Analysis
-
max time kernel
155s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
28-07-2024 01:24
Static task
static1
Behavioral task
behavioral1
Sample
04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
04cbf4458f648a2f7e5c23bfb9b57959
-
SHA1
9986a505f13ae253add91ae03b2392c77e32c2c6
-
SHA256
022b6653870e93836aec6d60a5aea24de1bc223bd583be4511cf2f12eb13a34f
-
SHA512
e87814fbedd9ea5962cc924768fe1badea030750168092748898644c9f1a2b342235c100a6593cac90d9b4bbea4f49e3226d0dfc0af8a75d65172f87913ab2c6
-
SSDEEP
12288:wqfw6Ew3ioqbw38/JJw3ID7daw3pP9/efSDw3/a2fvxw3ioqbw38/JJw3ID7dawF:wq46O2qJOMO2qUl5O2qJOMO2qU
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ggmjkapi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nhngem32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgjhkpbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cgjhkpbj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ggmjkapi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhngem32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkdlaplh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fkdlaplh.exe -
Executes dropped EXE 4 IoCs
pid Process 3000 Nhngem32.exe 3008 Cgjhkpbj.exe 2816 Fkdlaplh.exe 2824 Ggmjkapi.exe -
Loads dropped DLL 8 IoCs
pid Process 2204 04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe 2204 04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe 3000 Nhngem32.exe 3000 Nhngem32.exe 3008 Cgjhkpbj.exe 3008 Cgjhkpbj.exe 2816 Fkdlaplh.exe 2816 Fkdlaplh.exe -
Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\Fkdlaplh.exe Cgjhkpbj.exe File opened for modification C:\Windows\SysWOW64\Fkdlaplh.exe Cgjhkpbj.exe File created C:\Windows\SysWOW64\Cndkcnjj.dll Fkdlaplh.exe File created C:\Windows\SysWOW64\Gfbfln32.exe Ggmjkapi.exe File created C:\Windows\SysWOW64\Fgkpdifc.dll Ggmjkapi.exe File created C:\Windows\SysWOW64\Cahlnl32.dll 04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe File created C:\Windows\SysWOW64\Cgjhkpbj.exe Nhngem32.exe File created C:\Windows\SysWOW64\Ggmjkapi.exe Fkdlaplh.exe File opened for modification C:\Windows\SysWOW64\Nhngem32.exe 04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe File created C:\Windows\SysWOW64\Bojcalcl.dll Nhngem32.exe File created C:\Windows\SysWOW64\Jffaoi32.dll Cgjhkpbj.exe File opened for modification C:\Windows\SysWOW64\Ggmjkapi.exe Fkdlaplh.exe File opened for modification C:\Windows\SysWOW64\Gfbfln32.exe Ggmjkapi.exe File created C:\Windows\SysWOW64\Nhngem32.exe 04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Cgjhkpbj.exe Nhngem32.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkdlaplh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggmjkapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhngem32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cgjhkpbj.exe -
