Overview
overview
10Static
static
10[DemonArch...fb.exe
windows7-x64
1[DemonArch...4e.exe
windows7-x64
7[DemonArch...86.exe
windows7-x64
[DemonArch...1e.exe
windows7-x64
10[DemonArch...a6.exe
windows7-x64
7[DemonArch...a8.exe
windows7-x64
1[DemonArch...4b.exe
windows7-x64
3[DemonArch...6b.dll
windows7-x64
1[DemonArch...23.exe
windows7-x64
8[DemonArch...38.exe
windows7-x64
10[DemonArch...94.exe
windows7-x64
10[DemonArch...03.exe
windows7-x64
5[DemonArch...96.exe
windows7-x64
10[DemonArch...f0.dll
windows7-x64
3[DemonArch...4c.exe
windows7-x64
10[DemonArch...b3.exe
windows7-x64
1[DemonArch...44.exe
windows7-x64
[DemonArch...13.exe
windows7-x64
1[DemonArch...22.exe
windows7-x64
10[DemonArch...7e.exe
windows7-x64
1[DemonArch...73.exe
windows7-x64
10[DemonArch...94.exe
windows7-x64
10[DemonArch...f6.exe
windows7-x64
[DemonArch...b6.exe
windows7-x64
1[DemonArch...84.exe
windows7-x64
1[DemonArch...a0.exe
windows7-x64
10[DemonArch...9e.exe
windows7-x64
[DemonArch...f2.exe
windows7-x64
[DemonArch...f4.exe
windows7-x64
3[DemonArch...c8.dll
windows7-x64
1[DemonArch...85.dll
windows7-x64
10[DemonArch...71.exe
windows7-x64
Analysis
-
max time kernel
10s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
04-07-2024 17:19
Behavioral task
behavioral1
Sample
[DemonArchives]560184b003e9c461fdfa4ab15cd3b6fb.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
[DemonArchives]58b00f133ec3b7efa68faf94233d594e.exe
Resource
win7-20240611-en
Behavioral task
behavioral3
Sample
[DemonArchives]627ba000cff6d43aa031da4020d15186.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
[DemonArchives]68d0fb679004d3c27c9efa840010881e.exe
Resource
win7-20240611-en
Behavioral task
behavioral5
Sample
[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
[DemonArchives]6bc2fcef470b064c9bd339c7e2553ea8.exe
Resource
win7-20231129-en
Behavioral task
behavioral7
Sample
[DemonArchives]6bf80d8b5b235df5efb621da1dd61b4b.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
[DemonArchives]6e102d15d6af7c43d43141e9d2a1206b.dll
Resource
win7-20240611-en
Behavioral task
behavioral9
Sample
[DemonArchives]6e4f9763c17ea31c3d1406eabd7db423.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
[DemonArchives]720d7d1deff763aee99bcc266f96b238.exe
Resource
win7-20240611-en
Behavioral task
behavioral11
Sample
[DemonArchives]7a8bde6d1942443bdbf09e610eb1b794.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
[DemonArchives]7da028810a703bb926d39a9b4ba50703.exe
Resource
win7-20231129-en
Behavioral task
behavioral13
Sample
[DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
[DemonArchives]81759dd56bd4387d02cb20d44422c8f0.dll
Resource
win7-20240419-en
Behavioral task
behavioral15
Sample
[DemonArchives]853a559e0dcb25ab9605685ec776224c.exe
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
[DemonArchives]887a4917f4af1126d489a4f4d56b2eb3.exe
Resource
win7-20240508-en
Behavioral task
