Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 22:27
Behavioral task
behavioral1
Sample
53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe
-
Size
912KB
-
MD5
0b85ac4c10be2180e1d53fb363dfa0f0
-
SHA1
1bf103469014b2a20d46a3b9e0d9ede0108dd44a
-
SHA256
53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122
-
SHA512
65c6d586524cb4d8c2dba4661c4b7b3592d57b74b4241280e8f9217ee82287bdbf8b75054b77183e04759a0c9c60544644ca2a40484d032f659cdea58354a118
-
SSDEEP
24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWT/:RPjOa1NxyYtH1/
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 42 IoCs
resource yara_rule behavioral1/memory/2252-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000f000000018662-18.dat family_gh0strat behavioral1/memory/1764-33-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1764-32-0x0000000000230000-0x000000000025F000-memory.dmp family_gh0strat behavioral1/memory/1764-31-0x0000000000230000-0x000000000025F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000190c9-36.dat family_gh0strat behavioral1/memory/2252-23-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00080000000191fd-47.dat family_gh0strat behavioral1/memory/1764-53-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0005000000019db8-80.dat family_gh0strat behavioral1/files/0x000500000001a07b-103.dat family_gh0strat behavioral1/memory/2724-82-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2736-110-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000500000001a345-131.dat family_gh0strat behavioral1/memory/2744-146-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2744-144-0x00000000003D0000-0x00000000003FF000-memory.dmp family_gh0strat behavioral1/memory/2292-137-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000500000001a431-160.dat family_gh0strat behavioral1/memory/2744-166-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000500000001a48e-188.dat family_gh0strat behavioral1/memory/1756-201-0x0000000000230000-0x000000000025F000-memory.dmp family_gh0strat behavioral1/memory/1424-194-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000500000001a4b5-217.dat family_gh0strat behavioral1/memory/1756-222-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000500000001a4c4-243.dat family_gh0strat behavioral1/memory/2352-256-0x0000000000230000-0x000000000025F000-memory.dmp family_gh0strat behavioral1/memory/316-248-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2352-266-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1564-275-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1564-277-0x0000000000230000-0x000000000025F000-memory.dmp family_gh0strat behavioral1/memory/1564-276-0x0000000000230000-0x000000000025F000-memory.dmp family_gh0strat behavioral1/memory/1564-294-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/564-297-0x00000000002D0000-0x00000000002FF000-memory.dmp family_gh0strat behavioral1/memory/564-295-0x00000000002D0000-0x00000000002FF000-memory.dmp family_gh0strat behavioral1/memory/564-314-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/556-332-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1572-335-0x0000000000230000-0x000000000025F000-memory.dmp family_gh0strat behavioral1/memory/1572-352-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2236-371-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2792-390-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2828-410-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2604-429-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat -
Gh0strat family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6F723C62-6F99-49d5-BEFC-FCC52DFB40E3} inwyoarng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B80726A6-2DD6-4c6f-B8BE-5CACA62CF6E0}\stubpath = "C:\\Windows\\system32\\innkyzbkq.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D71CFD68-2E35-425c-963F-E8E3446C9425}\stubpath = "C:\\Windows\\system32\\inljnsraz.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0B2F0345-A552-4f24-B176-0BA00F08EAB0} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FB574CEC-DEDA-4169-99F7-2FB93F599F40}\stubpath = "C:\\Windows\\system32\\inmnqqvoz.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9EA51E4D-A04F-4c71-8275-4A096A3A1CCA} inqbcmcsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{10AD5F3E-B80A-4ce7-83D8-C5BD04CDE3F1}\stubpath = "C:\\Windows\\system32\\indwaelme.