Analysis
- max time kernel
48s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/11/2026, 21:52
Behavioral task
behavioral1
Sample
2026-11-08_aac62b21b1d150fe6db9a95c58233549_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-08_aac62b21b1d150fe6db9a95c58233549_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-11-08_aac62b21b1d150fe6db9a95c58233549_elex_wannacry.exe
- Size 320KB
- Sample261108-1rf29sba93
- SHA256 493a7ad70f61c41112d5cd4ed4c4b57fb493bbe775cd134c00771b0e8430e54c
- MD5 aac62b21b1d150fe6db9a95c58233549
- SHA1 b63603160a490abc71dd4cd6adfc5f60dc5b98b6
- SHA512 e29b8e20fd50471733a2e67fdb244ed8b5f3f77a5eb5fb1851bb0b74377c74b39942f4a6cc669f195e4d515541d0779b343191177087fa05daffef20b2e74461
- SSDEEP 3072:PX9/twsgm0whIbAXwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:1/tJgm0wheAXV/Ah1G/AcQ///NR5fn
- TLSH T17064EA192A3009EACDEE5FB5AC124DD89145E9B124F1E13E6123DFDDD8E4EAACC05F81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hfhgdc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amneleek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ejmild32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olbdacbp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Peahpa32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jcoapami.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iacnpjmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iolhdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kahqbgjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lemoid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cjcmognb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcqjhc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pihmojco.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdhfpm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnnnpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Emnbmoef.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oeccijoh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oaomij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nmighf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bpaanfce.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cponodge.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnhknj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jdjfhnpe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Filicodb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbbpgh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnafgd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bgnfpp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jejjlg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Khbioa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aplahpdo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hddbmedc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gpcffalc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qejkfp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Goccbhae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Encgofhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hlkfle32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Laiiie32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aadgadai.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oofacdaj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hncmfj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hjjnkkjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lkqliaki.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Omnqcfig.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Peeakakg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dfbcek32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efbllhfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hknkiokp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilhcmpeg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bohbackj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddjmkg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hojibgkm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hoaocf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jngbcj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ieagfh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipdfheal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fnipliip.