Bmkcjd32.exe Bgnkamef.exe File opened for modification C:\Windows\SysWOW64\Odhipp32.exe Oajmdd32.exe File created C:\Windows\SysWOW64\Hebcjdkb.exe Hnhknj32.exe File created C:\Windows\SysWOW64\Ogklob32.exe Opqdbhlb.exe File created C:\Windows\SysWOW64\Pahiebeq.exe Plkpmlfi.exe File created C:\Windows\SysWOW64\Hbjonepq.exe Hmmffnai.exe File opened for modification C:\Windows\SysWOW64\Mjlhpgfn.exe Mjjkkghp.exe File opened for modification C:\Windows\SysWOW64\Bbcpkjkg.exe Bmggbcmp.exe File opened for modification C:\Windows\SysWOW64\Lihpbl32.exe Lnbkeclf.exe File created C:\Windows\SysWOW64\Njcnafpe.exe Ncifdlii.exe File created C:\Windows\SysWOW64\Jeoohc32.dll Kahqbgjp.exe File created C:\Windows\SysWOW64\Gkqlkp32.exe Gqkhng32.exe File created C:\Windows\SysWOW64\Ogoane32.dll Aeaagoaj.exe File created C:\Windows\SysWOW64\Dfglpjqo.exe Domdcpib.exe File created C:\Windows\SysWOW64\Nlplhe32.exe Nakhkl32.exe File created C:\Windows\SysWOW64\Dbcpapne.dll Kfgddi32.exe File created C:\Windows\SysWOW64\Bfpedlcp.dll Oioojh32.exe File created C:\Windows\SysWOW64\Ecnlhf32.exe Dnqcop32.exe File opened for modification C:\Windows\SysWOW64\Iomcqa32.exe Idgocigi.exe File created C:\Windows\SysWOW64\Dgmlehnj.dll Mhbmin32.exe File opened for modification C:\Windows\SysWOW64\Niconj32.exe Mnnkaa32.exe File created C:\Windows\SysWOW64\Icdhojka.exe Iljpbp32.exe File created C:\Windows\SysWOW64\Mglfibmh.exe Mabnlh32.exe File created C:\Windows\SysWOW64\Dhlfim32.dll Bddjijia.exe File created C:\Windows\SysWOW64\Jdnnaj32.dll Cdpjeh32.exe File opened for modification C:\Windows\SysWOW64\Joqapmcf.exe Jehmgg32.exe File created C:\Windows\SysWOW64\Cmklaaek.exe Cgndikgd.exe File opened for modification C:\Windows\SysWOW64\Galcjkmj.exe Ghdoae32.exe File created C:\Windows\SysWOW64\Oihjionb.dll Hkkgii32.exe File created C:\Windows\SysWOW64\Ljnloi32.exe Lcdcbokq.exe File created C:\Windows\SysWOW64\Ngbeok32.exe Mmmqbb32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 7496 3064 Process not Found 1326 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Akccje32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efnbqi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlplhe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hbkgfode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbgibgpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onmfcb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-21_a1db4ef4c60e49041cbfe30b8109f43e_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gafmkp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbaocfmo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nppfimnm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkaimj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ffaogm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Feoomd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikcdfbmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iomood32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dgpebf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Agiagn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpjlgp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dpphcf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfglpjqo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nqpccp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hbbacobm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mkgmhcij.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hhoomd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cggifn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pohdamqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlipomli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdlpjicj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nijqml32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iohjebkd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Boabkj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Illmho32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Agbgda32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kdffdlfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pacojc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