Modifies registry class 18 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nhngem32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fkdlaplh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nhngem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cgjhkpbj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ggmjkapi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ggmjkapi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bojcalcl.dll" Nhngem32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cgjhkpbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jffaoi32.dll" Cgjhkpbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgkpdifc.dll" Ggmjkapi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cahlnl32.dll" 04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cndkcnjj.dll" Fkdlaplh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fkdlaplh.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2204 wrote to memory of 3000 2204 04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe 29 PID 2204 wrote to memory of 3000 2204 04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe 29 PID 2204 wrote to memory of 3000 2204 04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe 29 PID 2204 wrote to memory of 3000 2204 04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe 29 PID 3000 wrote to memory of 3008 3000 Nhngem32.exe 30 PID 3000 wrote to memory of 3008 3000 Nhngem32.exe 30 PID 3000 wrote to memory of 3008 3000 Nhngem32.exe 30 PID 3000 wrote to memory of 3008 3000 Nhngem32.exe 30 PID 3008 wrote to memory of 2816 3008 Cgjhkpbj.exe 31 PID 3008 wrote to memory of 2816 3008 Cgjhkpbj.exe 31 PID 3008 wrote to memory of 2816 3008 Cgjhkpbj.exe 31 PID 3008 wrote to memory of 2816 3008 Cgjhkpbj.exe 31 PID 2816 wrote to memory of 2824 2816 Fkdlaplh.exe 32 PID 2816 wrote to memory of 2824 2816 Fkdlaplh.exe 32 PID 2816 wrote to memory of 2824 2816 Fkdlaplh.exe 32 PID 2816 wrote to memory of 2824 2816 Fkdlaplh.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04cbf4458f648a2f7e5c23bfb9b57959_JaffaCakes118.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\Nhngem32.exeC:\Windows\system32\Nhngem32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\Cgjhkpbj.exeC:\Windows\system32\Cgjhkpbj.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\Fkdlaplh.exeC:\Windows\system32\Fkdlaplh.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\Ggmjkapi.exeC:\Windows\system32\Ggmjkapi.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2824 -
C:\Windows\SysWOW64\Gfbfln32.exeC:\Windows\system32\Gfbfln32.exe6⤵PID:1564
-
C:\Windows\SysWOW64\Gcfgfack.exeC:\Windows\system32\Gcfgfack.exe7⤵PID:972
-
C:\Windows\SysWOW64\Gielchpp.exeC:\Windows\system32\Gielchpp.exe8⤵PID:1948
-
C:\Windows\SysWOW64\Higiih32.exeC:\Windows\system32\Higiih32.exe9⤵PID:2040
-
C:\Windows\SysWOW64\Hngngo32.exeC:\Windows\system32\Hngngo32.exe10⤵PID:2904
-
C:\Windows\SysWOW64\Hfbckagm.exeC:\Windows\system32\Hfbckagm.exe11⤵PID:300
-