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AB9905E5-14B2-45da-9AE0-8425A48F5E01} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CE5DBD1D-D25C-4f42-9B93-8D6DDDF047B7} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0F66CC82-BC08-4fb9-ADDE-707C86501E8A}\stubpath = "C:\\Windows\\system32\\invlokdbj.exe" inndiulal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2114FAA4-E278-4698-9B99-7C720281E3E1} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B176DE91-3C6D-4955-92C5-DF221A694B58} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{906BF0B6-787B-43bd-BC6E-B69B8E02A8C0}\stubpath = "C:\\Windows\\system32\\inihodrxd.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{564888E6-B587-4922-A0E2-B957BDDBC34F} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DEA0C924-A8A9-4eb5-8D35-882503F2C6C2}\stubpath = "C:\\Windows\\system32\\innwxjjmk.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0D15BA8-6217-4fbb-9E1F-D66A3F181443}\stubpath = "C:\\Windows\\system32\\inqyhxkst.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E58B2905-485A-42db-8460-76A838EA60A8}\stubpath = "C:\\Windows\\system32\\inybywsph.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FDAE23FF-778D-4497-A994-CADC7CCB1978} incsnrmiw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0B29DDD5-E413-4aa8-95D8-60CC10C9B9D3}\stubpath = "C:\\Windows\\system32\\inyvsxuru.exe" inenfezbl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{61DEB09E-35DE-4f06-BF49-23A3DC542DF5} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{84CC1AE7-017E-469c-BABB-18ED8249A973} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{117B5211-DAD7-4d57-94C7-73898A0D8F2A} inlhpjpqs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7562EDEF-7581-4c0a-913F-20D346C1F218}\stubpath = "C:\\Windows\\system32\\inohnsuqx.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2B288A35-6A3A-47cb-A5D3-EB777B4D7A20}\stubpath = "C:\\Windows\\system32\\inctcumep.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BD850A1B-8F28-4a0e-B45D-B0FAFE1F455F}\stubpath = "C:\\Windows\\system32\\inkyxjvfb.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F35F5D53-5412-4477-A8FD-E68B55043474}\stubpath = "C:\\Windows\\system32\\invdvkuva.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EB4FA8A8-F2A5-4a32-9ECD-834AE969B1C0}\stubpath = "C:\\Windows\\system32\\inrkkopkx.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F9EC1B7B-E1A0-4cf1-95BC-AAEB9B178581} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CC2F29F6-3B52-4fb3-B7BE-019F2326F801}\stubpath = "C:\\Windows\\system32\\intrfzlnv.exe" inctckufj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{796122F7-661E-493f-89B3-F687C5DBF26C}\stubpath = "C:\\Windows\\system32\\ineguxzcg.exe" inhdmkggs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{234A8921-B8F8-445b-99C1-EDD76D536D45}\stubpath = "C:\\Windows\\system32\\inrgvrxml.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E1DDC50E-B4C6-4bd8-879A-D4DB9402BDED}\stubpath = "C:\\Windows\\system32\\inhnrctsc.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4F2F12B2-C543-4a48-B767-B4B896C62328}\stubpath = "C:\\Windows\\system32\\injpofnpi.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8351C5FB-CEB0-418d-A966-338DC5E5D912}\stubpath = "C:\\Windows\\system32\\innycjqwp.exe" inmroafou.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B902BE5F-82DE-4704-99E8-923DCC556045}\stubpath = "C:\\Windows\\system32\\inujzthos.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EFFCA500-17BA-4b8d-9617-5E00DFFCCBD2}\stubpath = "C:\\Windows\\system32\\ingpzxcre.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ABA91D2C-98F7-4511-ADD8-E6B9949C3A86} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8565D6A5-FF03-48f2-B883-214B0182EACA}\stubpath = "C:\\Windows\\system32\\indfbinpy.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0B86D685-4014-45fc-AF0D-336308A4DED1} indxawycz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2DAFE918-CC30-4945-BFCC-5DE0FE9141A9} inbdhuahl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B7A65921-4C0E-4bdd-A905-9D92D1593220}\stubpath = "C:\\Windows\\system32\\inyenhigo.exe" inxtjigwa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F1EACC98-3B2E-4ccb-881C-D6F9307EC206}\stubpath = "C:\\Windows\\system32\\inkupidyf.