nflkkf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nfenpafc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Igoeoe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nleojlbk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghhhmebd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjaciafc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmlekq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nekgna32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmnkdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mebchf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gcnnebhe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eecpaeoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Apcemh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jialbf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjdkeaij.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Piapehkd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkjfkacd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdopcmlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajbmmcii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dlfhhgpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihnbih32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gejoib32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ofjgmdgg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cglbanmo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Glpdecjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekljic32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Alfkgm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dohkhq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phjdggoj.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gikkof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndgjmhgb.dll" Cdlpjicj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eicemccc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hlkmfkli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ogndki32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ebocpd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkoneo32.dll" Iggakn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnkcchff.dll" Phbhlcpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blihca32.dll" Fpggkbfq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cndecn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ibqndm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ecphmfbg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odppgo32.dll" Apfqbj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lalnfooo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fpfppl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Njcnafpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oconpn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfdfjbne.dll" Fhablf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cejjpn32.dll" Lgnihd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jondjmei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppljlh32.dll" Paaaeg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Elnoifjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aegghi32.dll" Fkjfkacd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kbpkdd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Poajdlcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbdbck32.dll" Cjgpoq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mlohjpoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fohoed32.dll" Imieblgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpfmidbh.dll" Fdiohnek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nbphqahb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hnhknj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nhjbjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdnnaj32.dll" Cdpjeh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cncnhh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jengfefa.dll" Amfokf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldodop32.dll" Hdnlmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Naaqhlmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbbbggpb.dll" Bhhiocdg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hnfohj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fmnkdm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Boplmekj.dll" Gpnfak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igmcbplc.dll" Ibegpmah.