Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/11/2026, 23:04
Behavioral task
behavioral1
Sample
2026-11-08_99b64837bb5adb0591fe6268ae754ca7_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-08_99b64837bb5adb0591fe6268ae754ca7_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-11-08_99b64837bb5adb0591fe6268ae754ca7_elex_wannacry.exe
- Size 320KB
- Sample261108-22m41afy2j
- SHA256 666aec3c33f0560c88af8d360f5cb8d8823cb57c74ba8ee099b65f95a285000e
- MD5 99b64837bb5adb0591fe6268ae754ca7
- SHA1 1a033368004cd2b458d24341fd49ce40f9c4ad99
- SHA512 103d1124ebabf94472d2511cf442fc0d72c28577a4927f76c8a3e79450098f4c33cc1eff959fd2de94d1daf2dd6c84a9c59c5192d13cd1e57954e89f7ce1b144
- SSDEEP 3072:Yp2NWXmX4PPwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:MPPV/Ah1G/AcQ///NR5fn
- TLSH T15E645F49263049EBCEED1FB6AC1249D9A541E8F055F1E23E6163DFDEC8E4DA2C805F81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://master-x.com/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://crutop.ru/index.php
-
http://kaspersky.ru/index.php
-
http://color-bank.ru/index.php
-
http://adult-empire.com/index.php
-
http://virus-list.com/index.php
-
http://trojan.ru/index.php
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://fethard.biz/index.htm
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://kaspersky.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cmdmki32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fojenfeg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gibhihko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lqfnqjpi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilnbch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ncifdlii.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Caebfg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifbbbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bqafpc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eiobmjkd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aefjbo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojcghc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kjccna32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmmqbb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dejamdca.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jqgldb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmjlpnpb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hkpqdifa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lfbpnjjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kojdflkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bjokno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hdlphjaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qfpbfljd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gmpqof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hmbflc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mnhkklbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mckbhg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pbekboej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bjmnho32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afjlgafe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bffkcp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fhbifl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcdlgnkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kdgapp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bohbackj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofaeffpa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eaonccme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fkiobhac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oomnmfid.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbomfokl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jepjbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Padeem32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ehlhbn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eqgmgq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kqmkjk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Meepne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ojajbdde.