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jidigfeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Obikgppg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ajfejknb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jhcecmjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qemoff32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hgokikan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dfdpjj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgphjk32.exe - Executes dropped EXE 64 IoCs
pid Process 5112 Opjnai32.exe 2664 Ohebek32.exe 3064 Opnglhnd.exe 4604 Oekpdoll.exe 4512 Olehai32.exe 3500 Ocopncke.exe 4332 Ohlifj32.exe 2776 Oofacdaj.exe 5404 Ojkepmqp.exe 5304 Pohnhdog.exe 3868 Pjnbfmom.exe 1196 Pokjnd32.exe 944 Pfdbknda.exe 4248 Phcogice.exe 4152 Pomgcc32.exe 5464 Pfgopnbo.exe 5616 Pplcnf32.exe 1212 Pgfljqia.exe 5904 Phhhbi32.exe 3376 Poaqocgl.exe 520 Pflikm32.exe 1140 Qleahgff.exe 6112 Qcpieamc.exe 3288 Qhlamhkj.exe 2380 Qqcjnell.exe 2480 Qgmbkp32.exe 3056 Ahonbhig.exe 2768 Aoifoa32.exe 5256 Ajnkmjqj.exe 2676 Aqhcid32.exe 5564 Agbkfood.exe 1240 Aichng32.exe 4700 Aqjpod32.exe 2636 Agdhln32.exe 3132 Aifdcgcp.exe 2760 Aopmpq32.exe 5672 Afjemkbi.exe 5268 Amcmie32.exe 1660 Acnefoac.exe 1560 Bjgncihp.exe 5372 Bqafpc32.exe 4872 Bcpblo32.exe 980 Bjjjhifm.exe 3332 Bqdbec32.exe 6048 Bgnkamef.exe 5592 Bqfokblg.exe 5748 Bgpggm32.exe 3728 Biadoeib.exe 848 Bpkllo32.exe 4864 Bfedhihl.exe 412 Bmomecoi.exe 2360 Bciebm32.exe 2804 Cjcmognb.exe 752 Cameka32.exe 1744 Cfjnch32.exe 4120 Capbaacl.exe 5008 Cgijnk32.exe 976 Cikgecag.exe 1932 Cpeobn32.exe 5280 Cfogohpa.exe 5884 Cimckcoe.exe 2964 Cpglgmfa.exe 6120 Cfaddg32.exe 4268 Cmklaaek.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Lalnfooo.exe Lgcjmjho.exe File created C:\Windows\SysWOW64\Illiakok.dll Qejkfp32.exe File created C:\Windows\SysWOW64\Imbpam32.exe Hfhgdc32.exe File opened for modification C:\Windows\SysWOW64\Nflkkf32.exe Npbcollj.exe File created C:\Windows\SysWOW64\Fphneijl.exe Fkkemble.exe File created C:\Windows\SysWOW64\Nppakcok.dll Hahcfi32.exe File opened for modification C:\Windows\SysWOW64\Dfcjoa32.exe Dmjefkap.exe File opened for modification C:\Windows\SysWOW64\Emhahiep.exe Ebcmjqej.exe File created C:\Windows\SysWOW64\Fbipejob.dll Gkfnnjnl.exe File created C:\Windows\SysWOW64\Ombanm32.dll Ilhcmpeg.exe File created C:\Windows\SysWOW64\Hfiobm32.dll Fcpadd32.exe File created C:\Windows\SysWOW64\Aoinde32.dll Gjmffn32.exe File created C:\Windows\SysWOW64\Khnhkdjh.dll Mgaoda32.exe File created C:\Windows\SysWOW64\Ojmhaklf.exe Ndcoeq32.exe File created C:\Windows\SysWOW64\Oeclockl.exe Ojmhaklf.exe File opened for modification C:\Windows\SysWOW64\Lnendhol.exe Kpankd32.exe File created C:\Windows\SysWOW64\Mgamci32.dll Bpedoold.exe File created C:\Windows\SysWOW64\Edaamihh.exe Ejlmppha.exe File created C:\Windows\SysWOW64\Kemndfob.dll Gjoclm32.exe File opened for modification C:\Windows\SysWOW64\Ddjmkg32.exe Domdcpib.exe File opened for modification C:\Windows\SysWOW64\Oofacdaj.exe Ohlifj32.exe File opened for modification C:\Windows\SysWOW64\Hahcfi32.exe Hknkiokp.exe File created C:\Windows\SysWOW64\Jgqdal32.exe Jbdliejl.exe File created C:\Windows\SysWOW64\Qemhlp32.exe Qkgcog32.exe File created C:\Windows\SysWOW64\Ljfjme32.dll Chiipg32.exe File created C:\Windows\SysWOW64\Ffjbpe32.dll Pflmhnbi.exe File created C:\Windows\SysWOW64\Qejkfp32.exe Qopbjf32.exe File created C:\Windows\SysWOW64\Fgbfbc32.exe Fphneijl.exe File opened for modification C:\Windows\SysWOW64\Jlhlcnge.exe Jgkdkg32.exe File created C:\Windows\SysWOW64\Jieoac32.dll Omnqcfig.exe File created C:\Windows\SysWOW64\Emfqafob.dll Eicemccc.exe File created C:\Windows\SysWOW64\Gdlgjg32.dll Iiipfnch.exe File created C:\Windows\SysWOW64\Jiglgl32.exe Joahjcgb.exe File created C:\Windows\SysWOW64\Kjejiiif.dll Nflkkf32.exe File opened for modification C:\Windows\SysWOW64\Fgenoj32.exe Eqkfapoe.exe File opened for modification C:\Windows\SysWOW64\Pfdbknda.exe Pokjnd32.exe File created C:\Windows\SysWOW64\Ggfombmd.exe