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{13FBAD66-3945-4f79-93C9-F4C6B36C95C8} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{347EFE6C-0178-4c07-B59D-982BFDC53DC8} infgqgwzc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B519C5D5-6FA5-4726-812D-93D574BC0FB7} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{24AD43A6-E062-43be-88F2-8C08C9143617} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{70835630-FC8D-4f52-83F5-E6D69DBC05C5}\stubpath = "C:\\Windows\\system32\\invspsova.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F7381E69-1E28-4d6a-8006-2BC381F8708F} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{696C7085-0DEF-4b18-A7A9-0FA59DF1E5D3} inqrcscxo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5E1C1942-602B-4f77-BDA4-6F71907C5D62} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{90EF589B-D43F-4238-84FD-4907AEE42FD2}\stubpath = "C:\\Windows\\system32\\incubtlew.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9337A490-6690-4a5c-B8BF-B88716A4DC6C}\stubpath = "C:\\Windows\\system32\\inhmttzrd.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8EF125A6-F255-4e5d-B21A-6B42BB9ECCDA}\stubpath = "C:\\Windows\\system32\\indtkzjxv.exe" inmawkptn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495D3286-921E-4204-8311-F529C82AC114} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{887B1A0E-0D86-4dc1-A3E1-75957FF4349B} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{10694064-4D44-427c-BF8D-804C8B5C6A60}\stubpath = "C:\\Windows\\system32\\invobtnvn.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C29C38FD-9843-43b8-8EB0-CCC559E62499}\stubpath = "C:\\Windows\\system32\\inerqlrrp.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FA90FFA9-981E-45cc-9CF8-F881C82CB7C1} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{88B8427A-D4D9-4a80-BD62-D07C6575CF36}\stubpath = "C:\\Windows\\system32\\inoagqoiu.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C4BCE751-F40E-4d93-AD61-C22DEC2FCB90} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55FD2C54-CE7F-40fa-9FA6-A6921526E081}\stubpath = "C:\\Windows\\system32\\inejpcony.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5CB1B850-2DF0-4968-A3AF-845466AD5F66}\stubpath = "C:\\Windows\\system32\\inkwhunqr.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8ED900BE-A6CF-491b-B2E0-2AD5386B7E2A} inqofiykl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4C91CC7C-E94C-45c4-ADC0-C668F6039309}\stubpath = "C:\\Windows\\system32\\innljnnyl.exe" inycopaqa.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0007000000012101-5.dat acprotect -
Executes dropped EXE 64 IoCs
pid Process 1764 inuqbjvqf.exe 2724 innqsrkjz.exe 2736 inyufnzuj.exe 2292 indwztgsi.exe 2744 ingvnhoze.exe 1424 inbuxzyre.exe 1756 inortslka.exe 316 inqtvunam.exe 2352 insezthji.exe 1564 invhwkmle.exe 564 inrdysgih.exe 556 incvyzsfr.exe 1572 inykznpoh.exe 2236 intsuvkkg.exe 2792 inqcxrfhg.exe 2828 indskelwb.exe 2604 infhthtec.exe 2564 inyjbrycn.exe 1716 inmeufqjy.exe 1920 inutvwllh.exe 284 inazpsjiq.exe 2212 inwsdlxsh.exe 2540 inzvgovkd.exe 3012 inwixlnmf.exe 1952 injyqkarh.exe 2084 inldtepix.exe 280 inqmfrmyb.exe 2272 intpaiupe.exe 1180 inyorihpp.exe 2164 inecpcnet.exe 2708 incraptug.exe 1472 indtwnmuu.exe 2712 inxjymong.exe 2620 ingvetxyk.exe 2032 inhwnltjf.exe 2888 inasgqvzt.exe 2940 incrjzdkv.exe 2964 inatwyxqd.exe 1424 inugvjlkd.exe 1776 insbquvhx.exe 1980 inbfyviuk.exe 680 ingwzqpxx.exe 396 ingvzmksi.exe 1720 injhulmow.exe 1484 inpsutmlb.exe 2452 inaphxbit.exe 376 invrckwrg.exe 2092 inqgdzfrf.exe 2836 infumgnyd.exe 2904 inwhpwale.exe 2604 infvypoww.exe 2644 inkzrlbas.exe 2876 inpleqlxa.exe 2020 inpbwqegf.exe 1280 inadbobmd.exe 2964 inpfzcyeq.exe 2664 incsvmltt.exe 2524 ineuxonvv.exe 1608 inzloqpih.exe 1944 inlsmacbt.exe 2504 innfvgrkz.exe 1264 inmkxopbr.exe 1656 insvxwpco.exe 2800 indrzpldy.exe -
Loads dropped DLL 64 IoCs