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jidigfeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kjafha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mflbdibj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmkfjn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Enfceefi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fbkblb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amdbffme.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Foghhg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cameka32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgkdkg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Omkmcpgo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njdlfbgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jnqbmadp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dkmogbeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ngikpjml.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oanodnip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nobldfio.exe - Executes dropped EXE 64 IoCs
pid Process 3108 Pqhammje.exe 4768 Pmoabn32.exe 4168 Pnonla32.exe 3624 Pggbdgmm.exe 4812 Pmdkmnkd.exe 2888 Pcncjh32.exe 5672 Pncggqbg.exe 4836 Qcppogqo.exe 412 Qjjhla32.exe 2272 Qcbmegol.exe 3136 Qjmeaafi.exe 2852 Qqfmnk32.exe 5156 Afcffb32.exe 5816 Aqijdk32.exe 4140 Afeblb32.exe 2568 Aqkgikip.exe 4972 Afhoaahg.exe 5808 Aancojgn.exe 1156 Afjlgafe.exe 2016 Aappdj32.exe 4324 Afmhma32.exe 4988 Benijhla.exe 1200 Bnfmcn32.exe 2144 Bccfleqi.exe 3484 Bjmnho32.exe 4748 Bebbeh32.exe 3404 Bjokno32.exe 3740 Baickimp.exe 3964 Bffkcp32.exe 2396 Balpph32.exe 3284 Bfhhho32.exe 124 Bmbpeiaa.exe 2652 Chhdbb32.exe 3764 Cmdmki32.exe 6068 Cdoegcfl.exe 5796 Cndidlfb.exe 4332 Cenaaf32.exe 1768 Cjkjjmlf.exe 3364 Caebfg32.exe 4328 Cfakon32.exe 4356 Cagolf32.exe 2388 Cjpcel32.exe 4116 Ddhhnana.exe 5528 Donlkjng.exe 1636 Ddjecalo.exe 4856 Dkdmpl32.exe 3992 Dejamdca.exe 4436 Dfknem32.exe 1544 Daqbbe32.exe 5324 Dkifkkpf.exe 620 Ddakdqff.exe 4676 Eogoaifl.exe 5408 Eddhipdd.exe 5380 Eknpfj32.exe 3328 Eecdcckf.exe 4824 Ekpmljin.exe 4632 Edhado32.exe 4380 Eoneah32.exe 2724 Eehnnb32.exe 4484 Ekefgi32.exe 3716 Eaonccme.exe 2772 Fkgbli32.exe 6020 Femgia32.exe 4280 Fkiobhac.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Jkjclk32.exe Jqdoob32.exe File created C:\Windows\SysWOW64\Bmbpeiaa.exe Bfhhho32.exe File created C:\Windows\SysWOW64\Foghhg32.exe Feocoaai.exe File created C:\Windows\SysWOW64\Fnoido32.dll Aqmldddb.exe File opened for modification C:\Windows\SysWOW64\Kdgapp32.exe Jgcafl32.exe File opened for modification C:\Windows\SysWOW64\Aafefq32.exe Alimnj32.exe File created C:\Windows\SysWOW64\Bndbjd32.dll Eiahhdee.exe File opened for modification C:\Windows\SysWOW64\Dnmaog32.exe Dgbhbm32.exe File created C:\Windows\SysWOW64\Bcqebkmh.dll Piocoi32.exe File created C:\Windows\SysWOW64\Afcffb32.exe Qqfmnk32.exe File created C:\Windows\SysWOW64\Gkbnbjlb.dll Fggfghap.exe File opened for modification C:\Windows\SysWOW64\Njdlfbgm.exe Mbigapjb.exe File created C:\Windows\SysWOW64\Mmagah32.dll Lmaafcml.exe File opened for modification C:\Windows\SysWOW64\Bjokno32.exe Bebbeh32.exe File created C:\Windows\SysWOW64\Pkpbaojc.dll Jkjclk32.exe File created C:\Windows\SysWOW64\Faejhf32.dll Aklddmep.exe File opened for modification C:\Windows\SysWOW64\Hpdlajfe.exe Gikdep32.exe File created C:\Windows\SysWOW64\Kflink32.exe Kpoaed32.exe File created C:\Windows\SysWOW64\Pmdioh32.exe Ofjqbndk.exe File created C:\Windows\SysWOW64\Kbneij32.exe Kldmmp32.exe File created C:\Windows\SysWOW64\Dogdnj32.exe Cdpckbli.exe File opened for modification C:\Windows\SysWOW64\Pomgcc32.exe Pgaboa32.exe File created C:\Windows\SysWOW64\Afhoaahg.exe Aqkgikip.exe File created C:\Windows\SysWOW64\Qhdnqbjf.dll Neqoidmo.exe File created C:\Windows\SysWOW64\Hfodnd32.exe Hpdlajfe.exe File opened for modification C:\Windows\SysWOW64\Mbgejcpm.exe Mqeibk32.exe File created C:\Windows\SysWOW64\Cpmmcncm.dll Benijhla.exe File created C:\Windows\SysWOW64\Oceoqioq.dll Opqdbhlb.exe File created C:\Windows\SysWOW64\Ngoighje.dll Hmbflc32.exe File created C:\Windows\SysWOW64\Eecdcckf.exe Eknpfj32.exe File opened for modification C:\Windows\SysWOW64\Emnbmoef.exe Edemdine.exe File