Overview
overview
10Static
static
10[DemonArch...fb.exe
windows7-x64
1[DemonArch...4e.exe
windows7-x64
7[DemonArch...86.exe
windows7-x64
[DemonArch...1e.exe
windows7-x64
10[DemonArch...a6.exe
windows7-x64
7[DemonArch...a8.exe
windows7-x64
1[DemonArch...4b.exe
windows7-x64
3[DemonArch...6b.dll
windows7-x64
1[DemonArch...23.exe
windows7-x64
8[DemonArch...38.exe
windows7-x64
10[DemonArch...94.exe
windows7-x64
10[DemonArch...03.exe
windows7-x64
5[DemonArch...96.exe
windows7-x64
10[DemonArch...f0.dll
windows7-x64
3[DemonArch...4c.exe
windows7-x64
10[DemonArch...b3.exe
windows7-x64
1[DemonArch...44.exe
windows7-x64
[DemonArch...13.exe
windows7-x64
1[DemonArch...22.exe
windows7-x64
10[DemonArch...7e.exe
windows7-x64
1[DemonArch...73.exe
windows7-x64
10[DemonArch...94.exe
windows7-x64
10[DemonArch...f6.exe
windows7-x64
[DemonArch...b6.exe
windows7-x64
1[DemonArch...84.exe
windows7-x64
1[DemonArch...a0.exe
windows7-x64
10[DemonArch...9e.exe
windows7-x64
[DemonArch...f2.exe
windows7-x64
[DemonArch...f4.exe
windows7-x64
3[DemonArch...c8.dll
windows7-x64
1[DemonArch...85.dll
windows7-x64
10[DemonArch...71.exe
windows7-x64
Analysis
-
max time kernel
140s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
04-07-2024 17:19
Behavioral task
behavioral1
Sample
[DemonArchives]560184b003e9c461fdfa4ab15cd3b6fb.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
[DemonArchives]58b00f133ec3b7efa68faf94233d594e.exe
Resource
win7-20240611-en
Behavioral task
behavioral3
Sample
[DemonArchives]627ba000cff6d43aa031da4020d15186.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
[DemonArchives]68d0fb679004d3c27c9efa840010881e.exe
Resource
win7-20240611-en
Behavioral task
behavioral5
Sample
[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
[DemonArchives]6bc2fcef470b064c9bd339c7e2553ea8.exe
Resource
win7-20231129-en
Behavioral task
behavioral7
Sample
[DemonArchives]6bf80d8b5b235df5efb621da1dd61b4b.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
[DemonArchives]6e102d15d6af7c43d43141e9d2a1206b.dll
Resource
win7-20240611-en
Behavioral task
behavioral9
Sample
[DemonArchives]6e4f9763c17ea31c3d1406eabd7db423.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
[DemonArchives]720d7d1deff763aee99bcc266f96b238.exe
Resource
win7-20240611-en
Behavioral task
behavioral11
Sample
[DemonArchives]7a8bde6d1942443bdbf09e610eb1b794.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
[DemonArchives]7da028810a703bb926d39a9b4ba50703.exe
Resource
win7-20231129-en
Behavioral task
behavioral13
Sample
[DemonArchives]7e020e96f43c40b26aa7f880ad0f8a96.exe
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
[DemonArchives]81759dd56bd4387d02cb20d44422c8f0.dll
Resource
win7-20240419-en
Behavioral task
behavioral15
Sample
[DemonArchives]853a559e0dcb25ab9605685ec776224c.exe
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
[DemonArchives]887a4917f4af1126d489a4f4d56b2eb3.exe
Resource
win7-20240508-en
Behavioral task
behavioral17
Sample
[DemonArchives]8edcc9bf66c21c55cf482dcac1c18c44.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
[DemonArchives]973465ab358797d8d056e4f04bda2513.exe
Resource
win7-20240221-en
Behavioral task
behavioral19
Sample
[DemonArchives]9a6f31f789128531e4c714e44915f822.exe
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
[DemonArchives]9afac07fd6517652d6e659963db8b87e.exe
Resource
win7-20240611-en
Behavioral task