pid Process 2252 53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe 2252 53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe 1764 inuqbjvqf.exe 1764 inuqbjvqf.exe 1764 inuqbjvqf.exe 1764 inuqbjvqf.exe 1764 inuqbjvqf.exe 2724 innqsrkjz.exe 2724 innqsrkjz.exe 2724 innqsrkjz.exe 2724 innqsrkjz.exe 2724 innqsrkjz.exe 2736 inyufnzuj.exe 2736 inyufnzuj.exe 2736 inyufnzuj.exe 2736 inyufnzuj.exe 2736 inyufnzuj.exe 2292 indwztgsi.exe 2292 indwztgsi.exe 2292 indwztgsi.exe 2292 indwztgsi.exe 2292 indwztgsi.exe 2744 ingvnhoze.exe 2744 ingvnhoze.exe 2744 ingvnhoze.exe 2744 ingvnhoze.exe 2744 ingvnhoze.exe 1424 inbuxzyre.exe 1424 inbuxzyre.exe 1424 inbuxzyre.exe 1424 inbuxzyre.exe 1424 inbuxzyre.exe 1756 inortslka.exe 1756 inortslka.exe 1756 inortslka.exe 1756 inortslka.exe 1756 inortslka.exe 316 inqtvunam.exe 316 inqtvunam.exe 316 inqtvunam.exe 316 inqtvunam.exe 316 inqtvunam.exe 2352 insezthji.exe 2352 insezthji.exe 2352 insezthji.exe 2352 insezthji.exe 2352 insezthji.exe 1564 invhwkmle.exe 1564 invhwkmle.exe 1564 invhwkmle.exe 1564 invhwkmle.exe 1564 invhwkmle.exe 564 inrdysgih.exe 564 inrdysgih.exe 564 inrdysgih.exe 564 inrdysgih.exe 564 inrdysgih.exe 556 incvyzsfr.exe 556 incvyzsfr.exe 556 incvyzsfr.exe 556 incvyzsfr.exe 556 incvyzsfr.exe 1572 inykznpoh.exe 1572 inykznpoh.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inhfjonvr.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inpztssbo.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\iniyvoyek.exe Process not Found File opened for modification C:\Windows\SysWOW64\inwptxwfn.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inkzrlbas.exe_lang.ini infvypoww.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inngmlnpt.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\infvhzyik.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inxavmale.exe File created C:\Windows\SysWOW64\inoxamzxs.exe Process not Found File opened for modification C:\Windows\SysWOW64\inqhztqfa.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\innxojlnx.exe Process not Found File created C:\Windows\SysWOW64\inkqfxtww.exe Process not Found File created C:\Windows\SysWOW64\inpzalala.exe Process not Found File opened for modification C:\Windows\SysWOW64\inbeweghk.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inaqqubah.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\incjlnzmh.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inelzamyq.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\infhthtec.exe indskelwb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inapioiyr.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inyfyzyum.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inutedbhd.exe Process not Found File opened for modification C:\Windows\SysWOW64\incjkcasi.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inkbyhage.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inulkvuiv.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\ingesfnmg.exe Process not Found File created C:\Windows\SysWOW64\inyncpean.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inkuaczqt.exe File opened for modification C:\Windows\SysWOW64\indbgunvf.exe_lang.ini inlrcakqo.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inekycovy.exe Process not Found File created C:\Windows\SysWOW64\inetlvact.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inwvlxdnl.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inesfniwn.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inoxpttnk.exe Process not Found File created C:\Windows\SysWOW64\inywnjhqs.exe Process not Found File created C:\Windows\SysWOW64\inmhvsosp.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inxbftvlo.exe File opened for modification C:\Windows\SysWOW64\inarkgohq.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\invmqmkty.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\infmbpvbz.exe_lang.ini inlolxmlm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inklimtau.exe File created C:\Windows\SysWOW64\inciyatsg.exe Process not Found File created C:\Windows\SysWOW64\invtzxoiy.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inpiokmso.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inpleqlxa.