Analysis
-
max time kernel
0s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
21/11/2024, 09:31
Static task
static1
Behavioral task
behavioral1
Sample
dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe
Resource
win10v2004-20241007-en
General
-
Target
dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe
-
Size
192KB
-
MD5
5fca7998b33bcf9a3a62c1649587d8b9
-
SHA1
fbf9fe14682f25c574755f407d151f85da12d1a7
-
SHA256
dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5
-
SHA512
149e7e340674286640cc3e255a5273b2b7eb741793025fdae5f45ce943f653bc367a8ad827d47745a5842d6a5da168fd0b068a284cb16f5840cb7a1bfccb9e75
-
SSDEEP
3072:rkgwzjO9GdCNQIceh5nLoYDGNlib5qfpfGU4lfirgjZXmK:xYqGkNjL7GNlighD4lTjZXN
Malware Config
Extracted
berbew
http://viruslist.com/wcmd.txt
http://viruslist.com/ppslog.php
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhnjdfcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fhnjdfcl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fohbqpki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fohbqpki.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdcncg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fdcncg32.exe -
Berbew family
-
Executes dropped EXE 4 IoCs
pid Process 2584 Fdcncg32.exe 2856 Fhnjdfcl.exe 2784 Fohbqpki.exe 2776 Fnkblm32.exe -
Loads dropped DLL 8 IoCs
pid Process 2604 dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe 2604 dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe 2584 Fdcncg32.exe 2584 Fdcncg32.exe 2856 Fhnjdfcl.exe 2856 Fhnjdfcl.exe 2784 Fohbqpki.exe 2784 Fohbqpki.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\Fnkblm32.exe Fohbqpki.exe File created C:\Windows\SysWOW64\Fdcncg32.exe dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe File opened for modification C:\Windows\SysWOW64\Fhnjdfcl.exe Fdcncg32.exe File created C:\Windows\SysWOW64\Fohbqpki.exe Fhnjdfcl.exe File created C:\Windows\SysWOW64\Kgmmoieh.dll Fdcncg32.exe File opened for modification C:\Windows\SysWOW64\Fohbqpki.exe Fhnjdfcl.exe File created C:\Windows\SysWOW64\Jeconcng.dll Fhnjdfcl.exe File opened for modification C:\Windows\SysWOW64\Fnkblm32.exe Fohbqpki.exe File created C:\Windows\SysWOW64\Qbeemg32.dll Fohbqpki.exe File opened for modification C:\Windows\SysWOW64\Fdcncg32.exe dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe File created C:\Windows\SysWOW64\Bgfhfhcl.dll dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe File created C:\Windows\SysWOW64\Fhnjdfcl.exe Fdcncg32.exe -
Program crash 1 IoCs
