Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/03/2024, 20:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe
Resource
win7-20240221-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe
Resource
win10v2004-20240226-en
6 signatures
150 seconds
General
-
Target
6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe
-
Size
860KB
-
MD5
12cbf83abf772ae80fc1f06122cdc8dd
-
SHA1
dd109671efd7f9f4cf0aa3f2ac51f0ad757925fc
-
SHA256
6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4
-
SHA512
8046101e1189eba72366b7a045fe62a297f931753b034bf838abcf83f42c2b0f96ee8a224b55dae3fdde9413420aa1d335cbade1af2d68f3c5d3c35f2a85dc77
-
SSDEEP
24576:ls5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:lzbazR0vD
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fjongcbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iapebchh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmbiipml.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhneehek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jnkpbcjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jofbag32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgcdki32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdgdempa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjongcbl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilncom32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ieidmbcc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iapebchh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jofbag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jdgdempa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hoopae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ieidmbcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jocflgga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jgcdki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jmbiipml.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fhneehek.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmpgio32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hoopae32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Flehkhai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gmpgio32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jocflgga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Flehkhai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ilncom32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnkpbcjg.exe -
Executes dropped EXE 15 IoCs
pid Process 2220 Flehkhai.exe 2544 Fhneehek.exe 2556 Fjongcbl.exe 2756 Gmpgio32.exe 2392 Hoopae32.exe 2448 Ilncom32.exe 1952 Ieidmbcc.exe 2648 Iapebchh.exe 1444 Jocflgga.exe 2932 Jofbag32.exe 1988 Jnkpbcjg.exe 796 Jgcdki32.exe 1592 Jdgdempa.exe 1692 Jmbiipml.exe 1840 Kqqboncb.exe -
Loads dropped DLL 30 IoCs
pid Process 1984 6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe 1984 6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe 2220 Flehkhai.exe 2220 Flehkhai.exe 2544 Fhneehek.exe 2544 Fhneehek.exe 2556 Fjongcbl.exe 2556 Fjongcbl.exe 2756 Gmpgio32.exe 2756 Gmpgio32.exe 2392 Hoopae32.exe 2392 Hoopae32.exe 2448 Ilncom32.exe 2448 Ilncom32.exe 1952 Ieidmbcc.exe 1952 Ieidmbcc.exe 2648 Iapebchh.exe 2648 Iapebchh.exe 1444 Jocflgga.exe 1444 Jocflgga.exe 2932 Jofbag32.exe 2932 Jofbag32.exe 1988 Jnkpbcjg.exe 1988 Jnkpbcjg.exe 796 Jgcdki32.exe 796 Jgcdki32.exe 1592 Jdgdempa.exe 1592 Jdgdempa.exe 1692 Jmbiipml.exe 1692 Jmbiipml.exe -