Gpmgph32.exe File opened for modification C:\Windows\SysWOW64\Mijlhl32.exe Mbpdkabl.exe File opened for modification C:\Windows\SysWOW64\Eilomd32.exe Ebbfpjbn.exe File created C:\Windows\SysWOW64\Aphngglp.exe Aogbpo32.exe File opened for modification C:\Windows\SysWOW64\Dhbelp32.exe Dahmoefm.exe File created C:\Windows\SysWOW64\Hnfohj32.exe Hglflpok.exe File opened for modification C:\Windows\SysWOW64\Bqafpc32.exe Bjgncihp.exe File created C:\Windows\SysWOW64\Ghflgedf.exe Gmqgjl32.exe File opened for modification C:\Windows\SysWOW64\Jbdliejl.exe Jkjclk32.exe File opened for modification C:\Windows\SysWOW64\Plijbblh.exe Pacfdila.exe File opened for modification C:\Windows\SysWOW64\Illfmi32.exe Iebnqofj.exe File created C:\Windows\SysWOW64\Baephacf.exe Bfolki32.exe File created C:\Windows\SysWOW64\Egihhe32.exe Edklljnp.exe File opened for modification C:\Windows\SysWOW64\Kcgnkgkl.exe Jlmfomcp.exe File created C:\Windows\SysWOW64\Flmqem32.exe Fechhcal.exe File opened for modification C:\Windows\SysWOW64\Iepako32.exe Ilglbjbl.exe File created C:\Windows\SysWOW64\Aagkaj32.exe Agbgda32.exe File created C:\Windows\SysWOW64\Jhhonl32.exe Jangaboo.exe File created C:\Windows\SysWOW64\Kbpaon32.dll Bjgncihp.exe File created C:\Windows\SysWOW64\Kohhopdk.dll Ajpqhdkl.exe File opened for modification C:\Windows\SysWOW64\Lnadkmhj.exe Lgglnb32.exe File created C:\Windows\SysWOW64\Cncnhh32.exe Cgiflnoa.exe File opened for modification C:\Windows\SysWOW64\Nophfa32.exe Niconj32.exe File created C:\Windows\SysWOW64\Nklbfaae.exe Nbqmbo32.exe File opened for modification C:\Windows\SysWOW64\Hfcnicjl.exe Hpiemj32.exe File created C:\Windows\SysWOW64\Ehlhbn32.exe Eglkhk32.exe File created C:\Windows\SysWOW64\Ihmobn32.exe Iencfb32.exe File opened for modification C:\Windows\SysWOW64\Pkencn32.exe Pidaleei.exe - Program crash 1 IoCs
pid pid_target Process procid_target 20404 16128 Process not Found 2480 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Khiopp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qfhmcl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdjbel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbmhglqi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckkilhjm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnpmej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpdlajfe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnppbapl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Henajkcc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aadgadai.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gjoclm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Indkih32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nimbdi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pkqdhnom.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ohlifj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgpggm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdmecdlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ejchbmna.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nalpbf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bohbackj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljdboe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aomipkic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Doanno32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flfjdn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ipjocgdm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knnhdied.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nggnjjoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pdenghpi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-08_aac62b21b1d150fe6db9a95c58233549_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbobnf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dpmknf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmighf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljcejhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjjkkghp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nglhei32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bkgekock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pgfljqia