pid pid_target Process 8828 8464 WerFault.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdcncg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fhnjdfcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fohbqpki.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831} dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fdcncg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jeconcng.dll" Fhnjdfcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fohbqpki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fohbqpki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgmmoieh.dll" Fdcncg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fhnjdfcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbeemg32.dll" Fohbqpki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fdcncg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fhnjdfcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgfhfhcl.dll" dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2604 wrote to memory of 2584 2604 dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe 29 PID 2604 wrote to memory of 2584 2604 dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe 29 PID 2604 wrote to memory of 2584 2604 dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe 29 PID 2604 wrote to memory of 2584 2604 dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe 29 PID 2584 wrote to memory of 2856 2584 Fdcncg32.exe 30 PID 2584 wrote to memory of 2856 2584 Fdcncg32.exe 30 PID 2584 wrote to memory of 2856 2584 Fdcncg32.exe 30 PID 2584 wrote to memory of 2856 2584 Fdcncg32.exe 30 PID 2856 wrote to memory of 2784 2856 Fhnjdfcl.exe 31 PID 2856 wrote to memory of 2784 2856 Fhnjdfcl.exe 31 PID 2856 wrote to memory of 2784 2856 Fhnjdfcl.exe 31 PID 2856 wrote to memory of 2784 2856 Fhnjdfcl.exe 31 PID 2784 wrote to memory of 2776 2784 Fohbqpki.exe 32 PID 2784 wrote to memory of 2776 2784 Fohbqpki.exe 32 PID 2784 wrote to memory of 2776 2784 Fohbqpki.exe 32 PID 2784 wrote to memory of 2776 2784 Fohbqpki.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe"C:\Users\Admin\AppData\Local\Temp\dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\Fdcncg32.exeC:\Windows\system32\Fdcncg32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\Fhnjdfcl.exeC:\Windows\system32\Fhnjdfcl.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\Fohbqpki.exeC:\Windows\system32\Fohbqpki.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\Fnkblm32.exeC:\Windows\system32\Fnkblm32.exe5⤵
- Executes dropped EXE
PID:2776 -
C:\Windows\SysWOW64\Fdggofgn.exeC:\Windows\system32\Fdggofgn.exe6⤵PID:2796
-
C:\Windows\SysWOW64\Fnplgl32.exeC:\Windows\system32\Fnplgl32.exe7⤵PID:2692
-
C:\Windows\SysWOW64\Fqnhcgma.exeC:\Windows\system32\Fqnhcgma.exe8⤵PID:2328
-
C:\Windows\SysWOW64\Fghppa32.exeC:\Windows\system32\Fghppa32.exe9⤵PID:2460
-
C:\Windows\SysWOW64\Fjfllm32.exeC:\Windows\system32\Fjfllm32.exe10⤵PID:780
-
C:\Windows\SysWOW64\Gjiibm32.exeC:\Windows\system32\Gjiibm32.exe11⤵PID:288
-
C:\Windows\SysWOW64\Gmgenh32.exeC:\Windows\system32\Gmgenh32.exe12⤵PID:2452
-
C:\Windows\SysWOW64\Gfpjgn32.exeC:\Windows\system32\Gfpjgn32.exe13⤵PID:1148
-
C:\Windows\SysWOW64\Gohnpcmd.exeC:\Windows\system32\Gohnpcmd.exe14⤵PID:1792