C:\Windows\SysWOW64\Hfdpaqej.exeC:\Windows\system32\Hfdpaqej.exe12⤵PID:792
-
C:\Windows\SysWOW64\Hfflfp32.exeC:\Windows\system32\Hfflfp32.exe13⤵PID:2200
-
C:\Windows\SysWOW64\Ibpjaagi.exeC:\Windows\system32\Ibpjaagi.exe14⤵PID:2132
-
C:\Windows\SysWOW64\Iaegbmlq.exeC:\Windows\system32\Iaegbmlq.exe15⤵PID:1468
-
C:\Windows\SysWOW64\Iljkofkg.exeC:\Windows\system32\Iljkofkg.exe16⤵PID:2596
-
C:\Windows\SysWOW64\Imndmnob.exeC:\Windows\system32\Imndmnob.exe17⤵PID:2032
-
C:\Windows\SysWOW64\Jpcfih32.exeC:\Windows\system32\Jpcfih32.exe18⤵PID:1792
-
C:\Windows\SysWOW64\Keehmobp.exeC:\Windows\system32\Keehmobp.exe19⤵PID:2172
-
C:\Windows\SysWOW64\Kaliaphd.exeC:\Windows\system32\Kaliaphd.exe20⤵PID:1932
-
C:\Windows\SysWOW64\Kneflplf.exeC:\Windows\system32\Kneflplf.exe21⤵PID:2364
-
C:\Windows\SysWOW64\Lgphke32.exeC:\Windows\system32\Lgphke32.exe22⤵PID:1668
-
C:\Windows\SysWOW64\Lfedlb32.exeC:\Windows\system32\Lfedlb32.exe23⤵PID:872
-
C:\Windows\SysWOW64\Lomidgkl.exeC:\Windows\system32\Lomidgkl.exe24⤵PID:1732
-
C:\Windows\SysWOW64\Dbqajk32.exeC:\Windows\system32\Dbqajk32.exe25⤵PID:1568
-
C:\Windows\SysWOW64\Jemkai32.exeC:\Windows\system32\Jemkai32.exe26⤵PID:2732
-
C:\Windows\SysWOW64\Lddagi32.exeC:\Windows\system32\Lddagi32.exe27⤵PID:2304
-
C:\Windows\SysWOW64\Njaoeq32.exeC:\Windows\system32\Njaoeq32.exe28⤵PID:1928
-
C:\Windows\SysWOW64\Npngng32.exeC:\Windows\system32\Npngng32.exe29⤵PID:824
-
C:\Windows\SysWOW64\Oiglfm32.exeC:\Windows\system32\Oiglfm32.exe30⤵PID:1296
-
C:\Windows\SysWOW64\Oenmkngi.exeC:\Windows\system32\Oenmkngi.exe31⤵PID:1592
-
C:\Windows\SysWOW64\Opcaiggo.exeC:\Windows\system32\Opcaiggo.exe32⤵PID:1332
-
C:\Windows\SysWOW64\Oinbglkm.exeC:\Windows\system32\Oinbglkm.exe33⤵PID:2836
-
C:\Windows\SysWOW64\Odgchjhl.exeC:\Windows\system32\Odgchjhl.exe34⤵PID:1656
-
C:\Windows\SysWOW64\Phelnhnb.exeC:\Windows\system32\Phelnhnb.exe35⤵PID:2680
-
C:\Windows\SysWOW64\Piiekp32.exeC:\Windows\system32\Piiekp32.exe36⤵PID:1060
-
C:\Windows\SysWOW64\Pljnmkoo.exeC:\Windows\system32\Pljnmkoo.exe37⤵PID:2908
-
C:\Windows\SysWOW64\Pmijgn32.exeC:\Windows\system32\Pmijgn32.exe38⤵PID:672
-
C:\Windows\SysWOW64\Pedokpcm.exeC:\Windows\system32\Pedokpcm.exe39⤵PID:1728
-
C:\Windows\SysWOW64\Qibhao32.exeC:\Windows\system32\Qibhao32.exe40⤵PID:1884
-
C:\Windows\SysWOW64\Qbkljd32.exeC:\Windows\system32\Qbkljd32.exe41⤵PID:2868
-
C:\Windows\SysWOW64\Adnegldo.exeC:\Windows\system32\Adnegldo.exe42⤵PID:2348
-
C:\Windows\SysWOW64\Aodjdede.exeC:\Windows\system32\Aodjdede.exe43⤵PID:2152
-
C:\Windows\SysWOW64\Adekhkng.exeC:\Windows\system32\Adekhkng.exe44⤵PID:2724
-
C:\Windows\SysWOW64\Apllml32.exeC:\Windows\system32\Apllml32.exe45⤵PID:472
-
C:\Windows\SysWOW64\Bhgaan32.exeC:\Windows\system32\Bhgaan32.exe46⤵PID:1848
-
C:\Windows\SysWOW64\Blejgm32.exeC:\Windows\system32\Blejgm32.exe47⤵PID:1404
-
C:\Windows\SysWOW64\Bkjfhile.exeC:\Windows\system32\Bkjfhile.exe48⤵PID:2052
-
C:\Windows\SysWOW64\Bfpkfb32.exeC:\Windows\system32\Bfpkfb32.exe49⤵PID:2848