opened for modification C:\Windows\SysWOW64\Iloimopp.exe Icfediio.exe File opened for modification C:\Windows\SysWOW64\Lofklp32.exe Lnendhol.exe File created C:\Windows\SysWOW64\Cgdlqo32.exe Cpkddd32.exe File created C:\Windows\SysWOW64\Nmacbk32.exe Nfgkfadq.exe File created C:\Windows\SysWOW64\Kehhjfif.exe Jnnpnl32.exe File created C:\Windows\SysWOW64\Eqiilp32.exe Ekladi32.exe File created C:\Windows\SysWOW64\Cjpcel32.exe Cagolf32.exe File created C:\Windows\SysWOW64\Gelqhibk.dll Pafcjijo.exe File created C:\Windows\SysWOW64\Nppfimnm.exe Nnojad32.exe File created C:\Windows\SysWOW64\Ojajbdde.exe Oplfekdp.exe File created C:\Windows\SysWOW64\Bfnqdggd.dll Ieojqi32.exe File created C:\Windows\SysWOW64\Inefnb32.dll Mckbhg32.exe File created C:\Windows\SysWOW64\Qjjhla32.exe Qcppogqo.exe File created C:\Windows\SysWOW64\Cjejdglp.exe Cameka32.exe File created C:\Windows\SysWOW64\Gbdcekfc.dll Lnmbjd32.exe File created C:\Windows\SysWOW64\Mkfobmgk.dll Bbpoge32.exe File created C:\Windows\SysWOW64\Mhbaol32.dll Njkklk32.exe File created C:\Windows\SysWOW64\Mccqgk32.dll Phaabm32.exe File created C:\Windows\SysWOW64\Cnbmaehm.dll Bnfmcn32.exe File created C:\Windows\SysWOW64\Knipik32.exe Kimgad32.exe File created C:\Windows\SysWOW64\Mnbofm32.dll Kimgad32.exe File created C:\Windows\SysWOW64\Olcklj32.exe Oookbega.exe File created C:\Windows\SysWOW64\Bmmljbhc.dll Cameka32.exe File created C:\Windows\SysWOW64\Jfigdl32.dll Aoofej32.exe File created C:\Windows\SysWOW64\Doiabgqc.exe Cbeaib32.exe File created C:\Windows\SysWOW64\Mcdlil32.exe Mjlhpgfn.exe File created C:\Windows\SysWOW64\Phcgmffo.exe Paioplob.exe File opened for modification C:\Windows\SysWOW64\Ipdnna32.exe Ieojqi32.exe File created C:\Windows\SysWOW64\Ojcpmm32.exe Opnlpdoa.exe File opened for modification C:\Windows\SysWOW64\Dffmogji.exe Dplebmbl.exe File created C:\Windows\SysWOW64\Jnfamk32.dll Eangimij.exe File created C:\Windows\SysWOW64\Inombh32.exe Ihbdja32.exe File opened for modification C:\Windows\SysWOW64\Qjfmda32.exe Qpahghbg.exe - Program crash 1 IoCs
pid pid_target Process procid_target 7240 13132 WerFault.exe 854 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkianp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajdjcc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hlcjaq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aehghn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kokkqbog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lfgboc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iggakn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cckkmg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eiahhdee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kpoaed32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbdeba32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggcjphja.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihhmaehj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Khiopp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocamcc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdodekhg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmfalimb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aojepe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bojogb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckclacmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpbfem32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pcnhfi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jphcmp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gibhihko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lqfnqjpi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onicbi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fieacc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pndlca32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahdpdd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekladi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjopmh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nbefmopd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmflkl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjlmmbfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