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nlplhe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ajdjcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hkmdoi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gbgibgpf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jlclnhho.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ljnloi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nggnjl32.dll" Agdcja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kifodcej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pmdioh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilibnf32.dll" Jbpihlbn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmpbdj32.dll" Amjjcf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hggqniih.dll" Fipbnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldbnjl32.dll" Mlhqll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnmihgic.dll" Aapnfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kimgad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgagcn32.dll" Ciefpn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfdmag32.dll" Hlldaape.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Efnbqi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnhgmefn.dll" Gqnedg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ijioijao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apcgga32.dll" Ocfdqm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aecika32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5932 wrote to memory of 2340 5932 2026-10-21_a1db4ef4c60e49041cbfe30b8109f43e_elex_wannacry.exe 89 PID 2340 wrote to memory of 3364 2340 Gamjea32.exe 90 PID 3364 wrote to memory of 4856 3364 Gaogja32.exe 91 PID 4856 wrote to memory of 3608 4856 Gkglcfec.exe 92 PID 3608 wrote to memory of 5392 3608 Ghklmk32.exe 93 PID 5392 wrote to memory of 4068 5392 Gafmkp32.exe 94 PID 4068 wrote to memory of 4256 4068 Ghpehjph.exe 95 PID 4256 wrote to memory of 2696 4256 Hojndd32.exe 96 PID 2696 wrote to memory of 204 2696 Hhbbmjne.exe 97 PID 204 wrote to memory of 3356 204 Hbkgfode.exe 98 PID 3356 wrote to memory of 5916 3356 Hheoci32.exe 99 PID 5916 wrote to memory of 6076 5916 Hnagkp32.exe 100 PID 6076 wrote to memory of 5048 6076 Hdlphjaf.exe 101 PID 5048 wrote to memory of 3548 5048 Hoadecal.exe 102 PID 3548 wrote to memory of 5672 3548 Hdnlmj32.exe 103 PID 5672 wrote to memory of 3760 5672 Hkhdjdgq.exe 104 PID 3760 wrote to memory of 4700 3760 Hfmigmgf.exe 105 PID 4700 wrote to memory of 1432 4700 Igoeoe32.exe 106 PID 1432 wrote to memory of 1336 1432 Ibdiln32.exe 107 PID 1336 wrote to memory of 5908 1336 Ihnbih32.exe 108 PID 5908 wrote to memory of 5200 5908 Iohjebkd.exe 109 PID 5200 wrote to memory of 1756 5200 Idebniil.exe 110 PID 1756 wrote to memory of 3756 1756 Iojgkbib.exe 111 PID 3756 wrote to memory of 5592 3756 Idgocigi.exe 112 PID 5592 wrote to memory of 5044 5592 Iomcqa32.exe 113 PID 5044 wrote to memory of 2772 5044 Ikcdfbmc.exe 114 PID 2772 wrote to memory of 2600 2772 Ibnlbm32.exe 115 PID 2600 wrote to memory of 5732 2600 Jgjekc32.exe 116 PID 5732 wrote to memory of 1900 5732 Jbpihlbn.exe 117 PID 1900 wrote to memory of 704 1900 Jijaef32.exe 118 PID 704 wrote to memory of 6108 704 Jodiaqag.exe 119 PID 6108 wrote to memory of 4608 6108 Jeqbjgoo.exe 120 PID 4608 wrote to memory of 5848 4608 Jpffgp32.exe 121 PID 5848 wrote to memory of 5576 5848 Jfpocjfa.exe 122 PID 5576 wrote to memory of 3400 5576 Jgakkb32.exe 123 PID 3400 wrote to memory of 6036 3400 Jnkchmdl.exe 124 PID 6036 wrote to memory of 2336 6036 Jeekeg32.exe 125 PID 2336 wrote to memory of 5776 2336 Jlocaabf.exe 126 PID 5776 wrote to memory of 4120 5776 Kfehoj32.exe 127 PID 4120 wrote to memory of 4892 4120 Klapgq32.exe 128 PID 4892 wrote to memory of 2092 4892 Kfgddi32.exe 129 PID 2092 wrote to memory of 4996 2092 Kppimogj.exe 130 PID 4996 wrote to memory of 3648 4996 Kelaef32.exe 131 PID 3648 wrote to