Drops file in System32 directory 45 IoCs
description ioc Process File created C:\Windows\SysWOW64\Algdlcdm.dll Fjongcbl.exe File opened for modification C:\Windows\SysWOW64\Hoopae32.exe Gmpgio32.exe File opened for modification C:\Windows\SysWOW64\Jofbag32.exe Jocflgga.exe File created C:\Windows\SysWOW64\Jnkpbcjg.exe Jofbag32.exe File created C:\Windows\SysWOW64\Nelkpj32.dll Jnkpbcjg.exe File created C:\Windows\SysWOW64\Flehkhai.exe 6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe File opened for modification C:\Windows\SysWOW64\Flehkhai.exe 6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe File opened for modification C:\Windows\SysWOW64\Jgcdki32.exe Jnkpbcjg.exe File created C:\Windows\SysWOW64\Jdgdempa.exe Jgcdki32.exe File opened for modification C:\Windows\SysWOW64\Fjongcbl.exe Fhneehek.exe File opened for modification C:\Windows\SysWOW64\Ilncom32.exe Hoopae32.exe File created C:\Windows\SysWOW64\Ieidmbcc.exe Ilncom32.exe File created C:\Windows\SysWOW64\Indgjihl.dll Jgcdki32.exe File created C:\Windows\SysWOW64\Jmbiipml.exe Jdgdempa.exe File created C:\Windows\SysWOW64\Kqqboncb.exe Jmbiipml.exe File opened for modification C:\Windows\SysWOW64\Fhneehek.exe Flehkhai.exe File created C:\Windows\SysWOW64\Fjongcbl.exe Fhneehek.exe File created C:\Windows\SysWOW64\Ilncom32.exe Hoopae32.exe File created C:\Windows\SysWOW64\Aedeic32.dll Ieidmbcc.exe File created C:\Windows\SysWOW64\Fhneehek.exe Flehkhai.exe File opened for modification C:\Windows\SysWOW64\Gmpgio32.exe Fjongcbl.exe File opened for modification C:\Windows\SysWOW64\Ieidmbcc.exe Ilncom32.exe File created C:\Windows\SysWOW64\Iapebchh.exe Ieidmbcc.exe File created C:\Windows\SysWOW64\Ccfcekqe.dll Jofbag32.exe File created C:\Windows\SysWOW64\Qocjhb32.dll Jmbiipml.exe File created C:\Windows\SysWOW64\Gmpgio32.exe Fjongcbl.exe File created C:\Windows\SysWOW64\Hoopae32.exe Gmpgio32.exe File created C:\Windows\SysWOW64\Daiohhgh.dll Ilncom32.exe File opened for modification C:\Windows\SysWOW64\Jnkpbcjg.exe Jofbag32.exe File opened for modification C:\Windows\SysWOW64\Jdgdempa.exe Jgcdki32.exe File opened for modification C:\Windows\SysWOW64\Jmbiipml.exe Jdgdempa.exe File created C:\Windows\SysWOW64\Jgcdki32.exe Jnkpbcjg.exe File opened for modification C:\Windows\SysWOW64\Iapebchh.exe Ieidmbcc.exe File created C:\Windows\SysWOW64\Jocflgga.exe Iapebchh.exe File opened for modification C:\Windows\SysWOW64\Jocflgga.exe Iapebchh.exe File created C:\Windows\SysWOW64\Cogbjdmj.dll Iapebchh.exe File created C:\Windows\SysWOW64\Jofbag32.exe Jocflgga.exe File created C:\Windows\SysWOW64\Bdlhejlj.dll Jocflgga.exe File opened for modification C:\Windows\SysWOW64\Kqqboncb.exe Jmbiipml.exe File created C:\Windows\SysWOW64\Ibijie32.dll 6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe File created C:\Windows\SysWOW64\Qmbbdq32.dll Flehkhai.exe File created C:\Windows\SysWOW64\Qkekligg.dll Fhneehek.exe File created C:\Windows\SysWOW64\Agkfljge.dll Gmpgio32.exe File created C:\Windows\SysWOW64\Ecjlgm32.dll Hoopae32.exe File created C:\Windows\SysWOW64\Bedolome.dll Jdgdempa.exe -