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqfeufhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inojxnmke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmzfdmqx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzewkdpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inknhvqeu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intxcqoxe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intsuvkkg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invjtmuem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injhepyti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inougxtmk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2252 53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe 1764 inuqbjvqf.exe 2724 innqsrkjz.exe 2736 inyufnzuj.exe 2292 indwztgsi.exe 2744 ingvnhoze.exe 1424 inbuxzyre.exe 1756 inortslka.exe 316 inqtvunam.exe 2352 insezthji.exe 1564 invhwkmle.exe 564 inrdysgih.exe 556 incvyzsfr.exe 1572 inykznpoh.exe 2236 intsuvkkg.exe 2792 inqcxrfhg.exe 2828 indskelwb.exe 2604 infhthtec.exe 2564 inyjbrycn.exe 1716 inmeufqjy.exe 1920 inutvwllh.exe 284 inazpsjiq.exe 2212 inwsdlxsh.exe 2540 inzvgovkd.exe 3012 inwixlnmf.exe 1952 injyqkarh.exe 2084 inldtepix.exe 280 inqmfrmyb.exe 2272 intpaiupe.exe 1180 inyorihpp.exe 2164 inecpcnet.exe 2708 incraptug.exe 1472 indtwnmuu.exe 2712 inxjymong.exe 2620 ingvetxyk.exe 2032 inhwnltjf.exe 2888 inasgqvzt.exe 2940 incrjzdkv.exe 2964 inatwyxqd.exe 1424 inugvjlkd.exe 1776 insbquvhx.exe 1980 inbfyviuk.exe 680 ingwzqpxx.exe 396 ingvzmksi.exe 1720 injhulmow.exe 1484 inpsutmlb.exe 2452 inaphxbit.exe 376 invrckwrg.exe 2092 inqgdzfrf.exe 2836 infumgnyd.exe 2904 inwhpwale.exe 2604 infvypoww.exe 2644 inkzrlbas.exe 2876 inpleqlxa.exe 2020 inpbwqegf.exe 1280 inadbobmd.exe 2964 inpfzcyeq.exe 2664 incsvmltt.exe 2524 ineuxonvv.exe 1608 inzloqpih.exe 1944 inlsmacbt.exe 2504 innfvgrkz.exe 1264 inmkxopbr.exe 1656 insvxwpco.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2252 53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe Token: SeDebugPrivilege 1764 inuqbjvqf.exe Token: SeDebugPrivilege 2724 innqsrkjz.exe Token: SeDebugPrivilege 2736 inyufnzuj.exe Token: SeDebugPrivilege 2292 indwztgsi.exe Token: SeDebugPrivilege 2744 ingvnhoze.exe Token: SeDebugPrivilege 1424 inbuxzyre.exe Token: SeDebugPrivilege 1756 inortslka.exe Token: SeDebugPrivilege 316 inqtvunam.exe Token: SeDebugPrivilege 2352 insezthji.exe Token: SeDebugPrivilege 1564 invhwkmle.exe Token: SeDebugPrivilege 564 inrdysgih.exe Token: SeDebugPrivilege 556 incvyzsfr.exe Token: SeDebugPrivilege 1572 inykznpoh.exe Token: SeDebugPrivilege 2236 intsuvkkg.exe Token: SeDebugPrivilege 2792 inqcxrfhg.exe Token: SeDebugPrivilege 2828 indskelwb.exe Token: SeDebugPrivilege 2604 infhthtec.exe Token: SeDebugPrivilege 2564 inyjbrycn.exe Token: SeDebugPrivilege 1716 inmeufqjy.exe Token: SeDebugPrivilege 1920 inutvwllh.exe Token: SeDebugPrivilege 284 inazpsjiq.exe Token: SeDebugPrivilege 2212 inwsdlxsh.exe Token: SeDebugPrivilege 2540 inzvgovkd.exe Token: SeDebugPrivilege 3012 inwixlnmf.exe Token: SeDebugPrivilege 1952 injyqkarh.exe Token: SeDebugPrivilege 2084 inldtepix.exe Token: SeDebugPrivilege 280 inqmfrmyb.exe Token: SeDebugPrivilege 2272 intpaiupe.exe Token: SeDebugPrivilege 1180 inyorihpp.exe Token: SeDebugPrivilege 2164 inecpcnet.exe Token: SeDebugPrivilege 2708 incraptug.exe Token: SeDebugPrivilege 1472 indtwnmuu.exe Token: SeDebugPrivilege 2712 inxjymong.exe Token: SeDebugPrivilege 2620 ingvetxyk.exe Token: SeDebugPrivilege 2032 inhwnltjf.exe Token: SeDebugPrivilege 2888 inasgqvzt.exe Token: SeDebugPrivilege 2940 incrjzdkv.exe Token: SeDebugPrivilege 2964 inatwyxqd.exe Token: SeDebugPrivilege 1424 inugvjlkd.exe Token: SeDebugPrivilege 1776 insbquvhx.exe Token: SeDebugPrivilege 1980 inbfyviuk.exe Token: SeDebugPrivilege 680 ingwzqpxx.exe Token: SeDebugPrivilege 396 ingvzmksi.exe Token: SeDebugPrivilege 1720 injhulmow.exe Token: SeDebugPrivilege 1484 inpsutmlb.exe Token: SeDebugPrivilege 2452 inaphxbit.exe Token: SeDebugPrivilege 376 invrckwrg.exe Token: SeDebugPrivilege 2092 inqgdzfrf.exe Token: SeDebugPrivilege 2836 infumgnyd.exe Token: SeDebugPrivilege 2904 inwhpwale.exe Token: SeDebugPrivilege 2604 infvypoww.exe Token: SeDebugPrivilege 2644 inkzrlbas.exe Token: SeDebugPrivilege 2876 inpleqlxa.exe Token: SeDebugPrivilege 2020 inpbwqegf.exe Token: SeDebugPrivilege 1280 inadbobmd.exe Token: SeDebugPrivilege 2964 inpfzcyeq.exe Token: SeDebugPrivilege 2664 incsvmltt.exe Token: SeDebugPrivilege 2524 ineuxonvv.exe Token: SeDebugPrivilege 1608 inzloqpih.exe Token: SeDebugPrivilege 1944 inlsmacbt.exe Token: SeDebugPrivilege 2504 innfvgrkz.exe Token: SeDebugPrivilege 1264 inmkxopbr.exe Token: SeDebugPrivilege 1656 insvxwpco.exe -