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nihiiimi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odhipp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qopbjf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aogbpo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgjhiibl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kafcmglb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pcpnab32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mbpdkabl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emhahiep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgnihd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnfnfl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbkblb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgoadi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hiofeigg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phhhbi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Plmmbkdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gihgoq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jiglgl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckbegmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Haebol32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ejjqjp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djcoko32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhnlapbo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pcgdbakj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdjfhnpe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qleahgff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emnbmoef.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fnffam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Inbndi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnjapoec.dll" Mbpdkabl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Albdgdpl.dll" Halaeeod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aoifoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bkeppeii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keeiahmm.dll" Ppgeqijb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Angpod32.dll" Fqpomo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcffcd32.dll" Jlphnbfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ekljic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mnkgakpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfnpdfgc.dll" Hedaoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hlmbadfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ooibee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mjjkkghp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kaofcf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnddfh32.dll" Mlhqll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glghpa32.dll" Obikgppg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Inpaoi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chbjoe32.dll" Efkfkilj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lopmbomp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkkoeh32.dll" Nggnjjoo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ombcdo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aapeakij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aphngglp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hohmhobk.dll" Joekkl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Omalii32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cgijnk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gnjjpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lqfnqjpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnfjeh32.dll" Jdjfhnpe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ebcmjqej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qkgnqm32.dll" Ffaogm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Icdhojka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfdjgm32.dll" Pnmojp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gilomqok.dll" Iolhdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Klbnjo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hncmfj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lgnihd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qkgcog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cdggoi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gmmmoppl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ggcjphja.