Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 15:42
Static task
static1
Behavioral task
behavioral1
Sample
b51110921b9aef0cdd27185abab2552d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b51110921b9aef0cdd27185abab2552d.exe
Resource
win10v2004-20240226-en
General
-
Target
b51110921b9aef0cdd27185abab2552d.exe
-
Size
609KB
-
MD5
b51110921b9aef0cdd27185abab2552d
-
SHA1
11d86cc07fc330b889478ad9da1c789222708131
-
SHA256
e539dbd7601cef1ef9c552077b228c0b698d426d2d9fc2be4d2d41b4df328d31
-
SHA512
edef1bf3f2a8135a599231d5c18cf060ccd7c5970b74566cd5da56b8d462ba54c23b0a3de3d0aed26315e2479c118e1aadc2f48706efbb130d19a9264599d408
-
SSDEEP
12288:NXWkRjK3nC4lLMrL0Nh4eoj1mliehPWWkHvGdmpnOCRZDA95lv7Oc1AifYJF:N1jKFBojshxe0Gtgag+F
Malware Config
Signatures
-
Executes dropped EXE 10 IoCs
pid Process 752 svchost.exe 3036 svchost.exe 692 svchost.exe 4384 svchost.exe 2800 svchost.exe 3128 svchost.exe 3652 svchost.exe 1752 svchost.exe 332 svchost.exe 2248 svchost.exe -
Loads dropped DLL 11 IoCs
pid Process 3176 b51110921b9aef0cdd27185abab2552d.exe 752 svchost.exe 3036 svchost.exe 692 svchost.exe 4384 svchost.exe 2800 svchost.exe 3128 svchost.exe 3652 svchost.exe 1752 svchost.exe 332 svchost.exe 2248 svchost.exe -
Drops file in System32 directory 33 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\25321 svchost.exe File created C:\Windows\SysWOW64\25321\AntiOpenProcess.dll b51110921b9aef0cdd27185abab2552d.exe File created C:\Windows\SysWOW64\25321\svchost.exe svchost.exe File opened for modification C:\Windows\SysWOW64\25321\AntiOpenProcess.dll svchost.exe File opened for modification C:\Windows\SysWOW64\25321\AntiOpenProcess.dll svchost.exe File opened for modification C:\Windows\SysWOW64\25321\AntiOpenProcess.dll svchost.exe File opened for modification C:\Windows\SysWOW64\25321 b51110921b9aef0cdd27185abab2552d.exe File opened for modification C:\Windows\SysWOW64\25321 svchost.exe File created C:\Windows\SysWOW64\25321\svchost.exe svchost.exe File created C:\Windows\SysWOW64\25321\svchost.exe svchost.exe File opened for modification C:\Windows\SysWOW64\25321 svchost.exe File opened for modification C:\Windows\SysWOW64\25321 svchost.exe File opened for modification C:\Windows\SysWOW64\25321\AntiOpenProcess.dll svchost.exe File opened for modification C:\Windows\SysWOW64\25321 svchost.exe File created C:\Windows\SysWOW64\25321\svchost.exe svchost.exe File opened for modification C:\Windows\SysWOW64\25321 svchost.exe File created C:\Windows\SysWOW64\25321\svchost.exe svchost.exe File opened for modification C:\Windows\SysWOW64\25321\svchost.exe b51110921b9aef0cdd27185abab2552d.exe File opened for modification C:\Windows\SysWOW64\25321 svchost.exe File opened for modification C:\Windows\SysWOW64\25321\AntiOpenProcess.dll svchost.exe File created C:\Windows\SysWOW64\25321\svchost.exe svchost.exe File opened for modification C:\Windows\SysWOW64\25321\AntiOpenProcess.dll svchost.exe File opened for modification C:\Windows\SysWOW64\25321\AntiOpenProcess.dll svchost.exe File opened for modification C:\Windows\SysWOW64\25321 svchost.exe File created C:\Windows\SysWOW64\25321\svchost.exe svchost.exe File created C:\Windows\SysWOW64\25321\tem.vbs svchost.exe File opened for modification C:\Windows\SysWOW64\25321\tem.vbs svchost.exe File opened for modification C:\Windows\SysWOW64\25321\AntiOpenProcess.dll svchost.exe File created C:\Windows\SysWOW64\25321\svchost.exe svchost.exe File created C:\Windows\SysWOW64\25321\svchost.exe svchost.exe File opened for modification C:\Windows\SysWOW64\25321\AntiOpenProcess.dll svchost.exe File created C:\Windows\SysWOW64\25321\svchost.exe b51110921b9aef0cdd27185abab2552d.exe File opened for modification C:\Windows\SysWOW64\25321 svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3176 b51110921b9aef0cdd27185abab2552d.exe 3176 b51110921b9aef0cdd27185abab2552d.exe 3176 b51110921b9aef0cdd27185abab2552d.exe 3176 b51110921b9aef0cdd27185abab2552d.exe 3176 b51110921b9aef0cdd27185abab2552d.exe 3176 b51110921b9aef0cdd27185abab2552d.exe 3176 b51110921b9aef0cdd27185abab2552d.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 3036 svchost.exe 3036 svchost.exe 3036 svchost.exe 3036 svchost.exe 3036 svchost.exe 3036 svchost.exe 3036 svchost.exe 692 svchost.exe 692 svchost.exe 692 svchost.exe 692 svchost.exe 692 svchost.exe 692 svchost.exe 692 svchost.exe 4384 svchost.exe 4384 svchost.exe 4384 svchost.exe 4384 svchost.exe 4384 svchost.exe 4384 svchost.exe 4384 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 3128 svchost.exe 3128 svchost.exe 3128 svchost.exe 3128 svchost.exe 3128 svchost.exe 3128 svchost.exe 3128 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 332 svchost.