-
C:\Windows\SysWOW64\Cgfqii32.exeC:\Windows\system32\Cgfqii32.exe50⤵PID:2828
-
C:\Windows\SysWOW64\Cmbiap32.exeC:\Windows\system32\Cmbiap32.exe51⤵PID:2728
-
C:\Windows\SysWOW64\Cghmni32.exeC:\Windows\system32\Cghmni32.exe52⤵PID:2776
-
C:\Windows\SysWOW64\Cqqbgoba.exeC:\Windows\system32\Cqqbgoba.exe53⤵PID:620
-
C:\Windows\SysWOW64\Cohlnkeg.exeC:\Windows\system32\Cohlnkeg.exe54⤵PID:2256
-
C:\Windows\SysWOW64\Dnpedghl.exeC:\Windows\system32\Dnpedghl.exe55⤵PID:2188
-
C:\Windows\SysWOW64\Ehopnk32.exeC:\Windows\system32\Ehopnk32.exe56⤵PID:1980
-
C:\Windows\SysWOW64\Edfqclni.exeC:\Windows\system32\Edfqclni.exe57⤵PID:2448
-
C:\Windows\SysWOW64\Elaego32.exeC:\Windows\system32\Elaego32.exe58⤵PID:1696
-
C:\Windows\SysWOW64\Eelfedpa.exeC:\Windows\system32\Eelfedpa.exe59⤵PID:2380
-
C:\Windows\SysWOW64\Feppqc32.exeC:\Windows\system32\Feppqc32.exe60⤵PID:524
-
C:\Windows\SysWOW64\Foidii32.exeC:\Windows\system32\Foidii32.exe61⤵PID:2932
-
C:\Windows\SysWOW64\Fhaibnim.exeC:\Windows\system32\Fhaibnim.exe62⤵PID:3064
-
C:\Windows\SysWOW64\Ejhhcdjm.exeC:\Windows\system32\Ejhhcdjm.exe63⤵PID:920
-
C:\Windows\SysWOW64\Ggcnbh32.exeC:\Windows\system32\Ggcnbh32.exe64⤵PID:2208
-
C:\Windows\SysWOW64\Gaibpa32.exeC:\Windows\system32\Gaibpa32.exe65⤵PID:2984
-
C:\Windows\SysWOW64\Gcjogidl.exeC:\Windows\system32\Gcjogidl.exe66⤵PID:1544
-
C:\Windows\SysWOW64\Hpplfm32.exeC:\Windows\system32\Hpplfm32.exe67⤵PID:2360
-
C:\Windows\SysWOW64\Hemeod32.exeC:\Windows\system32\Hemeod32.exe68⤵PID:2316
-
C:\Windows\SysWOW64\Hpbilmop.exeC:\Windows\system32\Hpbilmop.exe69⤵PID:1076
-
C:\Windows\SysWOW64\Hlijan32.exeC:\Windows\system32\Hlijan32.exe70⤵PID:2444
-
C:\Windows\SysWOW64\Hfanjcke.exeC:\Windows\system32\Hfanjcke.exe71⤵PID:2008
-
C:\Windows\SysWOW64\Hfdkoc32.exeC:\Windows\system32\Hfdkoc32.exe72⤵PID:876
-
C:\Windows\SysWOW64\Ikqcgj32.exeC:\Windows\system32\Ikqcgj32.exe73⤵PID:1636
-
C:\Windows\SysWOW64\Iqnlpq32.exeC:\Windows\system32\Iqnlpq32.exe74⤵PID:1472
-
C:\Windows\SysWOW64\Ijfpif32.exeC:\Windows\system32\Ijfpif32.exe75⤵PID:1476
-
C:\Windows\SysWOW64\Igjabj32.exeC:\Windows\system32\Igjabj32.exe76⤵PID:960
-
C:\Windows\SysWOW64\Ifoncgpc.exeC:\Windows\system32\Ifoncgpc.exe77⤵PID:1480
-
C:\Windows\SysWOW64\Iogbllfc.exeC:\Windows\system32\Iogbllfc.exe78⤵PID:1796
-
C:\Windows\SysWOW64\Imkbeqem.exeC:\Windows\system32\Imkbeqem.exe79⤵PID:2320
-
C:\Windows\SysWOW64\Jbhkngcd.exeC:\Windows\system32\Jbhkngcd.exe80⤵PID:2472
-
C:\Windows\SysWOW64\Jkqpfmje.exeC:\Windows\system32\Jkqpfmje.exe81⤵PID:2864
-
C:\Windows\SysWOW64\Jkcllmhb.exeC:\Windows\system32\Jkcllmhb.exe82⤵PID:1384
-
C:\Windows\SysWOW64\Jigmeagl.exeC:\Windows\system32\Jigmeagl.exe83⤵PID:2944
-
C:\Windows\SysWOW64\Jncenh32.exeC:\Windows\system32\Jncenh32.exe84⤵PID:896
-
C:\Windows\SysWOW64\Jkjbml32.exeC:\Windows\system32\Jkjbml32.exe85⤵PID:2340
-
C:\Windows\SysWOW64\Kebgea32.exeC:\Windows\system32\Kebgea32.exe86⤵PID:2768