memory of 2732 3648 Klfjbpmn.exe 132 PID 5312 wrote to memory of 2652 5312 Keonke32.exe 134 PID 2652 wrote to memory of 4308 2652 Klifhpjk.exe 135 PID 4308 wrote to memory of 3404 4308 Kbbodj32.exe 136 PID 3404 wrote to memory of 3160 3404 Kimgad32.exe 137 PID 3160 wrote to memory of 1512 3160 Klkcmo32.exe 138 PID 1512 wrote to memory of 2912 1512 Lbekjipe.exe 139 PID 2912 wrote to memory of 5068 2912 Liocgc32.exe 140 PID 5068 wrote to memory of 2560 5068 Lpilcnoo.exe 141 PID 2560 wrote to memory of 1396 2560 Lfcdph32.exe 142 PID 1396 wrote to memory of 5280 1396 Lhdqhp32.exe 143 PID 5280 wrote to memory of 5524 5280 Lbjeei32.exe 144 PID 5524 wrote to memory of 2436 5524 Lhfmmp32.exe 145 PID 2436 wrote to memory of 4732 2436 Loqejjad.exe 146 PID 4732 wrote to memory of 2344 4732 Lejngd32.exe 147 PID 2344 wrote to memory of 5880 2344 Lldfcn32.exe 148 PID 5880 wrote to memory of 1132 5880 Lbnnphhk.exe 149 PID 1132 wrote to memory of 3576 1132 Lihfmb32.exe 150 PID 3576 wrote to memory of 2700 3576 Lpbojlfd.exe 151 PID 2700 wrote to memory of 3252 2700 Meogbcel.exe 152 PID 3252 wrote to memory of 2608 3252 Mlipomli.exe 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-21_a1db4ef4c60e49041cbfe30b8109f43e_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-21_a1db4ef4c60e49041cbfe30b8109f43e_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\Gamjea32.exeC:\Windows\system32\Gamjea32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\Gaogja32.exeC:\Windows\system32\Gaogja32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\Gkglcfec.exeC:\Windows\system32\Gkglcfec.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\Ghklmk32.exeC:\Windows\system32\Ghklmk32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\Gafmkp32.exeC:\Windows\system32\Gafmkp32.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SysWOW64\Ghpehjph.exeC:\Windows\system32\Ghpehjph.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\Hojndd32.exeC:\Windows\system32\Hojndd32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\Hhbbmjne.exeC:\Windows\system32\Hhbbmjne.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\Hbkgfode.exeC:\Windows\system32\Hbkgfode.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Windows\SysWOW64\Hheoci32.exeC:\Windows\system32\Hheoci32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\Hnagkp32.exeC:\Windows\system32\Hnagkp32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Windows\SysWOW64\Hdlphjaf.exeC:\Windows\system32\Hdlphjaf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\Hoadecal.exeC:\Windows\system32\Hoadecal.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\Hdnlmj32.exeC:\Windows\system32\Hdnlmj32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\Hkhdjdgq.exeC:\Windows\system32\Hkhdjdgq.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Windows\SysWOW64\Hfmigmgf.exeC:\Windows\system32\Hfmigmgf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\Igoeoe32.exeC:\Windows\system32\Igoeoe32.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\Ibdiln32.exeC:\Windows\system32\Ibdiln32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\Ihnbih32.exeC:\Windows\system32\Ihnbih32.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\Iohjebkd.exeC:\Windows\system32\Iohjebkd.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Windows\SysWOW64\Idebniil.exeC:\Windows\system32\Idebniil.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Windows\SysWOW64\Iojgkbib.exeC:\Windows\system32\Iojgkbib.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\Idgocigi.exeC:\Windows\system32\Idgocigi.exe24⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\Iomcqa32.exeC:\Windows\system32\Iomcqa32.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Windows\SysWOW64\Ikcdfbmc.exeC:\Windows\system32\Ikcdfbmc.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\Ibnlbm32.exeC:\Windows\system32\Ibnlbm32.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\Jgjekc32.exeC:\Windows\system32\Jgjekc32.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\Jbpihlbn.exeC:\Windows\system32\Jbpihlbn.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\Jijaef32.exeC:\Windows\system32\Jijaef32.