Suspicious use of SetWindowsHookEx 29 IoCs
pid Process 2252 53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe 1764 inuqbjvqf.exe 2724 innqsrkjz.exe 2736 inyufnzuj.exe 2292 indwztgsi.exe 2744 ingvnhoze.exe 1424 inbuxzyre.exe 1756 inortslka.exe 316 inqtvunam.exe 2352 insezthji.exe 1564 invhwkmle.exe 564 inrdysgih.exe 556 incvyzsfr.exe 1572 inykznpoh.exe 2236 intsuvkkg.exe 2792 inqcxrfhg.exe 2828 indskelwb.exe 2604 infhthtec.exe 2564 inyjbrycn.exe 1716 inmeufqjy.exe 1920 inutvwllh.exe 284 inazpsjiq.exe 2212 inwsdlxsh.exe 2540 inzvgovkd.exe 3012 inwixlnmf.exe 1952 injyqkarh.exe 2084 inldtepix.exe 280 inqmfrmyb.exe 2272 intpaiupe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2252 wrote to memory of 1764 2252 53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe 31 PID 2252 wrote to memory of 1764 2252 53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe 31 PID 2252 wrote to memory of 1764 2252 53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe 31 PID 2252 wrote to memory of 1764 2252 53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe 31 PID 2252 wrote to memory of 1764 2252 53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe 31 PID 2252 wrote to memory of 1764 2252 53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe 31 PID 2252 wrote to memory of 1764 2252 53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe 31 PID 1764 wrote to memory of 2724 1764 inuqbjvqf.exe 32 PID 1764 wrote to memory of 2724 1764 inuqbjvqf.exe 32 PID 1764 wrote to memory of 2724 1764 inuqbjvqf.exe 32 PID 1764 wrote to memory of 2724 1764 inuqbjvqf.exe 32 PID 1764 wrote to memory of 2724 1764 inuqbjvqf.exe 32 PID 1764 wrote to memory of 2724 1764 inuqbjvqf.exe 32 PID 1764 wrote to memory of 2724 1764 inuqbjvqf.exe 32 PID 2724 wrote to memory of 2736 2724 innqsrkjz.exe 33 PID 2724 wrote to memory of 2736 2724 innqsrkjz.exe 33 PID 2724 wrote to memory of 2736 2724 innqsrkjz.exe 33 PID 2724 wrote to memory of 2736 2724 innqsrkjz.exe 33 PID 2724 wrote to memory of 2736 2724 innqsrkjz.exe 33 PID 2724 wrote to memory of 2736 2724 innqsrkjz.exe 33 PID 2724 wrote to memory of 2736 2724 innqsrkjz.exe 33 PID 2736 wrote to memory of 2292 2736 inyufnzuj.exe 34 PID 2736 wrote to memory of 2292 2736 inyufnzuj.exe 34 PID 2736 wrote to memory of 2292 2736 inyufnzuj.exe 34 PID 2736 wrote to memory of 2292 2736 inyufnzuj.exe 34 PID 2736 wrote to memory of 2292 2736 inyufnzuj.exe 34 PID 2736 wrote to memory of 2292 2736 inyufnzuj.exe 34 PID 2736 wrote to memory of 2292 2736 inyufnzuj.exe 34 PID 2292 wrote to memory of 2744 2292 indwztgsi.exe 35 PID 2292 wrote to memory of 2744 2292 indwztgsi.exe 35 PID 2292 wrote to memory of 2744 2292 indwztgsi.exe 35 PID 2292 wrote to memory of 2744 2292 indwztgsi.exe 35 PID 2292 wrote to memory of 2744 2292 indwztgsi.exe 35 PID 2292 wrote to memory of 2744 2292 indwztgsi.exe 35 PID 2292 wrote to memory of 2744 2292 indwztgsi.exe 35 PID 2744 wrote to memory of 1424 2744 ingvnhoze.exe 36 PID 2744 wrote to memory of 1424 2744 ingvnhoze.exe 36 PID 2744 wrote to memory of 1424 2744 ingvnhoze.exe 36 PID 2744 wrote to memory of 1424 2744 ingvnhoze.exe 36 PID 2744 wrote to memory of 1424 2744 ingvnhoze.exe 36 PID 2744 wrote to memory of 1424 2744 ingvnhoze.exe 36 PID 2744 wrote to memory of 1424 2744 ingvnhoze.exe 36 PID 1424 wrote to memory of 1756 1424 inbuxzyre.exe 37 PID 1424 wrote to memory of 1756 1424 inbuxzyre.exe 37 PID 1424 wrote to memory of 1756 1424 inbuxzyre.exe 37 PID 1424 wrote to memory of 1756 1424 inbuxzyre.exe 37 PID 1424 wrote to memory of 1756 1424 inbuxzyre.exe 37 PID 1424 wrote to memory of 1756 1424 inbuxzyre.exe 37 PID 1424 wrote to memory of 1756 1424 inbuxzyre.exe 37 PID 1756 wrote to memory of 316 1756 inortslka.exe 38 PID 1756 wrote to memory of 316 1756 inortslka.exe 38 PID 1756 wrote to memory of 316 1756 inortslka.exe 38 PID 1756 wrote to memory of 316 1756 inortslka.exe 38 PID 1756 wrote to memory of 316 1756 inortslka.exe 38 PID 1756 wrote to memory of 316 1756 inortslka.exe 38 PID 1756 wrote to memory of 316 1756 inortslka.exe 38 PID 316 wrote to memory of 2352 316 inqtvunam.exe 39 PID 316 wrote to memory of 2352 316 inqtvunam.exe 39 PID 316 wrote to memory of 2352 316 inqtvunam.exe 39 PID 316 wrote to memory of 2352 316 inqtvunam.exe 39 PID 316 wrote to memory of 2352 316 inqtvunam.exe 39 PID 316 wrote to memory of 2352 316 inqtvunam.exe 39 PID 316 wrote to memory of 2352 316 inqtvunam.exe 39 PID 2352 wrote to memory of 1564 2352 insezthji.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe"C:\Users\Admin\AppData\Local\Temp\53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1564 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:564 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:556 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1572 -