kqmkjk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nanmhf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdpckbli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhbelp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jnnpnl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iiigqdfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjccna32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbfgdllk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eqiilp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hnnlcpcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mbppjd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nihdhl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aqjpod32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nljgfn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cffcilob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kflink32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkfcjh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bqafpc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Olmdln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hmmffnai.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Imbpam32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bdagidhi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qifiph32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eknpfj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eaonccme.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bmomecoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlfeeelm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Igpdph32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojcghc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pijjdial.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnfmno32.dll" Dpmknf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ekoniian.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lljdkn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nekgna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pndppiml.dll" Lkjehbaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bgeabloo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aklddmep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dndnjllg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ipgbngfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofiima32.dll" Jgfcfajg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aegphhqg.dll" Jofaeb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kflink32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljmgmd32.dll" Epndddnk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jgpmffeh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hlbcgj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Amdbffme.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mikcbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nebmnqdf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mceccbpj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bojogb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jocepc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mogccnfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Einmaaqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hphpap32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mcnmccfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hoheefad.dll" Jekqgnno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mckbhg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Naejcl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Phgagb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnngkkmo.dll" Ckfpai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmjoim32.dll" Hmmffnai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jpbjophf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppickpjh.dll" Dmbbaq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oopjchnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llhncc32.dll" Ennqpkcm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdiijemd.dll" Fligjnlo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dkdmpl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jqgldb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Efccfojn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhbcmqog.dll" Ikpjkf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aojepe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dmlkaela.