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kamjmf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pemibn32.dll" Kqpoja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Akffjkme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obmichdq.dll" Ebimqi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgecbebc.dll" Ilglbjbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Haebol32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Adbdml32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ihmobn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Igmgji32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pcpnab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afaccndj.dll" Cgijnk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pkqdhnom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbfpoddf.dll" Fldeie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hfcnicjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gjmffn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Agdhln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dakampio.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ikijenab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhohahlh.dll" Gnnjgh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kckqlpck.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jacggh32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4600 wrote to memory of 5112 4600 2026-11-08_aac62b21b1d150fe6db9a95c58233549_elex_wannacry.exe 87 PID 5112 wrote to memory of 2664 5112 Opjnai32.exe 89 PID 2664 wrote to memory of 3064 2664 Ohebek32.exe 90 PID 3064 wrote to memory of 4604 3064 Opnglhnd.exe 91 PID 4604 wrote to memory of 4512 4604 Oekpdoll.exe 92 PID 4512 wrote to memory of 3500 4512 Olehai32.exe 93 PID 3500 wrote to memory of 4332 3500 Ocopncke.exe 94 PID 4332 wrote to memory of 2776 4332 Ohlifj32.exe 95 PID 2776 wrote to memory of 5404 2776 Oofacdaj.exe 96 PID 5404 wrote to memory of 5304 5404 Ojkepmqp.exe 97 PID 5304 wrote to memory of 3868 5304 Pohnhdog.exe 98 PID 3868 wrote to memory of 1196 3868 Pjnbfmom.exe 99 PID 1196 wrote to memory of 944 1196 Pokjnd32.exe 100 PID 944 wrote to memory of 4248 944 Pfdbknda.exe 101 PID 4248 wrote to memory of 4152 4248 Phcogice.exe 102 PID 4152 wrote to memory of 5464 4152 Pomgcc32.exe 103 PID 5464 wrote to memory of 5616 5464 Pfgopnbo.exe 104 PID 5616 wrote to memory of 1212 5616 Pplcnf32.exe 105 PID 1212 wrote to memory of 5904 1212 Pgfljqia.exe 106 PID 5904 wrote to memory of 3376 5904 Phhhbi32.exe 107 PID 3376 wrote to memory of 520 3376 Poaqocgl.exe 108 PID 520 wrote to memory of 1140 520 Pflikm32.exe 109 PID 1140 wrote to memory of 6112 1140 Qleahgff.exe 110 PID 6112 wrote to memory of 3288 6112 Qcpieamc.exe 111 PID 3288 wrote to memory of 2380 3288 Qhlamhkj.exe 112 PID 2380 wrote to memory of 2480 2380 Qqcjnell.exe 113 PID 2480 wrote to memory of 3056 2480 Qgmbkp32.exe 114 PID 3056 wrote to memory of 2768 3056 Ahonbhig.exe 115 PID 2768 wrote to memory of 5256 2768 Aoifoa32.exe 116 PID 5256 wrote to memory of 2676 5256 Ajnkmjqj.exe 117 PID 2676 wrote to memory of 5564 2676 Aqhcid32.exe 118 PID 5564 wrote to memory of 1240 5564 Agbkfood.exe 119 PID 1240 wrote to memory of 4700 1240 Aichng32.exe 120 PID 4700 wrote to memory of 2636 4700 Aqjpod32.exe 121 PID 2636 wrote to memory of 3132 2636 Agdhln32.exe 122 PID 3132 wrote to memory of 2760 3132 Aifdcgcp.exe 123 PID 2760 wrote to memory of 5672 2760 Aopmpq32.exe 124 PID 5672 wrote to memory of 5268 5672 Afjemkbi.exe 125 PID 5268 wrote to memory of 1660 5268 Amcmie32.exe 126 PID 1660 wrote to memory of 1560 1660 Acnefoac.exe 127 PID 1560 wrote to memory of 5372 1560 Bjgncihp.exe 128 PID 5372 wrote to memory of 4872 5372 Bqafpc32.exe 129 PID 4872 wrote to memory of 980 4872 Bcpblo32.exe 130 PID 980 wrote to memory of 3332 980 Bjjjhifm.exe 131 PID 3332 wrote to memory of 6048 3332 Bqdbec32.exe 132 PID 6048 wrote to memory of 