behavioral17
Sample
[DemonArchives]8edcc9bf66c21c55cf482dcac1c18c44.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
[DemonArchives]973465ab358797d8d056e4f04bda2513.exe
Resource
win7-20240221-en
Behavioral task
behavioral19
Sample
[DemonArchives]9a6f31f789128531e4c714e44915f822.exe
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
[DemonArchives]9afac07fd6517652d6e659963db8b87e.exe
Resource
win7-20240611-en
Behavioral task
behavioral21
Sample
[DemonArchives]a367e7069b0df249dbcd93f02f05a573.exe
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
[DemonArchives]a410ac0c141ebeb019661a692020fb94.exe
Resource
win7-20240419-en
Behavioral task
behavioral23
Sample
[DemonArchives]a62aacc19cac89138571eec242bcd4f6.exe
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
[DemonArchives]a7f2bf63baba5ffe2b5e76ab67d25bb6.exe
Resource
win7-20231129-en
Behavioral task
behavioral25
Sample
[DemonArchives]a9ea383aca2b60aece3a27c899e3f784.exe
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
[DemonArchives]ad9972de71fbca864e9303a043d203a0.exe
Resource
win7-20240221-en
Behavioral task
behavioral27
Sample
[DemonArchives]adefb3d586e8f74af30155d21ac5fc9e.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
[DemonArchives]b00c6b1b2a79fc9c57f97d16d58d00f2.exe
Resource
win7-20240220-en
Behavioral task
behavioral29
Sample
[DemonArchives]b2d7c4f62aa3abc7e398981d5c280af4.exe
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
[DemonArchives]c30111080c9e6acc70dd86ff97188ac8.dll
Resource
win7-20240419-en
Behavioral task
behavioral31
Sample
[DemonArchives]ddc0d08019efa4cc5f2a39de99cc0a85.dll
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
[DemonArchives]e28fe1917c5ffe9a3062ee369087f971.exe
Resource
win7-20240221-en
General
-
Target
[DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe
-
Size
3.0MB
-
MD5
7e020e96f43c40b26aa7f880ad0f8a96
-
SHA1
aa5b15e6fefc819a061b27be11002eecf4d2e018
-
SHA256
6ce3e78e052fea66207749cf98376e2ff2ba7e8191a2efbdde6a9614722bda6f
-
SHA512
efa3ff506eea68013933164d977b3e6836a6983dbda8c742e96c6379b96d4af05f38c45d01ffd4f817c7b7d010ac8eb42794a574d4128478811072a553e0c17a
-
SSDEEP
49152:SANMxixIxIxIxixIxsxIxixIxlHxIxixIxsxIxixIxIxIxixIxsxIxixIx:HMxixIxIxIxixIxsxIxixIxlHxIxixIT
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dpcjnabn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad [DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" [DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpcjnabn.exe -
Executes dropped EXE 2 IoCs
pid Process 2668 Dpcjnabn.exe 2680 Domqjm32.exe -
Loads dropped DLL 4 IoCs
pid Process 1540 [DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe 1540 [DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe 2668 Dpcjnabn.exe 2668 Dpcjnabn.exe -
Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Dpcjnabn.exe [DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe File created C:\Windows\SysWOW64\Bpgcnh32.dll [DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe File created C:\Windows\SysWOW64\Domqjm32.exe Dpcjnabn.exe File opened for modification C:\Windows\SysWOW64\Domqjm32.exe Dpcjnabn.exe File created C:\Windows\SysWOW64\Dbcflk32.dll Dpcjnabn.exe File created C:\Windows\SysWOW64\Ejmhkiig.exe Domqjm32.exe File opened for modification C:\Windows\SysWOW64\Ejmhkiig.exe Domqjm32.exe File created C:\Windows\SysWOW64\Dpcjnabn.exe [DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 928 3528 WerFault.exe 410 -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node [DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dpcjnabn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbcflk32.dll" Dpcjnabn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 [DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID [DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} [DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpgcnh32.dll" [DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" [DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dpcjnabn.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1540 wrote to memory of 2668 1540 [DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe 28 PID 1540 wrote to memory of 2668 1540 [DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe 28 PID 1540 wrote to memory of 2668 1540 [DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe 28 PID 1540 wrote to memory of 2668 1540 [DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe 28 PID 2668 wrote to memory of 2680 2668 Dpcjnabn.exe 376 PID 2668 wrote to memory of 2680 2668 Dpcjnabn.exe 376 PID 2668 wrote to memory of 2680 2668 Dpcjnabn.exe 376 PID 2668 wrote to memory of 2680 2668 Dpcjnabn.exe 376
Processes
-
C:\Users\Admin\AppData\Local\Temp\[DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe"C:\Users\Admin\AppData\Local\Temp\[DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\Dpcjnabn.exeC:\Windows\system32\Dpcjnabn.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\Domqjm32.exeC:\Windows\system32\Domqjm32.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2680 -
C:\Windows\SysWOW64\Ejmhkiig.exeC:\Windows\system32\Ejmhkiig.exe4⤵PID:2724
-
C:\Windows\SysWOW64\Fgcejm32.exeC:\Windows\system32\Fgcejm32.exe5⤵PID:2728
-
C:\Windows\SysWOW64\Fnfcel32.exeC:\Windows\system32\Fnfcel32.exe6⤵PID:2528
-
C:\Windows\SysWOW64\Fdbhge32.exeC:\Windows\system32\Fdbhge32.exe7⤵PID:2460
-
C:\Windows\SysWOW64\Gcahoqhf.exeC:\Windows\system32\Gcahoqhf.exe8⤵PID:2784
-
C:\Windows\SysWOW64\Hmjlhfof.exeC:\Windows\system32\Hmjlhfof.exe9⤵PID:2876
-
C:\Windows\SysWOW64\Kcmcoblm.exeC:\Windows\system32\Kcmcoblm.exe10⤵PID:532
-
C:\Windows\SysWOW64\Palepb32.exeC:\Windows\system32\Palepb32.exe11⤵PID:1456
-
C:\Windows\SysWOW64\Qfljkp32.exeC:\Windows\system32\Qfljkp32.exe12⤵PID:1272
-