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2236 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe16⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2792 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2828 -
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe18⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2604 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2564 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe20⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1716 -
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1920 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe22⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:284 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2212 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe24⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2540 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3012 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe26⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1952 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2084 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe28⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:280 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2272 -
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe30⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180 -
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2164 -
C:\Windows\SysWOW64\incraptug.exeC:\Windows\system32\incraptug.exe32⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2708 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe34⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712 -
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2620 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe36⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2032 -
C:\Windows\SysWOW64\inasgqvzt.exeC:\Windows\system32\inasgqvzt.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2888 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe38⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2940 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2964 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe40⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1424 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1776 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe42⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1980 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:680 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe44⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:396 -
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe46⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2452 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe48⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:376 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe50⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904 -
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe56⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1280 -
C:\Windows\SysWOW64\inpfzcyeq.exeC:\Windows\system32\inpfzcyeq.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2964 -
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe58⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe60⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1608 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe62⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504 -
C:\Windows\SysWOW64\inmkxopbr.exeC:\Windows\system32\inmkxopbr.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1264 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe64⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1656 -
C:\Windows\SysWOW64\indrzpldy.exeC:\Windows\system32\indrzpldy.exe65⤵
- Executes dropped EXE
PID:2800 -
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\system32\ingerepgv.exe66⤵PID:2224
-
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe67⤵PID:2812
-
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe68⤵PID:2448
-
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe69⤵PID:2600
-
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\system32\inxsdoolp.exe70⤵PID:2656
-
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe71⤵PID:1996
-
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe72⤵PID:2924
-
C:\Windows\SysWOW64\ineqbmfxl.exeC:\Windows\system32\ineqbmfxl.exe73⤵PID:528
-
C:\Windows\SysWOW64\innoddvuk.exeC:\Windows\system32\innoddvuk.exe74⤵PID:2012
-
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe75⤵PID:1592
-
C:\Windows\SysWOW64\inhjvjvge.exeC:\Windows\system32\inhjvjvge.exe76⤵PID:2444
-
C:\Windows\SysWOW64\inxrqyyst.exeC:\Windows\system32\inxrqyyst.exe77⤵PID:2440
-
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe78⤵PID:2500
-
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe79⤵PID:2492
-
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe80⤵PID:2132
-
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe81⤵PID:1584
-
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe82⤵PID:2188
-
C:\Windows\SysWOW64\inftrnfcc.exeC:\Windows\system32\inftrnfcc.exe83⤵PID:2676
-
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe84⤵PID:2764
-
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe85⤵PID:2816
-
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe86⤵PID:744
-
C:\Windows\SysWOW64\inyegrpfl.exeC:\Windows\system32\inyegrpfl.exe87⤵PID:2724
-
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe88⤵PID:2760
-
C:\Windows\SysWOW64\inaivxrqr.exeC:\Windows\system32\inaivxrqr.exe89⤵PID:1900
-
C:\Windows\SysWOW64\incvdypdo.exeC:\Windows\system32\incvdypdo.exe90⤵PID:2916
-
C:\Windows\SysWOW64\inuinrlrc.exeC:\Windows\system32\inuinrlrc.exe91⤵PID:1616
-
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe92⤵PID:2296
-
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe93⤵PID:1304
-
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe94⤵PID:1460
-
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe95⤵PID:1756
-
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe96⤵PID:948
-
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe97⤵PID:828
-
C:\Windows\SysWOW64\inbjwysrs.exeC:\Windows\system32\inbjwysrs.exe98⤵PID:2180
-
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe99⤵PID:2084
-
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe100⤵PID:2340
-
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\system32\inahuhbcs.exe101⤵PID:564
-
C:\Windows\SysWOW64\inhwfuyzl.exeC:\Windows\system32\inhwfuyzl.exe102⤵PID:2156
-
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe103⤵PID:1548
-
C:\Windows\SysWOW64\inzkzjyci.exeC:\Windows\system32\inzkzjyci.exe104⤵PID:2784
-
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\system32\inxnqhgoo.exe105⤵PID:3032
-
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe106⤵PID:2832
-
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe107⤵PID:444
-
C:\Windows\SysWOW64\inmxiifwj.exeC:\Windows\system32\inmxiifwj.exe108⤵PID:2572
-
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe109⤵PID:2564
-
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe110⤵PID:2600
-
C:\Windows\SysWOW64\inkivmnpx.exeC:\Windows\system32\inkivmnpx.exe111⤵PID:1144
-
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe112⤵PID:1256
-
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe113⤵PID:1792
-
C:\Windows\SysWOW64\inaaajueu.exeC:\Windows\system32\inaaajueu.exe114⤵PID:2972
-
C:\Windows\SysWOW64\indwezqep.exeC:\Windows\system32\indwezqep.exe115⤵PID:1424
-
C:\Windows\SysWOW64\inlvjosms.exeC:\Windows\system32\inlvjosms.exe116⤵PID:1932
-
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe117⤵PID:2992
-
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe118⤵PID:1772
-
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe119⤵PID:2128
-
C:\Windows\SysWOW64\invbdruwx.exeC:\Windows\system32\invbdruwx.exe120⤵PID:2304
-
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe121⤵PID:1008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-