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3176 wrote to memory of 752 3176 b51110921b9aef0cdd27185abab2552d.exe 89 PID 3176 wrote to memory of 752 3176 b51110921b9aef0cdd27185abab2552d.exe 89 PID 3176 wrote to memory of 752 3176 b51110921b9aef0cdd27185abab2552d.exe 89 PID 752 wrote to memory of 3036 752 svchost.exe 90 PID 752 wrote to memory of 3036 752 svchost.exe 90 PID 752 wrote to memory of 3036 752 svchost.exe 90 PID 3036 wrote to memory of 692 3036 svchost.exe 91 PID 3036 wrote to memory of 692 3036 svchost.exe 91 PID 3036 wrote to memory of 692 3036 svchost.exe 91 PID 692 wrote to memory of 4384 692 svchost.exe 92 PID 692 wrote to memory of 4384 692 svchost.exe 92 PID 692 wrote to memory of 4384 692 svchost.exe 92 PID 4384 wrote to memory of 2800 4384 svchost.exe 94 PID 4384 wrote to memory of 2800 4384 svchost.exe 94 PID 4384 wrote to memory of 2800 4384 svchost.exe 94 PID 2800 wrote to memory of 3128 2800 svchost.exe 96 PID 2800 wrote to memory of 3128 2800 svchost.exe 96 PID 2800 wrote to memory of 3128 2800 svchost.exe 96 PID 3128 wrote to memory of 3652 3128 svchost.exe 97 PID 3128 wrote to memory of 3652 3128 svchost.exe 97 PID 3128 wrote to memory of 3652 3128 svchost.exe 97 PID 3652 wrote to memory of 1752 3652 svchost.exe 98 PID 3652 wrote to memory of 1752 3652 svchost.exe 98 PID 3652 wrote to memory of 1752 3652 svchost.exe 98 PID 1752 wrote to memory of 332 1752 svchost.exe 99 PID 1752 wrote to memory of 332 1752 svchost.exe 99 PID 1752 wrote to memory of 332 1752 svchost.exe 99 PID 332 wrote to memory of 2248 332 svchost.exe 100 PID 332 wrote to memory of 2248 332 svchost.exe 100 PID 332 wrote to memory of 2248 332 svchost.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\b51110921b9aef0cdd27185abab2552d.exe"C:\Users\Admin\AppData\Local\Temp\b51110921b9aef0cdd27185abab2552d.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe12⤵PID:1344
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe13⤵PID:3980
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe14⤵PID:2500
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe15⤵PID:3216
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe16⤵PID:4560
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe17⤵PID:1532
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe18⤵PID:652
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe19⤵PID:2324
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe20⤵PID:4880
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe21⤵PID:2304
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe22⤵PID:1828
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe23⤵PID:5016
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe24⤵PID:4872
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe25⤵PID:3420
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe26⤵PID:2088
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe27⤵PID:2596
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe28⤵PID:1488
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe29⤵PID:3616
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe30⤵PID:224
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe31⤵PID:436
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe32⤵PID:1776
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe33⤵PID:2620
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe34⤵PID:816
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe35⤵PID:3100
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe36⤵PID:4032
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe37⤵PID:4312
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe38⤵PID:3812
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe39⤵PID:1840
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe40⤵PID:2904
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe41⤵PID:3068
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe42⤵PID:4856
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe43⤵PID:1472
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe44⤵PID:3996
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe45⤵PID:3732
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe46⤵PID:1532
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe47⤵PID:3192
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe48⤵PID:1360
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe49⤵PID:5088
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe50⤵PID:5124
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe51⤵PID:5204
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe52⤵PID:5328
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe53⤵PID:5404