-
C:\Windows\SysWOW64\Kjopnh32.exeC:\Windows\system32\Kjopnh32.exe87⤵PID:2544
-
C:\Windows\SysWOW64\Kcgdgnmc.exeC:\Windows\system32\Kcgdgnmc.exe88⤵PID:2600
-
C:\Windows\SysWOW64\Kjalch32.exeC:\Windows\system32\Kjalch32.exe89⤵PID:2896
-
C:\Windows\SysWOW64\Kcjqlm32.exeC:\Windows\system32\Kcjqlm32.exe90⤵PID:2764
-
C:\Windows\SysWOW64\Kiifjd32.exeC:\Windows\system32\Kiifjd32.exe91⤵PID:1900
-
C:\Windows\SysWOW64\Kofnbk32.exeC:\Windows\system32\Kofnbk32.exe92⤵PID:1940
-
C:\Windows\SysWOW64\Lhnckp32.exeC:\Windows\system32\Lhnckp32.exe93⤵PID:2120
-
C:\Windows\SysWOW64\Lebcdd32.exeC:\Windows\system32\Lebcdd32.exe94⤵PID:1688
-
C:\Windows\SysWOW64\Lkolmk32.exeC:\Windows\system32\Lkolmk32.exe95⤵PID:2264
-
C:\Windows\SysWOW64\Legmpdga.exeC:\Windows\system32\Legmpdga.exe96⤵PID:2956
-
C:\Windows\SysWOW64\Lkcehkeh.exeC:\Windows\system32\Lkcehkeh.exe97⤵PID:2272
-
C:\Windows\SysWOW64\Lanmde32.exeC:\Windows\system32\Lanmde32.exe98⤵PID:2196
-
C:\Windows\SysWOW64\Lmdnjf32.exeC:\Windows\system32\Lmdnjf32.exe99⤵PID:2800
-
C:\Windows\SysWOW64\Mmgkoe32.exeC:\Windows\system32\Mmgkoe32.exe100⤵PID:2020
-
C:\Windows\SysWOW64\Mmigdend.exeC:\Windows\system32\Mmigdend.exe101⤵PID:2160
-
C:\Windows\SysWOW64\Makmnh32.exeC:\Windows\system32\Makmnh32.exe102⤵PID:2216
-
C:\Windows\SysWOW64\Mamjchoa.exeC:\Windows\system32\Mamjchoa.exe103⤵PID:2904
-
C:\Windows\SysWOW64\Nnfgnibb.exeC:\Windows\system32\Nnfgnibb.exe104⤵PID:1584
-
C:\Windows\SysWOW64\Ndqokc32.exeC:\Windows\system32\Ndqokc32.exe105⤵PID:1864
-
C:\Windows\SysWOW64\Nadpdg32.exeC:\Windows\system32\Nadpdg32.exe106⤵PID:976
-
C:\Windows\SysWOW64\Ncellpog.exeC:\Windows\system32\Ncellpog.exe107⤵PID:2972
-
C:\Windows\SysWOW64\Nnkqih32.exeC:\Windows\system32\Nnkqih32.exe108⤵PID:2084
-
C:\Windows\SysWOW64\Nchiao32.exeC:\Windows\system32\Nchiao32.exe109⤵PID:796
-
C:\Windows\SysWOW64\Nffenj32.exeC:\Windows\system32\Nffenj32.exe110⤵PID:2284
-
C:\Windows\SysWOW64\Nlpmjdce.exeC:\Windows\system32\Nlpmjdce.exe111⤵PID:744
-
C:\Windows\SysWOW64\Ogfagmck.exeC:\Windows\system32\Ogfagmck.exe112⤵PID:1748
-
C:\Windows\SysWOW64\Ombjpd32.exeC:\Windows\system32\Ombjpd32.exe113⤵PID:1164
-
C:\Windows\SysWOW64\Obpbhk32.exeC:\Windows\system32\Obpbhk32.exe114⤵PID:2352
-
C:\Windows\SysWOW64\Ojgkih32.exeC:\Windows\system32\Ojgkih32.exe115⤵PID:2872
-
C:\Windows\SysWOW64\Ooccap32.exeC:\Windows\system32\Ooccap32.exe116⤵PID:2248
-
C:\Windows\SysWOW64\Ofmknifp.exeC:\Windows\system32\Ofmknifp.exe117⤵PID:1908
-
C:\Windows\SysWOW64\Okjdfq32.exeC:\Windows\system32\Okjdfq32.exe118⤵PID:2844
-
C:\Windows\SysWOW64\Ofphdi32.exeC:\Windows\system32\Ofphdi32.exe119⤵PID:1564
-
C:\Windows\SysWOW64\Giogonlb.exeC:\Windows\system32\Giogonlb.exe120⤵PID:1768
-
C:\Windows\SysWOW64\Heedbbdb.exeC:\Windows\system32\Heedbbdb.exe121⤵PID:1712
-
C:\Windows\SysWOW64\Icidlf32.exeC:\Windows\system32\Icidlf32.exe122⤵PID:904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-