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\Jodiaqag.exeC:\Windows\system32\Jodiaqag.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\Jeqbjgoo.exeC:\Windows\system32\Jeqbjgoo.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\Jpffgp32.exeC:\Windows\system32\Jpffgp32.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\Jfpocjfa.exeC:\Windows\system32\Jfpocjfa.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Windows\SysWOW64\Jgakkb32.exeC:\Windows\system32\Jgakkb32.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Windows\SysWOW64\Jnkchmdl.exeC:\Windows\system32\Jnkchmdl.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\Jeekeg32.exeC:\Windows\system32\Jeekeg32.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\Jlocaabf.exeC:\Windows\system32\Jlocaabf.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\Kfehoj32.exeC:\Windows\system32\Kfehoj32.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Windows\SysWOW64\Klapgq32.exeC:\Windows\system32\Klapgq32.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\Kfgddi32.exeC:\Windows\system32\Kfgddi32.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\Kppimogj.exeC:\Windows\system32\Kppimogj.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\Kelaef32.exeC:\Windows\system32\Kelaef32.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\Klfjbpmn.exeC:\Windows\system32\Klfjbpmn.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\Knefnkla.exeC:\Windows\system32\Knefnkla.exe45⤵
- Executes dropped EXE
PID:2732 -
C:\Windows\SysWOW64\Keonke32.exeC:\Windows\system32\Keonke32.exe46⤵
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\Klifhpjk.exeC:\Windows\system32\Klifhpjk.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\Kbbodj32.exeC:\Windows\system32\Kbbodj32.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\Kimgad32.exeC:\Windows\system32\Kimgad32.exe49⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\Klkcmo32.exeC:\Windows\system32\Klkcmo32.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\Lbekjipe.exeC:\Windows\system32\Lbekjipe.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\Liocgc32.exeC:\Windows\system32\Liocgc32.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\Lpilcnoo.exeC:\Windows\system32\Lpilcnoo.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\Lfcdph32.exeC:\Windows\system32\Lfcdph32.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\Lhdqhp32.exeC:\Windows\system32\Lhdqhp32.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\Lbjeei32.exeC:\Windows\system32\Lbjeei32.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Windows\SysWOW64\Lhfmmp32.exeC:\Windows\system32\Lhfmmp32.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Windows\SysWOW64\Loqejjad.exeC:\Windows\system32\Loqejjad.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\Lejngd32.exeC:\Windows\system32\Lejngd32.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\Lldfcn32.exeC:\Windows\system32\Lldfcn32.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\Lbnnphhk.exeC:\Windows\system32\Lbnnphhk.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Windows\SysWOW64\Lihfmb32.exeC:\Windows\system32\Lihfmb32.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\Lpbojlfd.exeC:\Windows\system32\Lpbojlfd.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\Meogbcel.exeC:\Windows\system32\Meogbcel.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\Mlipomli.exeC:\Windows\system32\Mlipomli.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\Mbchkg32.exeC:\Windows\system32\Mbchkg32.exe66⤵
- Executes dropped EXE
PID:2608 -
C:\Windows\SysWOW64\Mimphakb.exeC:\Windows\system32\Mimphakb.exe67⤵PID:5836
-
C:\Windows\SysWOW64\Mpghel32.exeC:\Windows\system32\Mpghel32.exe68⤵PID:4456
-
C:\Windows\SysWOW64\Mfaqafjl.exeC:\Windows\system32\Mfaqafjl.exe69⤵PID:3488
-
C:\Windows\SysWOW64\Mhbmin32.exeC:\Windows\system32\Mhbmin32.exe70⤵
- Drops file in System32 directory
PID:4684 -
C:\Windows\SysWOW64\Molefh32.exeC:\Windows\system32\Molefh32.exe71⤵PID:5024
-
C:\Windows\SysWOW64\Mefmbbod.exeC:\Windows\system32\Mefmbbod.exe72⤵PID:1624
-
C:\Windows\SysWOW64\Mlpeol32.exeC:\Windows\system32\Mlpeol32.exe73⤵PID:5256
-