-
C:\Windows\SysWOW64\Gjnbmlmj.exeC:\Windows\system32\Gjnbmlmj.exe15⤵PID:2840
-
C:\Windows\SysWOW64\Ghqchi32.exeC:\Windows\system32\Ghqchi32.exe16⤵PID:2344
-
C:\Windows\SysWOW64\Gbigao32.exeC:\Windows\system32\Gbigao32.exe17⤵PID:1484
-
C:\Windows\SysWOW64\Gomhkb32.exeC:\Windows\system32\Gomhkb32.exe18⤵PID:2216
-
C:\Windows\SysWOW64\Gdjpcj32.exeC:\Windows\system32\Gdjpcj32.exe19⤵PID:2548
-
C:\Windows\SysWOW64\Goodpb32.exeC:\Windows\system32\Goodpb32.exe20⤵PID:2324
-
C:\Windows\SysWOW64\Hbnqln32.exeC:\Windows\system32\Hbnqln32.exe21⤵PID:692
-
C:\Windows\SysWOW64\Higiih32.exeC:\Windows\system32\Higiih32.exe22⤵PID:920
-
C:\Windows\SysWOW64\Henjnica.exeC:\Windows\system32\Henjnica.exe23⤵PID:2352
-
C:\Windows\SysWOW64\Hcajjf32.exeC:\Windows\system32\Hcajjf32.exe24⤵PID:1512
-
C:\Windows\SysWOW64\Hngngo32.exeC:\Windows\system32\Hngngo32.exe25⤵PID:1736
-
C:\Windows\SysWOW64\Haejcj32.exeC:\Windows\system32\Haejcj32.exe26⤵PID:2124
-
C:\Windows\SysWOW64\Hccfoehi.exeC:\Windows\system32\Hccfoehi.exe27⤵PID:1584
-
C:\Windows\SysWOW64\Hjmolp32.exeC:\Windows\system32\Hjmolp32.exe28⤵PID:2940
-
C:\Windows\SysWOW64\Haggijgb.exeC:\Windows\system32\Haggijgb.exe29⤵PID:2616
-
C:\Windows\SysWOW64\Hjplao32.exeC:\Windows\system32\Hjplao32.exe30⤵PID:304
-
C:\Windows\SysWOW64\Hajdniep.exeC:\Windows\system32\Hajdniep.exe31⤵PID:2656
-
C:\Windows\SysWOW64\Hchpjddc.exeC:\Windows\system32\Hchpjddc.exe32⤵PID:2660
-
C:\Windows\SysWOW64\Hfflfp32.exeC:\Windows\system32\Hfflfp32.exe33⤵PID:2156
-
C:\Windows\SysWOW64\Ilceog32.exeC:\Windows\system32\Ilceog32.exe34⤵PID:608
-
C:\Windows\SysWOW64\Ibmmkaik.exeC:\Windows\system32\Ibmmkaik.exe35⤵PID:2944
-
C:\Windows\SysWOW64\Ieligmho.exeC:\Windows\system32\Ieligmho.exe36⤵PID:2148
-
C:\Windows\SysWOW64\Ilfadg32.exeC:\Windows\system32\Ilfadg32.exe37⤵PID:1340
-
C:\Windows\SysWOW64\Iijbnkne.exeC:\Windows\system32\Iijbnkne.exe38⤵PID:2024
-
C:\Windows\SysWOW64\Ilhnjfmi.exeC:\Windows\system32\Ilhnjfmi.exe39⤵PID:1752
-
C:\Windows\SysWOW64\Infjfblm.exeC:\Windows\system32\Infjfblm.exe40⤵PID:1476
-
C:\Windows\SysWOW64\Ieqbbl32.exeC:\Windows\system32\Ieqbbl32.exe41⤵PID:1436
-
C:\Windows\SysWOW64\Iljkofkg.exeC:\Windows\system32\Iljkofkg.exe42⤵PID:3000
-
C:\Windows\SysWOW64\Ibdclp32.exeC:\Windows\system32\Ibdclp32.exe43⤵PID:2172
-
C:\Windows\SysWOW64\Iecohl32.exeC:\Windows\system32\Iecohl32.exe44⤵PID:2968
-
C:\Windows\SysWOW64\Ilmgef32.exeC:\Windows\system32\Ilmgef32.exe45⤵PID:2336
-
C:\Windows\SysWOW64\Ijphqbpo.exeC:\Windows\system32\Ijphqbpo.exe46⤵PID:1980
-
C:\Windows\SysWOW64\Iaipmm32.exeC:\Windows\system32\Iaipmm32.exe47⤵PID:2284
-
C:\Windows\SysWOW64\Jdhlih32.exeC:\Windows\system32\Jdhlih32.exe48⤵PID:1452
-
C:\Windows\SysWOW64\Jhchjgoh.exeC:\Windows\system32\Jhchjgoh.exe49⤵PID:2868
-
C:\Windows\SysWOW64\Jjbdfbnl.exeC:\Windows\system32\Jjbdfbnl.exe50⤵PID:2788