5592 6048 Bgnkamef.exe 133 PID 5592 wrote to memory of 5748 5592 Bqfokblg.exe 134 PID 5748 wrote to memory of 3728 5748 Bgpggm32.exe 135 PID 3728 wrote to memory of 848 3728 Biadoeib.exe 136 PID 848 wrote to memory of 4864 848 Bpkllo32.exe 137 PID 4864 wrote to memory of 412 4864 Bfedhihl.exe 138 PID 412 wrote to memory of 2360 412 Bmomecoi.exe 139 PID 2360 wrote to memory of 2804 2360 Bciebm32.exe 140 PID 2804 wrote to memory of 752 2804 Cjcmognb.exe 141 PID 752 wrote to memory of 1744 752 Cameka32.exe 142 PID 1744 wrote to memory of 4120 1744 Cfjnch32.exe 143 PID 4120 wrote to memory of 5008 4120 Capbaacl.exe 144 PID 5008 wrote to memory of 976 5008 Cgijnk32.exe 145 PID 976 wrote to memory of 1932 976 Cikgecag.exe 146 PID 1932 wrote to memory of 5280 1932 Cpeobn32.exe 147 PID 5280 wrote to memory of 5884 5280 Cfogohpa.exe 148 PID 5884 wrote to memory of 2964 5884 Cimckcoe.exe 149 PID 2964 wrote to memory of 6120 2964 Cpglgmfa.exe 150 PID 6120 wrote to memory of 4268 6120 Cfaddg32.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-08_aac62b21b1d150fe6db9a95c58233549_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-08_aac62b21b1d150fe6db9a95c58233549_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\Opjnai32.exeC:\Windows\system32\Opjnai32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\Ohebek32.exeC:\Windows\system32\Ohebek32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\Opnglhnd.exeC:\Windows\system32\Opnglhnd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\Oekpdoll.exeC:\Windows\system32\Oekpdoll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\Olehai32.exeC:\Windows\system32\Olehai32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\Ocopncke.exeC:\Windows\system32\Ocopncke.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\Ohlifj32.exeC:\Windows\system32\Ohlifj32.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\Oofacdaj.exeC:\Windows\system32\Oofacdaj.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\Ojkepmqp.exeC:\Windows\system32\Ojkepmqp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\SysWOW64\Pohnhdog.exeC:\Windows\system32\Pohnhdog.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Windows\SysWOW64\Pjnbfmom.exeC:\Windows\system32\Pjnbfmom.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\Pokjnd32.exeC:\Windows\system32\Pokjnd32.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\Pfdbknda.exeC:\Windows\system32\Pfdbknda.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\Phcogice.exeC:\Windows\system32\Phcogice.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\Pomgcc32.exeC:\Windows\system32\Pomgcc32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\Pfgopnbo.exeC:\Windows\system32\Pfgopnbo.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\Pplcnf32.exeC:\Windows\system32\Pplcnf32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\SysWOW64\Pgfljqia.exeC:\Windows\system32\Pgfljqia.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\Phhhbi32.exeC:\Windows\system32\Phhhbi32.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\SysWOW64\Poaqocgl.exeC:\Windows\system32\Poaqocgl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\Pflikm32.exeC:\Windows\system32\Pflikm32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\SysWOW64\Qleahgff.exeC:\Windows\system32\Qleahgff.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\Qcpieamc.exeC:\Windows\system32\Qcpieamc.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Windows\SysWOW64\Qhlamhkj.exeC:\Windows\system32\Qhlamhkj.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\Qqcjnell.exeC:\Windows\system32\Qqcjnell.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\Qgmbkp32.exeC:\Windows\system32\Qgmbkp32.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\Ahonbhig.exeC:\Windows\system32\Ahonbhig.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\Aoifoa32.exeC:\Windows\system32\Aoifoa32.exe29⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\Ajnkmjqj.exeC:\Windows\system32\Ajnkmjqj.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Windows\SysWOW64\Aqhcid32.exeC:\Windows\system32\Aqhcid32.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\Agbkfood.exeC:\Windows\system32\Agbkfood.