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe54⤵PID:5492
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe55⤵PID:5616
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe56⤵PID:5756
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe57⤵PID:5816
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe58⤵PID:5976
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe59⤵PID:6068
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe60⤵PID:4456
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe61⤵PID:4816
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe62⤵PID:5444
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe63⤵PID:1272
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe64⤵PID:4540
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe65⤵PID:3688
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe66⤵PID:3784
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe67⤵PID:4420
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe68⤵PID:6128
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe69⤵PID:3664
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe70⤵PID:5148
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe71⤵PID:5660
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe72⤵PID:5560
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe73⤵PID:5204
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe74⤵PID:5576
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe75⤵PID:5760
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe76⤵PID:6000
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe77⤵PID:2280
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe78⤵PID:6040
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe79⤵PID:6024
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe80⤵PID:5720
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe81⤵PID:5616
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe82⤵PID:5344
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe83⤵PID:5588
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe84⤵PID:5908
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe85⤵PID:5740
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe86⤵PID:5584
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe87⤵PID:6208
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe88⤵PID:6300
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe89⤵PID:6384
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe90⤵PID:6452
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe91⤵PID:6524
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe92⤵PID:6632
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe93⤵PID:6716
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe94⤵PID:6788
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe95⤵PID:6896
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe96⤵PID:7024
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe97⤵PID:3388
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe98⤵PID:6340
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe99⤵PID:6244
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe100⤵PID:6408
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe101⤵PID:6764
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe102⤵PID:7032
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe103⤵PID:6776
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe104⤵PID:6968
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe105⤵PID:7004
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe106⤵PID:7160
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe107⤵PID:6220
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe108⤵PID:6436
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe109⤵PID:1272
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe110⤵PID:3648
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe111⤵PID:6404
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe112⤵PID:6368
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe113⤵PID:5440
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe114⤵PID:6720
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe115⤵PID:6904
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe116⤵PID:5888
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe117⤵PID:3656
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe118⤵PID:4356
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe119⤵PID:6888
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe120⤵PID:6604
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe121⤵PID:4312
-
C:\Windows\SysWOW64\25321\svchost.exeC:\Windows\System32\25321\svchost.exe122⤵PID:6776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-