Modifies registry class 48 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iapebchh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jmbiipml.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ilncom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Daiohhgh.dll" Ilncom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ieidmbcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fhneehek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fjongcbl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ieidmbcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jofbag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aedeic32.dll" Ieidmbcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jocflgga.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jmbiipml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qkekligg.dll" Fhneehek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gmpgio32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hoopae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hoopae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ilncom32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jofbag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccfcekqe.dll" Jofbag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Indgjihl.dll" Jgcdki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibijie32.dll" 6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Flehkhai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gmpgio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bedolome.dll" Jdgdempa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iapebchh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdlhejlj.dll" Jocflgga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jgcdki32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qmbbdq32.dll" Flehkhai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fjongcbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogbjdmj.dll" Iapebchh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jdgdempa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Flehkhai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fhneehek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Algdlcdm.dll" Fjongcbl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jocflgga.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jnkpbcjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nelkpj32.dll" Jnkpbcjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jdgdempa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qocjhb32.dll" Jmbiipml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agkfljge.dll" Gmpgio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecjlgm32.dll" Hoopae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jnkpbcjg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jgcdki32.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2220 1984 6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe 28 PID 1984 wrote to memory of 2220 1984 6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe 28 PID 1984 wrote to memory of 2220 1984 6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe 28 PID 1984 wrote to memory of 2220 1984 6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe 28 PID 2220 wrote to memory of 2544 2220 Flehkhai.exe 29 PID 2220 wrote to memory of 2544 2220 Flehkhai.exe 29 PID 2220 wrote to memory of 2544 2220 Flehkhai.exe 29 PID 2220 wrote to memory of 2544 2220 Flehkhai.exe 29 PID 2544 wrote to memory of 2556 2544 Fhneehek.exe 30 PID 2544 wrote to memory of 2556 2544 Fhneehek.exe 30 PID 2544 wrote to memory of 2556 2544 Fhneehek.exe 30 PID 2544 wrote to memory of 2556 2544 Fhneehek.exe 30 PID 2556 wrote to memory of 2756 2556 Fjongcbl.exe 31 PID 2556 wrote to memory of 2756 2556 Fjongcbl.exe 31 PID 2556 wrote to memory of 2756 2556 Fjongcbl.exe 31 PID 2556 wrote to memory of 2756 2556 Fjongcbl.exe 31 PID 2756 wrote to memory of 2392 2756 Gmpgio32.exe 32 PID 2756 wrote to memory of 2392 2756 Gmpgio32.exe 32 PID 2756 wrote to memory of 2392 2756 Gmpgio32.exe 32 PID 2756 wrote to memory of 2392 2756 Gmpgio32.exe 32 PID 2392 wrote to memory of 2448 2392 Hoopae32.exe 33 PID 2392 wrote to memory of 2448 2392 Hoopae32.exe 33 PID 2392 wrote to memory of 2448 2392 Hoopae32.exe 33 PID 2392 wrote to memory of 2448 2392 Hoopae32.exe 33 PID 2448 wrote to memory of 1952 2448 Ilncom32.exe 34 PID 2448 wrote to memory of 1952 2448 Ilncom32.exe 34 PID 2448 wrote to memory of 1952 2448 Ilncom32.exe 34 PID 2448 wrote to memory of 1952 2448 Ilncom32.exe 34 PID 1952 wrote to memory of 2648 1952 Ieidmbcc.exe 35 PID 1952 wrote to memory of 2648 1952 Ieidmbcc.exe 35 PID 1952 wrote to memory of 2648 1952 Ieidmbcc.exe 35 PID 1952 wrote to memory of 2648 1952 Ieidmbcc.exe 35 PID 2648 wrote to memory of 1444 2648 Iapebchh.exe 36 PID 2648 wrote to memory of 1444 2648 Iapebchh.exe 36 PID 2648 wrote to memory of 1444 2648 Iapebchh.exe 36 PID 2648 wrote to memory of 1444 2648 Iapebchh.exe 36 PID 1444 wrote to memory of 2932 1444 Jocflgga.exe 37 PID 1444 wrote to memory of 2932 1444 Jocflgga.exe 37 PID 1444 wrote to memory of 2932 1444 Jocflgga.exe 37 PID 1444 wrote to memory of 2932 1444 Jocflgga.exe 37 PID 2932 wrote to memory of 1988 2932 Jofbag32.exe 38 PID 2932 wrote to memory of 1988 2932 Jofbag32.exe 38 PID 2932 wrote to memory of 1988 2932 Jofbag32.exe 38 PID 2932 wrote to memory of 1988 2932 Jofbag32.exe 38 PID 1988 wrote to memory of 796 1988 Jnkpbcjg.exe 39 PID 1988 wrote to memory of 796 1988 Jnkpbcjg.exe 39 PID 1988 wrote to memory of 796 1988 Jnkpbcjg.exe 39 PID 1988 wrote to memory of 796 1988 Jnkpbcjg.exe 39 PID 796 wrote to memory of 1592 796 Jgcdki32.exe 40 PID 796 wrote to memory of 1592 796 Jgcdki32.exe 40 PID 796 wrote to memory of 1592 796 Jgcdki32.exe 40 PID 796 wrote to memory of 1592 796 Jgcdki32.exe 40 PID 1592 wrote to memory of 1692 1592 Jdgdempa.exe 41 PID 1592 wrote to memory of 1692 1592 Jdgdempa.exe 41 PID 1592 wrote to memory of 1692 1592 Jdgdempa.exe 41 PID 1592 wrote to memory of 1692 1592 Jdgdempa.exe 41 PID 1692 wrote to memory of 1840 1692 Jmbiipml.exe 42 PID 1692 wrote to memory of 1840 1692 Jmbiipml.exe 42 PID 1692 wrote to memory of 1840 1692 Jmbiipml.exe 42 PID 1692 wrote to memory of 1840 1692 Jmbiipml.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe"C:\Users\Admin\AppData\Local\Temp\6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\Flehkhai.exeC:\Windows\system32\Flehkhai.