C:\Windows\SysWOW64\Ackmih32.exeC:\Windows\system32\Ackmih32.exe13⤵PID:528
-
C:\Windows\SysWOW64\Aqonbm32.exeC:\Windows\system32\Aqonbm32.exe14⤵PID:2040
-
C:\Windows\SysWOW64\Ccbphk32.exeC:\Windows\system32\Ccbphk32.exe15⤵PID:2076
-
C:\Windows\SysWOW64\Dafmqb32.exeC:\Windows\system32\Dafmqb32.exe16⤵PID:2148
-
C:\Windows\SysWOW64\Dgbeiiqe.exeC:\Windows\system32\Dgbeiiqe.exe17⤵PID:2248
-
C:\Windows\SysWOW64\Ddfebnoo.exeC:\Windows\system32\Ddfebnoo.exe18⤵PID:2016
-
C:\Windows\SysWOW64\Epmfgo32.exeC:\Windows\system32\Epmfgo32.exe19⤵PID:1248
-
C:\Windows\SysWOW64\Emagacdm.exeC:\Windows\system32\Emagacdm.exe20⤵PID:932
-
C:\Windows\SysWOW64\Eihgfd32.exeC:\Windows\system32\Eihgfd32.exe21⤵PID:1632
-
C:\Windows\SysWOW64\Ehmdgp32.exeC:\Windows\system32\Ehmdgp32.exe22⤵PID:236
-
C:\Windows\SysWOW64\Ehpalp32.exeC:\Windows\system32\Ehpalp32.exe23⤵PID:876
-
C:\Windows\SysWOW64\Fkpjnkig.exeC:\Windows\system32\Fkpjnkig.exe24⤵PID:2052
-
C:\Windows\SysWOW64\Fnacpffh.exeC:\Windows\system32\Fnacpffh.exe25⤵PID:2564
-
C:\Windows\SysWOW64\Flfpabkp.exeC:\Windows\system32\Flfpabkp.exe26⤵PID:300
-
C:\Windows\SysWOW64\Fogibnha.exeC:\Windows\system32\Fogibnha.exe27⤵PID:2240
-
C:\Windows\SysWOW64\Fhomkcoa.exeC:\Windows\system32\Fhomkcoa.exe28⤵PID:360
-
C:\Windows\SysWOW64\Gceailog.exeC:\Windows\system32\Gceailog.exe29⤵PID:1764
-
C:\Windows\SysWOW64\Gmmfaa32.exeC:\Windows\system32\Gmmfaa32.exe30⤵PID:1592
-
C:\Windows\SysWOW64\Gfejjgli.exeC:\Windows\system32\Gfejjgli.exe31⤵PID:2180
-
C:\Windows\SysWOW64\Gkbcbn32.exeC:\Windows\system32\Gkbcbn32.exe32⤵PID:2676
-
C:\Windows\SysWOW64\Gfhgpg32.exeC:\Windows\system32\Gfhgpg32.exe33⤵PID:2892
-
C:\Windows\SysWOW64\Gkephn32.exeC:\Windows\system32\Gkephn32.exe34⤵PID:2488
-
C:\Windows\SysWOW64\Gqahqd32.exeC:\Windows\system32\Gqahqd32.exe35⤵PID:2204
-
C:\Windows\SysWOW64\Gkglnm32.exeC:\Windows\system32\Gkglnm32.exe36⤵PID:3020
-
C:\Windows\SysWOW64\Gqdefddb.exeC:\Windows\system32\Gqdefddb.exe37⤵PID:2656
-
C:\Windows\SysWOW64\Ggnmbn32.exeC:\Windows\system32\Ggnmbn32.exe38⤵PID:936
-
C:\Windows\SysWOW64\Hmkeke32.exeC:\Windows\system32\Hmkeke32.exe39⤵PID:1332
-
C:\Windows\SysWOW64\Hfcjdkpg.exeC:\Windows\system32\Hfcjdkpg.exe40⤵PID:1996
-
C:\Windows\SysWOW64\Hahnac32.exeC:\Windows\system32\Hahnac32.exe41⤵PID:1612
-
C:\Windows\SysWOW64\Hfegij32.exeC:\Windows\system32\Hfegij32.exe42⤵PID:2684
-
C:\Windows\SysWOW64\Hakkgc32.exeC:\Windows\system32\Hakkgc32.exe43⤵PID:616
-
C:\Windows\SysWOW64\Hfhcoj32.exeC:\Windows\system32\Hfhcoj32.exe44⤵PID:556
-
C:\Windows\SysWOW64\Hmalldcn.exeC:\Windows\system32\Hmalldcn.exe45⤵PID:2984
-
C:\Windows\SysWOW64\Hboddk32.exeC:\Windows\system32\Hboddk32.exe46⤵PID:264
-
C:\Windows\SysWOW64\Hihlqeib.exeC:\Windows\system32\Hihlqeib.exe47⤵PID:1044
-
C:\Windows\SysWOW64\Hbaaik32.exeC:\Windows\system32\Hbaaik32.exe48⤵PID:3016
-
C:\Windows\SysWOW64\Iikifegp.exeC:\Windows\system32\Iikifegp.exe49⤵PID:2096
-