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgeqjjko.dll" Opnbjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ihhmaehj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cfakon32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aqjpod32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cbeaib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Meepne32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ohfafn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ankfplap.dll" Gikdep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Klahof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ahdpdd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfaoli32.dll" Eknpfj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cfdgcmqd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ddifaqcn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jajdai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jigmgpap.dll" Pijjdial.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efeibfdg.dll" Hffbfn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nacmnlkd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ckaolcol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mogccnfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dhbelp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlcaej32.dll" Amfokf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Apekha32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2392 wrote to memory of 3108 2392 2026-11-08_99b64837bb5adb0591fe6268ae754ca7_elex_wannacry.exe 89 PID 3108 wrote to memory of 4768 3108 Pqhammje.exe 90 PID 4768 wrote to memory of 4168 4768 Pmoabn32.exe 91 PID 4168 wrote to memory of 3624 4168 Pnonla32.exe 92 PID 3624 wrote to memory of 4812 3624 Pggbdgmm.exe 93 PID 4812 wrote to memory of 2888 4812 Pmdkmnkd.exe 94 PID 2888 wrote to memory of 5672 2888 Pcncjh32.exe 95 PID 5672 wrote to memory of 4836 5672 Pncggqbg.exe 96 PID 4836 wrote to memory of 412 4836 Qcppogqo.exe 97 PID 412 wrote to memory of 2272 412 Qjjhla32.exe 98 PID 2272 wrote to memory of 3136 2272 Qcbmegol.exe 99 PID 3136 wrote to memory of 2852 3136 Qjmeaafi.exe 100 PID 2852 wrote to memory of 5156 2852 Qqfmnk32.exe 101 PID 5156 wrote to memory of 5816 5156 Afcffb32.exe 102 PID 5816 wrote to memory of 4140 5816 Aqijdk32.exe 103 PID 4140 wrote to memory of 2568 4140 Afeblb32.exe 104 PID 2568 wrote to memory of 4972 2568 Aqkgikip.exe 105 PID 4972 wrote to memory of 5808 4972 Afhoaahg.exe 106 PID 5808 wrote to memory of 1156 5808 Aancojgn.exe 107 PID 1156 wrote to memory of 2016 1156 Afjlgafe.exe 108 PID 2016 wrote to memory of 4324 2016 Aappdj32.exe 109 PID 4324 wrote to memory of 4988 4324 Afmhma32.exe 110 PID 4988 wrote to memory of 1200 4988 Benijhla.exe 111 PID 1200 wrote to memory of 2144 1200 Bnfmcn32.exe 112 PID 2144 wrote to memory of 3484 2144 Bccfleqi.exe 113 PID 3484 wrote to memory of 4748 3484 Bjmnho32.exe 114 PID 4748 wrote to memory of 3404 4748 Bebbeh32.exe 115 PID 3404 wrote to memory of 3740 3404 Bjokno32.exe 116 PID 3740 wrote to memory of 3964 3740 Baickimp.exe 117 PID 3964 wrote to memory of 2396 3964 Bffkcp32.exe 118 PID 2396 wrote to memory of 3284 2396 Balpph32.exe 119 PID 3284 wrote to memory of 124 3284 Bfhhho32.exe 120 PID 124 wrote to memory of 2652 124 Bmbpeiaa.exe 121 PID 2652 wrote to memory of 3764 2652 Chhdbb32.exe 122 PID 3764 wrote to memory of 6068 3764 Cmdmki32.exe 123 PID 6068 wrote to memory of 5796 6068 Cdoegcfl.exe 124 PID 5796 wrote to memory of 4332 5796 Cndidlfb.exe 125 PID 4332 wrote to memory of 1768 4332 Cenaaf32.exe 126 PID 1768 wrote to memory of 3364 1768 Cjkjjmlf.exe 127 PID 3364 wrote to memory of 4328 3364 Caebfg32.exe 128 PID 4328 wrote to memory of 4356 4328 Cfakon32.exe 129 PID 4356 wrote to memory of 2388 4356 Cagolf32.exe 130 PID 2388 wrote to memory of 4116 2388 Cjpcel32.exe 131 PID 4116 wrote to memory of 5528 4116 Ddhhnana.exe 132 PID 5528 wrote to