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\Fhneehek.exeC:\Windows\system32\Fhneehek.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\Fjongcbl.exeC:\Windows\system32\Fjongcbl.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\Gmpgio32.exeC:\Windows\system32\Gmpgio32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\Hoopae32.exeC:\Windows\system32\Hoopae32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\Ilncom32.exeC:\Windows\system32\Ilncom32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\Ieidmbcc.exeC:\Windows\system32\Ieidmbcc.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\Iapebchh.exeC:\Windows\system32\Iapebchh.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\Jocflgga.exeC:\Windows\system32\Jocflgga.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\Jofbag32.exeC:\Windows\system32\Jofbag32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\Jnkpbcjg.exeC:\Windows\system32\Jnkpbcjg.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\Jgcdki32.exeC:\Windows\system32\Jgcdki32.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\Jdgdempa.exeC:\Windows\system32\Jdgdempa.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\Jmbiipml.exeC:\Windows\system32\Jmbiipml.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\Kqqboncb.exeC:\Windows\system32\Kqqboncb.exe16⤵
- Executes dropped EXE
PID:1840 -
C:\Windows\SysWOW64\Kfmjgeaj.exeC:\Windows\system32\Kfmjgeaj.exe17⤵PID:2076
-
C:\Windows\SysWOW64\Kbdklf32.exeC:\Windows\system32\Kbdklf32.exe18⤵PID:2904
-
C:\Windows\SysWOW64\Kmjojo32.exeC:\Windows\system32\Kmjojo32.exe19⤵PID:2084
-
C:\Windows\SysWOW64\Kbfhbeek.exeC:\Windows\system32\Kbfhbeek.exe20⤵PID:2284
-
C:\Windows\SysWOW64\Kiqpop32.exeC:\Windows\system32\Kiqpop32.exe21⤵PID:3024
-
C:\Windows\SysWOW64\Knmhgf32.exeC:\Windows\system32\Knmhgf32.exe22⤵PID:2188
-
C:\Windows\SysWOW64\Kgemplap.exeC:\Windows\system32\Kgemplap.exe23⤵PID:1532
-
C:\Windows\SysWOW64\Kbkameaf.exeC:\Windows\system32\Kbkameaf.exe24⤵PID:2056
-
C:\Windows\SysWOW64\Lghjel32.exeC:\Windows\system32\Lghjel32.exe25⤵PID:2812
-
C:\Windows\SysWOW64\Ljffag32.exeC:\Windows\system32\Ljffag32.exe26⤵PID:2776
-
C:\Windows\SysWOW64\Lgjfkk32.exeC:\Windows\system32\Lgjfkk32.exe27⤵PID:2144
-
C:\Windows\SysWOW64\Lpekon32.exeC:\Windows\system32\Lpekon32.exe28⤵PID:2808
-
C:\Windows\SysWOW64\Laegiq32.exeC:\Windows\system32\Laegiq32.exe29⤵PID:552
-
C:\Windows\SysWOW64\Llohjo32.exeC:\Windows\system32\Llohjo32.exe30⤵PID:2116
-
C:\Windows\SysWOW64\Lbiqfied.exeC:\Windows\system32\Lbiqfied.exe31⤵PID:2312
-
C:\Windows\SysWOW64\Libicbma.exeC:\Windows\system32\Libicbma.exe32⤵PID:2112
-
C:\Windows\SysWOW64\Mbkmlh32.exeC:\Windows\system32\Mbkmlh32.exe33⤵PID:2024
-
C:\Windows\SysWOW64\Mponel32.exeC:\Windows\system32\Mponel32.exe34⤵PID:2896
-
C:\Windows\SysWOW64\Migbnb32.exeC:\Windows\system32\Migbnb32.exe35⤵PID:3068
-
C:\Windows\SysWOW64\Nplmop32.exeC:\Windows\system32\Nplmop32.exe36⤵PID:2548
-
C:\Windows\SysWOW64\Nmpnhdfc.exeC:\Windows\system32\Nmpnhdfc.exe37⤵PID:2664
-
C:\Windows\SysWOW64\Ncpcfkbg.exeC:\Windows\system32\Ncpcfkbg.exe38⤵PID:2432
-
C:\Windows\SysWOW64\Nhohda32.exeC:\Windows\system32\Nhohda32.exe39⤵PID:2424
-
C:\Windows\SysWOW64\Odeiibdq.exeC:\Windows\system32\Odeiibdq.exe40⤵PID:848