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\Aichng32.exeC:\Windows\system32\Aichng32.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\Aqjpod32.exeC:\Windows\system32\Aqjpod32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\Agdhln32.exeC:\Windows\system32\Agdhln32.exe35⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\Aifdcgcp.exeC:\Windows\system32\Aifdcgcp.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\Aopmpq32.exeC:\Windows\system32\Aopmpq32.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\Afjemkbi.exeC:\Windows\system32\Afjemkbi.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Windows\SysWOW64\Amcmie32.exeC:\Windows\system32\Amcmie32.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Windows\SysWOW64\Acnefoac.exeC:\Windows\system32\Acnefoac.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\Bjgncihp.exeC:\Windows\system32\Bjgncihp.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\Bqafpc32.exeC:\Windows\system32\Bqafpc32.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Windows\SysWOW64\Bcpblo32.exeC:\Windows\system32\Bcpblo32.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\Bjjjhifm.exeC:\Windows\system32\Bjjjhifm.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\Bqdbec32.exeC:\Windows\system32\Bqdbec32.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\Bgnkamef.exeC:\Windows\system32\Bgnkamef.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Windows\SysWOW64\Bqfokblg.exeC:\Windows\system32\Bqfokblg.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Windows\SysWOW64\Bgpggm32.exeC:\Windows\system32\Bgpggm32.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Windows\SysWOW64\Biadoeib.exeC:\Windows\system32\Biadoeib.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\Bpkllo32.exeC:\Windows\system32\Bpkllo32.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\Bfedhihl.exeC:\Windows\system32\Bfedhihl.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\Bmomecoi.exeC:\Windows\system32\Bmomecoi.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\SysWOW64\Bciebm32.exeC:\Windows\system32\Bciebm32.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\Cjcmognb.exeC:\Windows\system32\Cjcmognb.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\Cameka32.exeC:\Windows\system32\Cameka32.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\Cfjnch32.exeC:\Windows\system32\Cfjnch32.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\Capbaacl.exeC:\Windows\system32\Capbaacl.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\Cgijnk32.exeC:\Windows\system32\Cgijnk32.exe58⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\Cikgecag.exeC:\Windows\system32\Cikgecag.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\Cpeobn32.exeC:\Windows\system32\Cpeobn32.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\Cfogohpa.exeC:\Windows\system32\Cfogohpa.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Windows\SysWOW64\Cimckcoe.exeC:\Windows\system32\Cimckcoe.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Windows\SysWOW64\Cpglgmfa.exeC:\Windows\system32\Cpglgmfa.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\Cfaddg32.exeC:\Windows\system32\Cfaddg32.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\Cmklaaek.exeC:\Windows\system32\Cmklaaek.exe65⤵
- Executes dropped EXE
PID:4268 -
C:\Windows\SysWOW64\Dgqqnjea.exeC:\Windows\system32\Dgqqnjea.exe66⤵PID:5468
-
C:\Windows\SysWOW64\Dibmfb32.exeC:\Windows\system32\Dibmfb32.exe67⤵PID:5872
-
C:\Windows\SysWOW64\Dcgackke.exeC:\Windows\system32\Dcgackke.exe68⤵PID:3844
-
C:\Windows\SysWOW64\Djaipe32.exeC:\Windows\system32\Djaipe32.exe69⤵PID:1308
-
C:\Windows\SysWOW64\Dakampio.exeC:\Windows\system32\Dakampio.exe70⤵
- Modifies registry class
PID:4072 -
C:\Windows\SysWOW64\Dfhjefhf.exeC:\Windows\system32\Dfhjefhf.exe71⤵PID:5876
-
C:\Windows\SysWOW64\Dmbbaq32.exeC:\Windows\system32\Dmbbaq32.exe72⤵PID:5440
-
C:\Windows\SysWOW64\Dhgfoioi.exeC:\Windows\system32\Dhgfoioi.exe73⤵PID:4500
-
C:\Windows\SysWOW64\Diicfa32.exeC:\Windows\system32\Diicfa32.exe74⤵PID:4972
-
C:\Windows\SysWOW64\Dpckclld.exeC:\Windows\system32\Dpckclld.exe75⤵PID:3412