-
C:\Windows\SysWOW64\Jmpqbnmp.exeC:\Windows\system32\Jmpqbnmp.exe51⤵PID:1336
-
C:\Windows\SysWOW64\Jalmcl32.exeC:\Windows\system32\Jalmcl32.exe52⤵PID:2860
-
C:\Windows\SysWOW64\Jdjioh32.exeC:\Windows\system32\Jdjioh32.exe53⤵PID:2212
-
C:\Windows\SysWOW64\Jfiekc32.exeC:\Windows\system32\Jfiekc32.exe54⤵PID:484
-
C:\Windows\SysWOW64\Jigagocd.exeC:\Windows\system32\Jigagocd.exe55⤵PID:2832
-
C:\Windows\SysWOW64\Jmbnhm32.exeC:\Windows\system32\Jmbnhm32.exe56⤵PID:2892
-
C:\Windows\SysWOW64\Jdmfdgbj.exeC:\Windows\system32\Jdmfdgbj.exe57⤵PID:2636
-
C:\Windows\SysWOW64\Jbpfpd32.exeC:\Windows\system32\Jbpfpd32.exe58⤵PID:756
-
C:\Windows\SysWOW64\Jkfnaa32.exeC:\Windows\system32\Jkfnaa32.exe59⤵PID:1600
-
C:\Windows\SysWOW64\Jmejmm32.exeC:\Windows\system32\Jmejmm32.exe60⤵PID:2052
-
C:\Windows\SysWOW64\Jlhjijpe.exeC:\Windows\system32\Jlhjijpe.exe61⤵PID:2004
-
C:\Windows\SysWOW64\Jdobjgqg.exeC:\Windows\system32\Jdobjgqg.exe62⤵PID:956
-
C:\Windows\SysWOW64\Jbbbed32.exeC:\Windows\system32\Jbbbed32.exe63⤵PID:936
-
C:\Windows\SysWOW64\Jepoao32.exeC:\Windows\system32\Jepoao32.exe64⤵PID:2552
-
C:\Windows\SysWOW64\Jilkbn32.exeC:\Windows\system32\Jilkbn32.exe65⤵PID:1944
-
C:\Windows\SysWOW64\Jljgni32.exeC:\Windows\system32\Jljgni32.exe66⤵PID:2812
-
C:\Windows\SysWOW64\Joicje32.exeC:\Windows\system32\Joicje32.exe67⤵PID:2760
-
C:\Windows\SysWOW64\Jgpklb32.exeC:\Windows\system32\Jgpklb32.exe68⤵PID:2768
-
C:\Windows\SysWOW64\Jinghn32.exeC:\Windows\system32\Jinghn32.exe69⤵PID:2928
-
C:\Windows\SysWOW64\Jhahcjcf.exeC:\Windows\system32\Jhahcjcf.exe70⤵PID:2424
-
C:\Windows\SysWOW64\Kphpdhdh.exeC:\Windows\system32\Kphpdhdh.exe71⤵PID:2668
-
C:\Windows\SysWOW64\Kbflqccl.exeC:\Windows\system32\Kbflqccl.exe72⤵PID:2972
-
C:\Windows\SysWOW64\Kaillp32.exeC:\Windows\system32\Kaillp32.exe73⤵PID:984
-
C:\Windows\SysWOW64\Kiqdmm32.exeC:\Windows\system32\Kiqdmm32.exe74⤵PID:1308
-
C:\Windows\SysWOW64\Khcdijac.exeC:\Windows\system32\Khcdijac.exe75⤵PID:2220
-
C:\Windows\SysWOW64\Kkaaee32.exeC:\Windows\system32\Kkaaee32.exe76⤵PID:2100
-
C:\Windows\SysWOW64\Kommediq.exeC:\Windows\system32\Kommediq.exe77⤵PID:2520
-
C:\Windows\SysWOW64\Kaliaphd.exeC:\Windows\system32\Kaliaphd.exe78⤵PID:1800
-
C:\Windows\SysWOW64\Kegebn32.exeC:\Windows\system32\Kegebn32.exe79⤵PID:1708
-
C:\Windows\SysWOW64\Kheaoj32.exeC:\Windows\system32\Kheaoj32.exe80⤵PID:1180
-
C:\Windows\SysWOW64\Kkdnke32.exeC:\Windows\system32\Kkdnke32.exe81⤵PID:3020
-
C:\Windows\SysWOW64\Knbjgq32.exeC:\Windows\system32\Knbjgq32.exe82⤵PID:2596
-
C:\Windows\SysWOW64\Kanfgofa.exeC:\Windows\system32\Kanfgofa.exe83⤵PID:2372
-
C:\Windows\SysWOW64\Kdlbckee.exeC:\Windows\system32\Kdlbckee.exe84⤵PID:1492
-
C:\Windows\SysWOW64\Khhndi32.exeC:\Windows\system32\Khhndi32.exe85⤵PID:2056
-
C:\Windows\SysWOW64\Kkfjpemb.exeC:\Windows\system32\Kkfjpemb.exe86⤵PID:2752
-