-
C:\Windows\SysWOW64\Oaiibg32.exeC:\Windows\system32\Oaiibg32.exe41⤵PID:268
-
C:\Windows\SysWOW64\Ohcaoajg.exeC:\Windows\system32\Ohcaoajg.exe42⤵PID:684
-
C:\Windows\SysWOW64\Oomjlk32.exeC:\Windows\system32\Oomjlk32.exe43⤵PID:1552
-
C:\Windows\SysWOW64\Ohendqhd.exeC:\Windows\system32\Ohendqhd.exe44⤵PID:1912
-
C:\Windows\SysWOW64\Onbgmg32.exeC:\Windows\system32\Onbgmg32.exe45⤵PID:2336
-
C:\Windows\SysWOW64\Onecbg32.exeC:\Windows\system32\Onecbg32.exe46⤵PID:2108
-
C:\Windows\SysWOW64\Ocalkn32.exeC:\Windows\system32\Ocalkn32.exe47⤵PID:1388
-
C:\Windows\SysWOW64\Pngphgbf.exeC:\Windows\system32\Pngphgbf.exe48⤵PID:2064
-
C:\Windows\SysWOW64\Pgpeal32.exeC:\Windows\system32\Pgpeal32.exe49⤵PID:544
-
C:\Windows\SysWOW64\Pmlmic32.exeC:\Windows\system32\Pmlmic32.exe50⤵PID:2940
-
C:\Windows\SysWOW64\Pdlkiepd.exeC:\Windows\system32\Pdlkiepd.exe51⤵PID:3040
-
C:\Windows\SysWOW64\Poapfn32.exeC:\Windows\system32\Poapfn32.exe52⤵PID:1920
-
C:\Windows\SysWOW64\Qflhbhgg.exeC:\Windows\system32\Qflhbhgg.exe53⤵PID:664
-
C:\Windows\SysWOW64\Qgmdjp32.exeC:\Windows\system32\Qgmdjp32.exe54⤵PID:756
-
C:\Windows\SysWOW64\Qbbhgi32.exeC:\Windows\system32\Qbbhgi32.exe55⤵PID:896
-
C:\Windows\SysWOW64\Qiladcdh.exeC:\Windows\system32\Qiladcdh.exe56⤵PID:2748
-
C:\Windows\SysWOW64\Aniimjbo.exeC:\Windows\system32\Aniimjbo.exe57⤵PID:972
-
C:\Windows\SysWOW64\Aecaidjl.exeC:\Windows\system32\Aecaidjl.exe58⤵PID:1744
-
C:\Windows\SysWOW64\Ajpjakhc.exeC:\Windows\system32\Ajpjakhc.exe59⤵PID:2368
-
C:\Windows\SysWOW64\Aeenochi.exeC:\Windows\system32\Aeenochi.exe60⤵PID:2148
-
C:\Windows\SysWOW64\Ajbggjfq.exeC:\Windows\system32\Ajbggjfq.exe61⤵PID:2580
-
C:\Windows\SysWOW64\Ackkppma.exeC:\Windows\system32\Ackkppma.exe62⤵PID:2524
-
C:\Windows\SysWOW64\Aigchgkh.exeC:\Windows\system32\Aigchgkh.exe63⤵PID:2644
-
C:\Windows\SysWOW64\Abphal32.exeC:\Windows\system32\Abphal32.exe64⤵PID:2536
-
C:\Windows\SysWOW64\Aijpnfif.exeC:\Windows\system32\Aijpnfif.exe65⤵PID:2456
-
C:\Windows\SysWOW64\Acpdko32.exeC:\Windows\system32\Acpdko32.exe66⤵PID:1620
-
C:\Windows\SysWOW64\Bmhideol.exeC:\Windows\system32\Bmhideol.exe67⤵PID:2676
-
C:\Windows\SysWOW64\Bfpnmj32.exeC:\Windows\system32\Bfpnmj32.exe68⤵PID:1964
-
C:\Windows\SysWOW64\Blmfea32.exeC:\Windows\system32\Blmfea32.exe69⤵PID:2816
-
C:\Windows\SysWOW64\Bajomhbl.exeC:\Windows\system32\Bajomhbl.exe70⤵PID:2840
-
C:\Windows\SysWOW64\Blobjaba.exeC:\Windows\system32\Blobjaba.exe71⤵PID:1188
-
C:\Windows\SysWOW64\Balkchpi.exeC:\Windows\system32\Balkchpi.exe72⤵PID:3060
-
C:\Windows\SysWOW64\Bjdplm32.exeC:\Windows\system32\Bjdplm32.exe73⤵PID:2012
-
C:\Windows\SysWOW64\Bejdiffp.exeC:\Windows\system32\Bejdiffp.exe74⤵PID:1968
-
C:\Windows\SysWOW64\Bkglameg.exeC:\Windows\system32\Bkglameg.exe75⤵PID:784
-
C:\Windows\SysWOW64\Cdoajb32.exeC:\Windows\system32\Cdoajb32.exe76⤵PID:1788
-
C:\Windows\SysWOW64\Cpfaocal.exeC:\Windows\system32\Cpfaocal.exe77⤵PID:1616
-
C:\Windows\SysWOW64\Cmjbhh32.exeC:\Windows\system32\Cmjbhh32.exe78⤵PID:1640
-
C:\Windows\SysWOW64\Cgbfamff.exeC:\Windows\system32\Cgbfamff.exe79⤵PID:2484
-
C:\Windows\SysWOW64\Conkepdq.exeC:\Windows\system32\Conkepdq.exe80⤵PID:1704
-
C:\Windows\SysWOW64\Cophko32.exeC:\Windows\system32\Cophko32.exe81⤵PID:1348
-