C:\Windows\SysWOW64\Inhanl32.exeC:\Windows\system32\Inhanl32.exe50⤵PID:2268
-
C:\Windows\SysWOW64\Ieajkfmd.exeC:\Windows\system32\Ieajkfmd.exe51⤵PID:2280
-
C:\Windows\SysWOW64\Ijnbcmkk.exeC:\Windows\system32\Ijnbcmkk.exe52⤵PID:2944
-
C:\Windows\SysWOW64\Iedfqeka.exeC:\Windows\system32\Iedfqeka.exe53⤵PID:1208
-
C:\Windows\SysWOW64\Ijqoilii.exeC:\Windows\system32\Ijqoilii.exe54⤵PID:796
-
C:\Windows\SysWOW64\Idicbbpi.exeC:\Windows\system32\Idicbbpi.exe55⤵PID:2448
-
C:\Windows\SysWOW64\Ijclol32.exeC:\Windows\system32\Ijclol32.exe56⤵PID:696
-
C:\Windows\SysWOW64\Idkpganf.exeC:\Windows\system32\Idkpganf.exe57⤵PID:1720
-
C:\Windows\SysWOW64\Jmdepg32.exeC:\Windows\system32\Jmdepg32.exe58⤵PID:1124
-
C:\Windows\SysWOW64\Jdnmma32.exeC:\Windows\system32\Jdnmma32.exe59⤵PID:2388
-
C:\Windows\SysWOW64\Jikeeh32.exeC:\Windows\system32\Jikeeh32.exe60⤵PID:2672
-
C:\Windows\SysWOW64\Jpdnbbah.exeC:\Windows\system32\Jpdnbbah.exe61⤵PID:2708
-
C:\Windows\SysWOW64\Jeafjiop.exeC:\Windows\system32\Jeafjiop.exe62⤵PID:1576
-
C:\Windows\SysWOW64\Jpgjgboe.exeC:\Windows\system32\Jpgjgboe.exe63⤵PID:2636
-
C:\Windows\SysWOW64\Jgabdlfb.exeC:\Windows\system32\Jgabdlfb.exe64⤵PID:680
-
C:\Windows\SysWOW64\Jhbold32.exeC:\Windows\system32\Jhbold32.exe65⤵PID:2816
-
C:\Windows\SysWOW64\Jajcdjca.exeC:\Windows\system32\Jajcdjca.exe66⤵PID:2548
-
C:\Windows\SysWOW64\Jhdlad32.exeC:\Windows\system32\Jhdlad32.exe67⤵PID:2704
-
C:\Windows\SysWOW64\Jampjian.exeC:\Windows\system32\Jampjian.exe68⤵PID:1444
-
C:\Windows\SysWOW64\Khghgchk.exeC:\Windows\system32\Khghgchk.exe69⤵PID:1204
-
C:\Windows\SysWOW64\Kncaojfb.exeC:\Windows\system32\Kncaojfb.exe70⤵PID:1180
-
C:\Windows\SysWOW64\Kdnild32.exeC:\Windows\system32\Kdnild32.exe71⤵PID:2032
-
C:\Windows\SysWOW64\Kocmim32.exeC:\Windows\system32\Kocmim32.exe72⤵PID:1660
-
C:\Windows\SysWOW64\Kpdjaecc.exeC:\Windows\system32\Kpdjaecc.exe73⤵PID:820
-
C:\Windows\SysWOW64\Kjmnjkjd.exeC:\Windows\system32\Kjmnjkjd.exe74⤵PID:2116
-
C:\Windows\SysWOW64\Kpgffe32.exeC:\Windows\system32\Kpgffe32.exe75⤵PID:1544
-
C:\Windows\SysWOW64\Kklkcn32.exeC:\Windows\system32\Kklkcn32.exe76⤵PID:1740
-
C:\Windows\SysWOW64\Klngkfge.exeC:\Windows\system32\Klngkfge.exe77⤵PID:1288
-
C:\Windows\SysWOW64\Kffldlne.exeC:\Windows\system32\Kffldlne.exe78⤵PID:1688
-
C:\Windows\SysWOW64\Klpdaf32.exeC:\Windows\system32\Klpdaf32.exe79⤵PID:2024
-
C:\Windows\SysWOW64\Lgehno32.exeC:\Windows\system32\Lgehno32.exe80⤵PID:1580
-
C:\Windows\SysWOW64\Lpnmgdli.exeC:\Windows\system32\Lpnmgdli.exe81⤵PID:2580
-
C:\Windows\SysWOW64\Lhiakf32.exeC:\Windows\system32\Lhiakf32.exe82⤵PID:2496
-
C:\Windows\SysWOW64\Lcofio32.exeC:\Windows\system32\Lcofio32.exe83⤵PID:2556
-
C:\Windows\SysWOW64\Lhknaf32.exeC:\Windows\system32\Lhknaf32.exe84⤵PID:2820
-
C:\Windows\SysWOW64\Loefnpnn.exeC:\Windows\system32\Loefnpnn.exe85⤵PID:2932
-
C:\Windows\SysWOW64\Lfoojj32.exeC:\Windows\system32\Lfoojj32.exe86⤵PID:1604
-