memory of 1636 5528 Donlkjng.exe 133 PID 1636 wrote to memory of 4856 1636 Ddjecalo.exe 134 PID 4856 wrote to memory of 3992 4856 Dkdmpl32.exe 135 PID 3992 wrote to memory of 4436 3992 Dejamdca.exe 136 PID 4436 wrote to memory of 1544 4436 Dfknem32.exe 137 PID 1544 wrote to memory of 5324 1544 Daqbbe32.exe 138 PID 5324 wrote to memory of 620 5324 Dkifkkpf.exe 139 PID 620 wrote to memory of 4676 620 Ddakdqff.exe 140 PID 4676 wrote to memory of 5408 4676 Eogoaifl.exe 141 PID 5408 wrote to memory of 5380 5408 Eddhipdd.exe 142 PID 5380 wrote to memory of 3328 5380 Eknpfj32.exe 143 PID 3328 wrote to memory of 4824 3328 Eecdcckf.exe 144 PID 4824 wrote to memory of 4632 4824 Ekpmljin.exe 145 PID 4632 wrote to memory of 4380 4632 Edhado32.exe 146 PID 4380 wrote to memory of 2724 4380 Eoneah32.exe 147 PID 2724 wrote to memory of 4484 2724 Eehnnb32.exe 148 PID 4484 wrote to memory of 3716 4484 Ekefgi32.exe 149 PID 3716 wrote to memory of 2772 3716 Eaonccme.exe 150 PID 2772 wrote to memory of 6020 2772 Fkgbli32.exe 151 PID 6020 wrote to memory of 4280 6020 Femgia32.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-08_99b64837bb5adb0591fe6268ae754ca7_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-08_99b64837bb5adb0591fe6268ae754ca7_elex_wannacry.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\Pqhammje.exeC:\Windows\system32\Pqhammje.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\Pmoabn32.exeC:\Windows\system32\Pmoabn32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\Pnonla32.exeC:\Windows\system32\Pnonla32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\Pggbdgmm.exeC:\Windows\system32\Pggbdgmm.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\Pmdkmnkd.exeC:\Windows\system32\Pmdkmnkd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\Pcncjh32.exeC:\Windows\system32\Pcncjh32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\Pncggqbg.exeC:\Windows\system32\Pncggqbg.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Windows\SysWOW64\Qcppogqo.exeC:\Windows\system32\Qcppogqo.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\Qjjhla32.exeC:\Windows\system32\Qjjhla32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\SysWOW64\Qcbmegol.exeC:\Windows\system32\Qcbmegol.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\Qjmeaafi.exeC:\Windows\system32\Qjmeaafi.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\Qqfmnk32.exeC:\Windows\system32\Qqfmnk32.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\Afcffb32.exeC:\Windows\system32\Afcffb32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Windows\SysWOW64\Aqijdk32.exeC:\Windows\system32\Aqijdk32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\Afeblb32.exeC:\Windows\system32\Afeblb32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\Aqkgikip.exeC:\Windows\system32\Aqkgikip.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\Afhoaahg.exeC:\Windows\system32\Afhoaahg.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\Aancojgn.exeC:\Windows\system32\Aancojgn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\Afjlgafe.exeC:\Windows\system32\Afjlgafe.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\Aappdj32.exeC:\Windows\system32\Aappdj32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\Afmhma32.exeC:\Windows\system32\Afmhma32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\Benijhla.exeC:\Windows\system32\Benijhla.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\Bnfmcn32.exeC:\Windows\system32\Bnfmcn32.exe24⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\Bccfleqi.exeC:\Windows\system32\Bccfleqi.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\Bjmnho32.exeC:\Windows\system32\Bjmnho32.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\Bebbeh32.exeC:\Windows\system32\Bebbeh32.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\Bjokno32.exeC:\Windows\system32\Bjokno32.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\Baickimp.exeC:\Windows\system32\Baickimp.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\Bffkcp32.exeC:\Windows\system32\Bffkcp32.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\Balpph32.exeC:\Windows\system32\Balpph32.