C:\Windows\SysWOW64\Dkgippgb.exeC:\Windows\system32\Dkgippgb.exe82⤵PID:2868
-
C:\Windows\SysWOW64\Ddomif32.exeC:\Windows\system32\Ddomif32.exe83⤵PID:2552
-
C:\Windows\SysWOW64\Dngabk32.exeC:\Windows\system32\Dngabk32.exe84⤵PID:2672
-
C:\Windows\SysWOW64\Dnjngk32.exeC:\Windows\system32\Dnjngk32.exe85⤵PID:2588
-
C:\Windows\SysWOW64\Djqoll32.exeC:\Windows\system32\Djqoll32.exe86⤵PID:2132
-
C:\Windows\SysWOW64\Ddfcje32.exeC:\Windows\system32\Ddfcje32.exe87⤵PID:2232
-
C:\Windows\SysWOW64\Dlahng32.exeC:\Windows\system32\Dlahng32.exe88⤵PID:2520
-
C:\Windows\SysWOW64\Elcdcgcc.exeC:\Windows\system32\Elcdcgcc.exe89⤵PID:564
-
C:\Windows\SysWOW64\Eqamje32.exeC:\Windows\system32\Eqamje32.exe90⤵PID:1800
-
C:\Windows\SysWOW64\Ehmbng32.exeC:\Windows\system32\Ehmbng32.exe91⤵PID:1732
-
C:\Windows\SysWOW64\Efqbglen.exeC:\Windows\system32\Efqbglen.exe92⤵PID:320
-
C:\Windows\SysWOW64\Edfpih32.exeC:\Windows\system32\Edfpih32.exe93⤵PID:1336
-
C:\Windows\SysWOW64\Fnndan32.exeC:\Windows\system32\Fnndan32.exe94⤵PID:3028
-
C:\Windows\SysWOW64\Fidhof32.exeC:\Windows\system32\Fidhof32.exe95⤵PID:692
-
C:\Windows\SysWOW64\Fnqqgm32.exeC:\Windows\system32\Fnqqgm32.exe96⤵PID:1656
-
C:\Windows\SysWOW64\Fcmiod32.exeC:\Windows\system32\Fcmiod32.exe97⤵PID:436
-
C:\Windows\SysWOW64\Fncmmmma.exeC:\Windows\system32\Fncmmmma.exe98⤵PID:1364
-
C:\Windows\SysWOW64\Fcpfedki.exeC:\Windows\system32\Fcpfedki.exe99⤵PID:1328
-
C:\Windows\SysWOW64\Fnejbmko.exeC:\Windows\system32\Fnejbmko.exe100⤵PID:1884
-
C:\Windows\SysWOW64\Fcbbjcif.exeC:\Windows\system32\Fcbbjcif.exe101⤵PID:560
-
C:\Windows\SysWOW64\Fafcdh32.exeC:\Windows\system32\Fafcdh32.exe102⤵PID:1508
-
C:\Windows\SysWOW64\Gbnflo32.exeC:\Windows\system32\Gbnflo32.exe103⤵PID:2784
-
C:\Windows\SysWOW64\Ghkndf32.exeC:\Windows\system32\Ghkndf32.exe104⤵PID:2572
-
C:\Windows\SysWOW64\Gacbmk32.exeC:\Windows\system32\Gacbmk32.exe105⤵PID:1144
-
C:\Windows\SysWOW64\Gjlgfaco.exeC:\Windows\system32\Gjlgfaco.exe106⤵PID:1956
-
C:\Windows\SysWOW64\Hafock32.exeC:\Windows\system32\Hafock32.exe107⤵PID:1588
-
C:\Windows\SysWOW64\Hfbhkb32.exeC:\Windows\system32\Hfbhkb32.exe108⤵PID:2584
-
C:\Windows\SysWOW64\Hahlhkhi.exeC:\Windows\system32\Hahlhkhi.exe109⤵PID:1084
-
C:\Windows\SysWOW64\Hhbdee32.exeC:\Windows\system32\Hhbdee32.exe110⤵PID:2988
-
C:\Windows\SysWOW64\Hdiejfej.exeC:\Windows\system32\Hdiejfej.exe111⤵PID:1460
-
C:\Windows\SysWOW64\Hfjnla32.exeC:\Windows\system32\Hfjnla32.exe112⤵PID:2216
-
C:\Windows\SysWOW64\Heokmmgb.exeC:\Windows\system32\Heokmmgb.exe113⤵PID:2884
-
C:\Windows\SysWOW64\Ipdojfgh.exeC:\Windows\system32\Ipdojfgh.exe114⤵PID:1512
-
C:\Windows\SysWOW64\Iaelanmg.exeC:\Windows\system32\Iaelanmg.exe115⤵PID:2004
-
C:\Windows\SysWOW64\Ihpdoh32.exeC:\Windows\system32\Ihpdoh32.exe116⤵PID:1100
-
C:\Windows\SysWOW64\Iecdhm32.exeC:\Windows\system32\Iecdhm32.exe117⤵PID:2832
-
C:\Windows\SysWOW64\Ilnmdgkj.exeC:\Windows\system32\Ilnmdgkj.exe118⤵PID:2472
-
C:\Windows\SysWOW64\Imoilo32.exeC:\Windows\system32\Imoilo32.exe119⤵PID:2716
-
C:\Windows\SysWOW64\Idiaii32.exeC:\Windows\system32\Idiaii32.exe120⤵PID:2468
-
C:\Windows\SysWOW64\Ionefb32.exeC:\Windows\system32\Ionefb32.exe121⤵PID:2228
-
C:\Windows\SysWOW64\Igijkd32.exeC:\Windows\system32\Igijkd32.exe122⤵PID:1496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-