C:\Windows\SysWOW64\Kobfqc32.exeC:\Windows\system32\Kobfqc32.exe87⤵PID:2988
-
C:\Windows\SysWOW64\Kapbmo32.exeC:\Windows\system32\Kapbmo32.exe88⤵PID:1876
-
C:\Windows\SysWOW64\Kdooij32.exeC:\Windows\system32\Kdooij32.exe89⤵PID:576
-
C:\Windows\SysWOW64\Kgmkef32.exeC:\Windows\system32\Kgmkef32.exe90⤵PID:408
-
C:\Windows\SysWOW64\Kkigfdjo.exeC:\Windows\system32\Kkigfdjo.exe91⤵PID:2000
-
C:\Windows\SysWOW64\Kngcbpjc.exeC:\Windows\system32\Kngcbpjc.exe92⤵PID:2804
-
C:\Windows\SysWOW64\Kpeonkig.exeC:\Windows\system32\Kpeonkig.exe93⤵PID:264
-
C:\Windows\SysWOW64\Kcdljghj.exeC:\Windows\system32\Kcdljghj.exe94⤵PID:888
-
C:\Windows\SysWOW64\Lkkckdhm.exeC:\Windows\system32\Lkkckdhm.exe95⤵PID:828
-
C:\Windows\SysWOW64\Ljndga32.exeC:\Windows\system32\Ljndga32.exe96⤵PID:2444
-
C:\Windows\SysWOW64\Lllpclnk.exeC:\Windows\system32\Lllpclnk.exe97⤵PID:3032
-
C:\Windows\SysWOW64\Ldchdjom.exeC:\Windows\system32\Ldchdjom.exe98⤵PID:2780
-
C:\Windows\SysWOW64\Lcfhpf32.exeC:\Windows\system32\Lcfhpf32.exe99⤵PID:2728
-
C:\Windows\SysWOW64\Lfedlb32.exeC:\Windows\system32\Lfedlb32.exe100⤵PID:960
-
C:\Windows\SysWOW64\Lnlmmo32.exeC:\Windows\system32\Lnlmmo32.exe101⤵PID:2512
-
C:\Windows\SysWOW64\Lpjiik32.exeC:\Windows\system32\Lpjiik32.exe102⤵PID:1952
-
C:\Windows\SysWOW64\Lomidgkl.exeC:\Windows\system32\Lomidgkl.exe103⤵PID:2980
-
C:\Windows\SysWOW64\Lgdafeln.exeC:\Windows\system32\Lgdafeln.exe104⤵PID:2208
-
C:\Windows\SysWOW64\Ljbmbpkb.exeC:\Windows\system32\Ljbmbpkb.exe105⤵PID:2088
-
C:\Windows\SysWOW64\Llainlje.exeC:\Windows\system32\Llainlje.exe106⤵PID:1588
-
C:\Windows\SysWOW64\Loofjg32.exeC:\Windows\system32\Loofjg32.exe107⤵PID:2896
-
C:\Windows\SysWOW64\Lbnbfb32.exeC:\Windows\system32\Lbnbfb32.exe108⤵PID:2296
-
C:\Windows\SysWOW64\Lfingaaf.exeC:\Windows\system32\Lfingaaf.exe109⤵PID:1612
-
C:\Windows\SysWOW64\Lhhjcmpj.exeC:\Windows\system32\Lhhjcmpj.exe110⤵PID:2360
-
C:\Windows\SysWOW64\Llcfck32.exeC:\Windows\system32\Llcfck32.exe111⤵PID:2716
-
C:\Windows\SysWOW64\Lobbpg32.exeC:\Windows\system32\Lobbpg32.exe112⤵PID:580
-
C:\Windows\SysWOW64\Lcmopepp.exeC:\Windows\system32\Lcmopepp.exe113⤵PID:2540
-
C:\Windows\SysWOW64\Lflklaoc.exeC:\Windows\system32\Lflklaoc.exe114⤵PID:300
-
C:\Windows\SysWOW64\Lhjghlng.exeC:\Windows\system32\Lhjghlng.exe115⤵PID:2316
-
C:\Windows\SysWOW64\Llfcik32.exeC:\Windows\system32\Llfcik32.exe116⤵PID:1316
-
C:\Windows\SysWOW64\Lodoefed.exeC:\Windows\system32\Lodoefed.exe117⤵PID:1424
-
C:\Windows\SysWOW64\Lngpac32.exeC:\Windows\system32\Lngpac32.exe118⤵PID:2956
-
C:\Windows\SysWOW64\Mfngbq32.exeC:\Windows\system32\Mfngbq32.exe119⤵PID:2592
-
C:\Windows\SysWOW64\Mhlcnl32.exeC:\Windows\system32\Mhlcnl32.exe120⤵PID:1908
-
C:\Windows\SysWOW64\Mgodjico.exeC:\Windows\system32\Mgodjico.exe121⤵PID:2252
-
C:\Windows\SysWOW64\Moflkfca.exeC:\Windows\system32\Moflkfca.exe122⤵PID:1248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-