C:\Windows\SysWOW64\Mbjnlfnn.exeC:\Windows\system32\Mbjnlfnn.exe74⤵PID:5872
-
C:\Windows\SysWOW64\Midfiq32.exeC:\Windows\system32\Midfiq32.exe75⤵PID:2300
-
C:\Windows\SysWOW64\Mpnnek32.exeC:\Windows\system32\Mpnnek32.exe76⤵PID:5176
-
C:\Windows\SysWOW64\Nekgna32.exeC:\Windows\system32\Nekgna32.exe77⤵
- System Location Discovery: System Language Discovery
PID:4716 -
C:\Windows\SysWOW64\Nleojlbk.exeC:\Windows\system32\Nleojlbk.exe78⤵
- System Location Discovery: System Language Discovery
PID:108 -
C:\Windows\SysWOW64\Ngjcgdba.exeC:\Windows\system32\Ngjcgdba.exe79⤵PID:4696
-
C:\Windows\SysWOW64\Nhlpom32.exeC:\Windows\system32\Nhlpom32.exe80⤵PID:5528
-
C:\Windows\SysWOW64\Nbadmege.exeC:\Windows\system32\Nbadmege.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5620 -
C:\Windows\SysWOW64\Niklip32.exeC:\Windows\system32\Niklip32.exe82⤵PID:2828
-
C:\Windows\SysWOW64\Nohdaf32.exeC:\Windows\system32\Nohdaf32.exe83⤵PID:2212
-
C:\Windows\SysWOW64\Nimioo32.exeC:\Windows\system32\Nimioo32.exe84⤵PID:3832
-
C:\Windows\SysWOW64\Nojagf32.exeC:\Windows\system32\Nojagf32.exe85⤵PID:1792
-
C:\Windows\SysWOW64\Nipedokm.exeC:\Windows\system32\Nipedokm.exe86⤵PID:5912
-
C:\Windows\SysWOW64\Opjnai32.exeC:\Windows\system32\Opjnai32.exe87⤵PID:2856
-
C:\Windows\SysWOW64\Oeffip32.exeC:\Windows\system32\Oeffip32.exe88⤵PID:1560
-
C:\Windows\SysWOW64\Olqofjhn.exeC:\Windows\system32\Olqofjhn.exe89⤵PID:5664
-
C:\Windows\SysWOW64\Ocjgcd32.exeC:\Windows\system32\Ocjgcd32.exe90⤵PID:2080
-
C:\Windows\SysWOW64\Ohgokknb.exeC:\Windows\system32\Ohgokknb.exe91⤵PID:3008
-
C:\Windows\SysWOW64\Ocmchdmh.exeC:\Windows\system32\Ocmchdmh.exe92⤵PID:3596
-
C:\Windows\SysWOW64\Oiglen32.exeC:\Windows\system32\Oiglen32.exe93⤵PID:4884
-
C:\Windows\SysWOW64\Opqdbhlb.exeC:\Windows\system32\Opqdbhlb.exe94⤵
- Drops file in System32 directory
PID:1368 -
C:\Windows\SysWOW64\Ogklob32.exeC:\Windows\system32\Ogklob32.exe95⤵PID:5756
-
C:\Windows\SysWOW64\Ohlifj32.exeC:\Windows\system32\Ohlifj32.exe96⤵PID:1752
-
C:\Windows\SysWOW64\Oofacdaj.exeC:\Windows\system32\Oofacdaj.exe97⤵PID:3232
-
C:\Windows\SysWOW64\Ojkepmqp.exeC:\Windows\system32\Ojkepmqp.exe98⤵PID:4848
-
C:\Windows\SysWOW64\Phhhbi32.exeC:\Windows\system32\Phhhbi32.exe99⤵PID:3496
-
C:\Windows\SysWOW64\Pflikm32.exeC:\Windows\system32\Pflikm32.exe100⤵PID:2456
-
C:\Windows\SysWOW64\Qcpieamc.exeC:\Windows\system32\Qcpieamc.exe101⤵PID:4680
-
C:\Windows\SysWOW64\Qhlamhkj.exeC:\Windows\system32\Qhlamhkj.exe102⤵PID:3264
-
C:\Windows\SysWOW64\Qfpbfljd.exeC:\Windows\system32\Qfpbfljd.exe103⤵PID:456
-
C:\Windows\SysWOW64\Amjjcf32.exeC:\Windows\system32\Amjjcf32.exe104⤵
- Modifies registry class
PID:2728 -
C:\Windows\SysWOW64\Acdbpq32.exeC:\Windows\system32\Acdbpq32.exe105⤵PID:1480
-
C:\Windows\SysWOW64\Ammgifpn.exeC:\Windows\system32\Ammgifpn.exe106⤵PID:2956
-
C:\Windows\SysWOW64\Afelal32.exeC:\Windows\system32\Afelal32.exe107⤵PID:3692
-
C:\Windows\SysWOW64\Aompjamo.exeC:\Windows\system32\Aompjamo.exe108⤵PID:5136
-
C:\Windows\SysWOW64\Afghgkdl.exeC:\Windows\system32\Afghgkdl.exe109⤵PID:1360
-
C:\Windows\SysWOW64\Ackiqpce.exeC:\Windows\system32\Ackiqpce.exe110⤵PID:2192
-
C:\Windows\SysWOW64\Ajeami32.exeC:\Windows\system32\Ajeami32.exe111⤵PID:5468
-
C:\Windows\SysWOW64\Agiagn32.exeC:\Windows\system32\Agiagn32.exe112⤵
- System Location Discovery: System Language Discovery
PID:2704 -
C:\Windows\SysWOW64\Bcpblo32.exeC:\Windows\system32\Bcpblo32.exe113⤵PID:2548
-
C:\Windows\SysWOW64\Bqdbec32.exeC:\Windows\system32\Bqdbec32.exe114⤵PID:3060
-
C:\Windows\SysWOW64\Bgnkamef.exeC:\Windows\system32\Bgnkamef.exe115⤵
- Drops file in System32 directory
PID:1696 -
C:\Windows\SysWOW64\Bmkcjd32.exeC:\Windows\system32\Bmkcjd32.exe116⤵PID:4784
-
C:\Windows\SysWOW64\Bgpggm32.exeC:\Windows\system32\Bgpggm32.exe117⤵PID:4804
-
C:\Windows\SysWOW64\Bpkllo32.exeC:\Windows\system32\Bpkllo32.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5572 -
C:\Windows\SysWOW64\Bjaqih32.exeC:\Windows\system32\Bjaqih32.exe119⤵PID:1504
-
C:\Windows\SysWOW64\Bqkifb32.exeC:\Windows\system32\Bqkifb32.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5012 -
C:\Windows\SysWOW64\Bgeabloo.exeC:\Windows\system32\Bgeabloo.exe121⤵PID:2248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-