-
C:\Windows\SysWOW64\Djhpqdlj.exeC:\Windows\system32\Djhpqdlj.exe76⤵PID:5584
-
C:\Windows\SysWOW64\Dabhmo32.exeC:\Windows\system32\Dabhmo32.exe77⤵PID:2864
-
C:\Windows\SysWOW64\Ehlpjikd.exeC:\Windows\system32\Ehlpjikd.exe78⤵PID:5048
-
C:\Windows\SysWOW64\Emihbp32.exeC:\Windows\system32\Emihbp32.exe79⤵PID:4708
-
C:\Windows\SysWOW64\Edcqojqh.exeC:\Windows\system32\Edcqojqh.exe80⤵PID:5708
-
C:\Windows\SysWOW64\Ejmild32.exeC:\Windows\system32\Ejmild32.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2112 -
C:\Windows\SysWOW64\Epjadk32.exeC:\Windows\system32\Epjadk32.exe82⤵PID:5520
-
C:\Windows\SysWOW64\Efdjqeni.exeC:\Windows\system32\Efdjqeni.exe83⤵PID:5264
-
C:\Windows\SysWOW64\Emnbmoef.exeC:\Windows\system32\Emnbmoef.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2420 -
C:\Windows\SysWOW64\Ehcfkhel.exeC:\Windows\system32\Ehcfkhel.exe85⤵PID:3960
-
C:\Windows\SysWOW64\Eidbbp32.exeC:\Windows\system32\Eidbbp32.exe86⤵PID:5580
-
C:\Windows\SysWOW64\Epokojbg.exeC:\Windows\system32\Epokojbg.exe87⤵PID:2908
-
C:\Windows\SysWOW64\Efhcld32.exeC:\Windows\system32\Efhcld32.exe88⤵PID:2920
-
C:\Windows\SysWOW64\Eangimij.exeC:\Windows\system32\Eangimij.exe89⤵PID:2208
-
C:\Windows\SysWOW64\Ffkpadga.exeC:\Windows\system32\Ffkpadga.exe90⤵PID:4536
-
C:\Windows\SysWOW64\Fapdomgg.exeC:\Windows\system32\Fapdomgg.exe91⤵PID:4572
-
C:\Windows\SysWOW64\Fhjlkg32.exeC:\Windows\system32\Fhjlkg32.exe92⤵PID:5436
-
C:\Windows\SysWOW64\Filicodb.exeC:\Windows\system32\Filicodb.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5620 -
C:\Windows\SysWOW64\Fdamph32.exeC:\Windows\system32\Fdamph32.exe94⤵PID:1892
-
C:\Windows\SysWOW64\Fkkemble.exeC:\Windows\system32\Fkkemble.exe95⤵
- Drops file in System32 directory
PID:3708 -
C:\Windows\SysWOW64\Fphneijl.exeC:\Windows\system32\Fphneijl.exe96⤵
- Drops file in System32 directory
PID:6160 -
C:\Windows\SysWOW64\Fgbfbc32.exeC:\Windows\system32\Fgbfbc32.exe97⤵PID:6200
-
C:\Windows\SysWOW64\Fmlnomif.exeC:\Windows\system32\Fmlnomif.exe98⤵PID:6240
-
C:\Windows\SysWOW64\Fhablf32.exeC:\Windows\system32\Fhablf32.exe99⤵PID:6280
-
C:\Windows\SysWOW64\Fibocnnj.exeC:\Windows\system32\Fibocnnj.exe100⤵PID:6320
-
C:\Windows\SysWOW64\Gpmgph32.exeC:\Windows\system32\Gpmgph32.exe101⤵
- Drops file in System32 directory
PID:6360 -
C:\Windows\SysWOW64\Ggfombmd.exeC:\Windows\system32\Ggfombmd.exe102⤵PID:6400
-
C:\Windows\SysWOW64\Gmqgjl32.exeC:\Windows\system32\Gmqgjl32.exe103⤵
- Drops file in System32 directory
PID:6440 -
C:\Windows\SysWOW64\Ghflgedf.exeC:\Windows\system32\Ghflgedf.exe104⤵PID:6480
-
C:\Windows\SysWOW64\Gighom32.exeC:\Windows\system32\Gighom32.exe105⤵PID:6524
-
C:\Windows\SysWOW64\Gdmmlf32.exeC:\Windows\system32\Gdmmlf32.exe106⤵PID:6564
-
C:\Windows\SysWOW64\Gkgeipah.exeC:\Windows\system32\Gkgeipah.exe107⤵PID:6604
-
C:\Windows\SysWOW64\Gaqmej32.exeC:\Windows\system32\Gaqmej32.exe108⤵PID:6644
-
C:\Windows\SysWOW64\Ggnenagl.exeC:\Windows\system32\Ggnenagl.exe109⤵PID:6684
-
C:\Windows\SysWOW64\Gacjkjgb.exeC:\Windows\system32\Gacjkjgb.exe110⤵PID:6724
-
C:\Windows\SysWOW64\Ghmbhd32.exeC:\Windows\system32\Ghmbhd32.exe111⤵PID:6764
-
C:\Windows\SysWOW64\Gnjjpk32.exeC:\Windows\system32\Gnjjpk32.exe112⤵
- Modifies registry class
PID:6804 -
C:\Windows\SysWOW64\Hddbmedc.exeC:\Windows\system32\Hddbmedc.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6844 -
C:\Windows\SysWOW64\Hknkiokp.exeC:\Windows\system32\Hknkiokp.exe114⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:6884 -
C:\Windows\SysWOW64\Hahcfi32.exeC:\Windows\system32\Hahcfi32.exe115⤵
- Drops file in System32 directory
PID:6924 -
C:\Windows\SysWOW64\Hgdlnp32.exeC:\Windows\system32\Hgdlnp32.exe116⤵PID:6964
-
C:\Windows\SysWOW64\Hajpli32.exeC:\Windows\system32\Hajpli32.exe117⤵PID:7004
-
C:\Windows\SysWOW64\Hgghdp32.exeC:\Windows\system32\Hgghdp32.exe118⤵PID:7044
-
C:\Windows\SysWOW64\Halmaiog.exeC:\Windows\system32\Halmaiog.exe119⤵PID:7088
-
C:\Windows\SysWOW64\Hhfenc32.exeC:\Windows\system32\Hhfenc32.exe120⤵PID:7128
-
C:\Windows\SysWOW64\Hncmfj32.exeC:\Windows\system32\Hncmfj32.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:4516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-