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\Bfhhho32.exeC:\Windows\system32\Bfhhho32.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\Bmbpeiaa.exeC:\Windows\system32\Bmbpeiaa.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Windows\SysWOW64\Chhdbb32.exeC:\Windows\system32\Chhdbb32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\Cmdmki32.exeC:\Windows\system32\Cmdmki32.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\Cdoegcfl.exeC:\Windows\system32\Cdoegcfl.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Windows\SysWOW64\Cndidlfb.exeC:\Windows\system32\Cndidlfb.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Windows\SysWOW64\Cenaaf32.exeC:\Windows\system32\Cenaaf32.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\Cjkjjmlf.exeC:\Windows\system32\Cjkjjmlf.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\Caebfg32.exeC:\Windows\system32\Caebfg32.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\Cfakon32.exeC:\Windows\system32\Cfakon32.exe41⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\Cagolf32.exeC:\Windows\system32\Cagolf32.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\Cjpcel32.exeC:\Windows\system32\Cjpcel32.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\Ddhhnana.exeC:\Windows\system32\Ddhhnana.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\Donlkjng.exeC:\Windows\system32\Donlkjng.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Windows\SysWOW64\Ddjecalo.exeC:\Windows\system32\Ddjecalo.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\Dkdmpl32.exeC:\Windows\system32\Dkdmpl32.exe47⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\Dejamdca.exeC:\Windows\system32\Dejamdca.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\Dfknem32.exeC:\Windows\system32\Dfknem32.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\Daqbbe32.exeC:\Windows\system32\Daqbbe32.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\Dkifkkpf.exeC:\Windows\system32\Dkifkkpf.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Windows\SysWOW64\Ddakdqff.exeC:\Windows\system32\Ddakdqff.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\Eogoaifl.exeC:\Windows\system32\Eogoaifl.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\Eddhipdd.exeC:\Windows\system32\Eddhipdd.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\SysWOW64\Eknpfj32.exeC:\Windows\system32\Eknpfj32.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Windows\SysWOW64\Eecdcckf.exeC:\Windows\system32\Eecdcckf.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\Ekpmljin.exeC:\Windows\system32\Ekpmljin.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\Edhado32.exeC:\Windows\system32\Edhado32.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\Eoneah32.exeC:\Windows\system32\Eoneah32.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\Eehnnb32.exeC:\Windows\system32\Eehnnb32.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\Ekefgi32.exeC:\Windows\system32\Ekefgi32.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\Eaonccme.exeC:\Windows\system32\Eaonccme.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\Fkgbli32.exeC:\Windows\system32\Fkgbli32.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\Femgia32.exeC:\Windows\system32\Femgia32.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\Fkiobhac.exeC:\Windows\system32\Fkiobhac.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4280 -
C:\Windows\SysWOW64\Feocoaai.exeC:\Windows\system32\Feocoaai.exe66⤵
- Drops file in System32 directory
PID:2072 -
C:\Windows\SysWOW64\Foghhg32.exeC:\Windows\system32\Foghhg32.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4512 -
C:\Windows\SysWOW64\Fddqpn32.exeC:\Windows\system32\Fddqpn32.exe68⤵PID:4392
-
C:\Windows\SysWOW64\Fojenfeg.exeC:\Windows\system32\Fojenfeg.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5392 -
C:\Windows\SysWOW64\Fhbifl32.exeC:\Windows\system32\Fhbifl32.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3904 -
C:\Windows\SysWOW64\Fajnoabh.exeC:\Windows\system32\Fajnoabh.exe71⤵PID:1320
-
C:\Windows\SysWOW64\Fggfghap.exeC:\Windows\system32\Fggfghap.exe72⤵
- Drops file in System32 directory
PID:5536 -
C:\Windows\SysWOW64\Hdgfmk32.exeC:\Windows\system32\Hdgfmk32.exe73⤵PID:2600