C:\Windows\SysWOW64\Lohccp32.exeC:\Windows\system32\Lohccp32.exe87⤵PID:3004
-
C:\Windows\SysWOW64\Lhpglecl.exeC:\Windows\system32\Lhpglecl.exe88⤵PID:2752
-
C:\Windows\SysWOW64\Mjaddn32.exeC:\Windows\system32\Mjaddn32.exe89⤵PID:2700
-
C:\Windows\SysWOW64\Mqklqhpg.exeC:\Windows\system32\Mqklqhpg.exe90⤵PID:3012
-
C:\Windows\SysWOW64\Mgedmb32.exeC:\Windows\system32\Mgedmb32.exe91⤵PID:2284
-
C:\Windows\SysWOW64\Mmbmeifk.exeC:\Windows\system32\Mmbmeifk.exe92⤵PID:1736
-
C:\Windows\SysWOW64\Mfjann32.exeC:\Windows\system32\Mfjann32.exe93⤵PID:2764
-
C:\Windows\SysWOW64\Mqpflg32.exeC:\Windows\system32\Mqpflg32.exe94⤵PID:1776
-
C:\Windows\SysWOW64\Mfmndn32.exeC:\Windows\system32\Mfmndn32.exe95⤵PID:2004
-
C:\Windows\SysWOW64\Mmgfqh32.exeC:\Windows\system32\Mmgfqh32.exe96⤵PID:2744
-
C:\Windows\SysWOW64\Mbcoio32.exeC:\Windows\system32\Mbcoio32.exe97⤵PID:1108
-
C:\Windows\SysWOW64\Mimgeigj.exeC:\Windows\system32\Mimgeigj.exe98⤵PID:2848
-
C:\Windows\SysWOW64\Mcckcbgp.exeC:\Windows\system32\Mcckcbgp.exe99⤵PID:744
-
C:\Windows\SysWOW64\Nedhjj32.exeC:\Windows\system32\Nedhjj32.exe100⤵PID:2896
-
C:\Windows\SysWOW64\Npjlhcmd.exeC:\Windows\system32\Npjlhcmd.exe101⤵PID:2396
-
C:\Windows\SysWOW64\Nfdddm32.exeC:\Windows\system32\Nfdddm32.exe102⤵PID:392
-
C:\Windows\SysWOW64\Ngealejo.exeC:\Windows\system32\Ngealejo.exe103⤵PID:2080
-
C:\Windows\SysWOW64\Nbjeinje.exeC:\Windows\system32\Nbjeinje.exe104⤵PID:2956
-
C:\Windows\SysWOW64\Nhgnaehm.exeC:\Windows\system32\Nhgnaehm.exe105⤵PID:3056
-
C:\Windows\SysWOW64\Nbmaon32.exeC:\Windows\system32\Nbmaon32.exe106⤵PID:2620
-
C:\Windows\SysWOW64\Neknki32.exeC:\Windows\system32\Neknki32.exe107⤵PID:2480
-
C:\Windows\SysWOW64\Njhfcp32.exeC:\Windows\system32\Njhfcp32.exe108⤵PID:2340
-
C:\Windows\SysWOW64\Nabopjmj.exeC:\Windows\system32\Nabopjmj.exe109⤵PID:3084
-
C:\Windows\SysWOW64\Nhlgmd32.exeC:\Windows\system32\Nhlgmd32.exe110⤵PID:3124
-
C:\Windows\SysWOW64\Onfoin32.exeC:\Windows\system32\Onfoin32.exe111⤵PID:3164
-
C:\Windows\SysWOW64\Odchbe32.exeC:\Windows\system32\Odchbe32.exe112⤵PID:3204
-
C:\Windows\SysWOW64\Oippjl32.exeC:\Windows\system32\Oippjl32.exe113⤵PID:3244
-
C:\Windows\SysWOW64\Odedge32.exeC:\Windows\system32\Odedge32.exe114⤵PID:3284
-
C:\Windows\SysWOW64\Oibmpl32.exeC:\Windows\system32\Oibmpl32.exe115⤵PID:3324
-
C:\Windows\SysWOW64\Oplelf32.exeC:\Windows\system32\Oplelf32.exe116⤵PID:3364
-
C:\Windows\SysWOW64\Oidiekdn.exeC:\Windows\system32\Oidiekdn.exe117⤵PID:3404
-
C:\Windows\SysWOW64\Opnbbe32.exeC:\Windows\system32\Opnbbe32.exe118⤵PID:3444
-
C:\Windows\SysWOW64\Oiffkkbk.exeC:\Windows\system32\Oiffkkbk.exe119⤵PID:3484
-
C:\Windows\SysWOW64\Oococb32.exeC:\Windows\system32\Oococb32.exe120⤵PID:3524
-
C:\Windows\SysWOW64\Oemgplgo.exeC:\Windows\system32\Oemgplgo.exe121⤵PID:3564
-
C:\Windows\SysWOW64\Plgolf32.exeC:\Windows\system32\Plgolf32.exe122⤵PID:3604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-