-
C:\Windows\SysWOW64\Hffbfn32.exeC:\Windows\system32\Hffbfn32.exe74⤵
- Modifies registry class
PID:3712 -
C:\Windows\SysWOW64\Hdlphjaf.exeC:\Windows\system32\Hdlphjaf.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2176 -
C:\Windows\SysWOW64\Hbppaopp.exeC:\Windows\system32\Hbppaopp.exe76⤵PID:2768
-
C:\Windows\SysWOW64\Hbbmgn32.exeC:\Windows\system32\Hbbmgn32.exe77⤵PID:5008
-
C:\Windows\SysWOW64\Ihlechfj.exeC:\Windows\system32\Ihlechfj.exe78⤵PID:988
-
C:\Windows\SysWOW64\Iofmpb32.exeC:\Windows\system32\Iofmpb32.exe79⤵PID:2956
-
C:\Windows\SysWOW64\Idbfhiko.exeC:\Windows\system32\Idbfhiko.exe80⤵PID:3036
-
C:\Windows\SysWOW64\Ifbbbl32.exeC:\Windows\system32\Ifbbbl32.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4248 -
C:\Windows\SysWOW64\Ifdohl32.exeC:\Windows\system32\Ifdohl32.exe82⤵PID:5644
-
C:\Windows\SysWOW64\Ifglmlol.exeC:\Windows\system32\Ifglmlol.exe83⤵PID:368
-
C:\Windows\SysWOW64\Ioopfa32.exeC:\Windows\system32\Ioopfa32.exe84⤵PID:1828
-
C:\Windows\SysWOW64\Jenedhaa.exeC:\Windows\system32\Jenedhaa.exe85⤵PID:5440
-
C:\Windows\SysWOW64\Jkhnab32.exeC:\Windows\system32\Jkhnab32.exe86⤵PID:2488
-
C:\Windows\SysWOW64\Jbdbcl32.exeC:\Windows\system32\Jbdbcl32.exe87⤵PID:3024
-
C:\Windows\SysWOW64\Jiokpfee.exeC:\Windows\system32\Jiokpfee.exe88⤵PID:5124
-
C:\Windows\SysWOW64\Jphcmp32.exeC:\Windows\system32\Jphcmp32.exe89⤵
- System Location Discovery: System Language Discovery
PID:5660 -
C:\Windows\SysWOW64\Jnnpnl32.exeC:\Windows\system32\Jnnpnl32.exe90⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1728 -
C:\Windows\SysWOW64\Kehhjfif.exeC:\Windows\system32\Kehhjfif.exe91⤵PID:4396
-
C:\Windows\SysWOW64\Knpmcl32.exeC:\Windows\system32\Knpmcl32.exe92⤵PID:4956
-
C:\Windows\SysWOW64\Kldmmp32.exeC:\Windows\system32\Kldmmp32.exe93⤵
- Drops file in System32 directory
PID:1380 -
C:\Windows\SysWOW64\Kbneij32.exeC:\Windows\system32\Kbneij32.exe94⤵PID:764
-
C:\Windows\SysWOW64\Klfjbpmn.exeC:\Windows\system32\Klfjbpmn.exe95⤵PID:4420
-
C:\Windows\SysWOW64\Kijjldkh.exeC:\Windows\system32\Kijjldkh.exe96⤵PID:4820
-
C:\Windows\SysWOW64\Kngcdkjo.exeC:\Windows\system32\Kngcdkjo.exe97⤵PID:5744
-
C:\Windows\SysWOW64\Kimgad32.exeC:\Windows\system32\Kimgad32.exe98⤵
- Drops file in System32 directory
PID:4296 -
C:\Windows\SysWOW64\Knipik32.exeC:\Windows\system32\Knipik32.exe99⤵PID:5736
-
C:\Windows\SysWOW64\Lhbdbpnm.exeC:\Windows\system32\Lhbdbpnm.exe100⤵PID:5432
-
C:\Windows\SysWOW64\Lfcdph32.exeC:\Windows\system32\Lfcdph32.exe101⤵PID:5668
-
C:\Windows\SysWOW64\Lpkiim32.exeC:\Windows\system32\Lpkiim32.exe102⤵PID:3272
-
C:\Windows\SysWOW64\Lfeaegdi.exeC:\Windows\system32\Lfeaegdi.exe103⤵PID:5012
-
C:\Windows\SysWOW64\Lhfmmp32.exeC:\Windows\system32\Lhfmmp32.exe104⤵PID:4548
-
C:\Windows\SysWOW64\Lblakh32.exeC:\Windows\system32\Lblakh32.exe105⤵PID:3372
-
C:\Windows\SysWOW64\Lhijcohe.exeC:\Windows\system32\Lhijcohe.exe106⤵PID:2952
-
C:\Windows\SysWOW64\Lbnnphhk.exeC:\Windows\system32\Lbnnphhk.exe107⤵PID:2460
-
C:\Windows\SysWOW64\Lhkghofb.exeC:\Windows\system32\Lhkghofb.exe108⤵PID:3564
-
C:\Windows\SysWOW64\Loeoei32.exeC:\Windows\system32\Loeoei32.exe109⤵PID:3356
-
C:\Windows\SysWOW64\Mikcbb32.exeC:\Windows\system32\Mikcbb32.exe110⤵
- Modifies registry class
PID:4904 -
C:\Windows\SysWOW64\Moglkikl.exeC:\Windows\system32\Moglkikl.exe111⤵PID:3588
-
C:\Windows\SysWOW64\Mimphakb.exeC:\Windows\system32\Mimphakb.exe112⤵PID:4604
-
C:\Windows\SysWOW64\Mfaqafjl.exeC:\Windows\system32\Mfaqafjl.exe113⤵PID:3016
-
C:\Windows\SysWOW64\Mlnijmhc.exeC:\Windows\system32\Mlnijmhc.exe114⤵PID:5664
-
C:\Windows\SysWOW64\Miaica32.exeC:\Windows\system32\Miaica32.exe115⤵PID:972
-
C:\Windows\SysWOW64\Mbjnlfnn.exeC:\Windows\system32\Mbjnlfnn.exe116⤵PID:728
-
C:\Windows\SysWOW64\Mlbbel32.exeC:\Windows\system32\Mlbbel32.exe117⤵PID:3040
-
C:\Windows\SysWOW64\Nekgna32.exeC:\Windows\system32\Nekgna32.exe118⤵
- Modifies registry class
PID:2912 -
C:\Windows\SysWOW64\Nockfgao.exeC:\Windows\system32\Nockfgao.exe119⤵PID:2224
-
C:\Windows\SysWOW64\Nemcca32.exeC:\Windows\system32\Nemcca32.exe120⤵PID:5544
-
C:\Windows\SysWOW64\Nlglpkpi.exeC:\Windows\system32\Nlglpkpi.exe121⤵PID:2924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-