behavioral21
Sample
[DemonArchives]a367e7069b0df249dbcd93f02f05a573.exe
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
[DemonArchives]a410ac0c141ebeb019661a692020fb94.exe
Resource
win7-20240419-en
Behavioral task
behavioral23
Sample
[DemonArchives]a62aacc19cac89138571eec242bcd4f6.exe
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
[DemonArchives]a7f2bf63baba5ffe2b5e76ab67d25bb6.exe
Resource
win7-20231129-en
Behavioral task
behavioral25
Sample
[DemonArchives]a9ea383aca2b60aece3a27c899e3f784.exe
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
[DemonArchives]ad9972de71fbca864e9303a043d203a0.exe
Resource
win7-20240221-en
Behavioral task
behavioral27
Sample
[DemonArchives]adefb3d586e8f74af30155d21ac5fc9e.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
[DemonArchives]b00c6b1b2a79fc9c57f97d16d58d00f2.exe
Resource
win7-20240220-en
Behavioral task
behavioral29
Sample
[DemonArchives]b2d7c4f62aa3abc7e398981d5c280af4.exe
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
[DemonArchives]c30111080c9e6acc70dd86ff97188ac8.dll
Resource
win7-20240419-en
Behavioral task
behavioral31
Sample
[DemonArchives]ddc0d08019efa4cc5f2a39de99cc0a85.dll
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
[DemonArchives]e28fe1917c5ffe9a3062ee369087f971.exe
Resource
win7-20240221-en
General
-
Target
[DemonArchives]68d0fb679004d3c27c9efa840010881e.exe
-
Size
1.9MB
-
MD5
68d0fb679004d3c27c9efa840010881e
-
SHA1
02afd4c3b8699c5108b95bcb6eb5dd2293dce4a9
-
SHA256
4115fafda97c7ca9ecb38c57231bc0fda1c78bdd9eec797fe7bb9b76e7071bc2
-
SHA512
68353560b414e798775c0d2df9fbf84b6ffad75a84c7805217c8304351cd99dd20e8a2a5c795662dd8b6ce8f6971d3d85948331bf659ab4e3a67789b49079a5c
-
SSDEEP
24576:jNIVyeNIVy2jU3NIVyeNIVy2jUQNIVyeNIVy2jU3NIVyeNIVy2jUO:6yjByjUyjByjH
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad [DemonArchives]68d0fb679004d3c27c9efa840010881e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" [DemonArchives]68d0fb679004d3c27c9efa840010881e.exe -
Executes dropped EXE 1 IoCs
pid Process 2016 Odhhgkib.exe -
Loads dropped DLL 2 IoCs
pid Process 2792 [DemonArchives]68d0fb679004d3c27c9efa840010881e.exe 2792 [DemonArchives]68d0fb679004d3c27c9efa840010881e.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\Hnlfhkoa.dll [DemonArchives]68d0fb679004d3c27c9efa840010881e.exe File created C:\Windows\SysWOW64\Odhhgkib.exe [DemonArchives]68d0fb679004d3c27c9efa840010881e.exe File opened for modification C:\Windows\SysWOW64\Odhhgkib.exe [DemonArchives]68d0fb679004d3c27c9efa840010881e.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 [DemonArchives]68d0fb679004d3c27c9efa840010881e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node [DemonArchives]68d0fb679004d3c27c9efa840010881e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID [DemonArchives]68d0fb679004d3c27c9efa840010881e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} [DemonArchives]68d0fb679004d3c27c9efa840010881e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnlfhkoa.dll" [DemonArchives]68d0fb679004d3c27c9efa840010881e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" [DemonArchives]68d0fb679004d3c27c9efa840010881e.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2016 2792 [DemonArchives]68d0fb679004d3c27c9efa840010881e.exe 28 PID 2792 wrote to memory of 2016 2792 [DemonArchives]68d0fb679004d3c27c9efa840010881e.exe 28 PID 2792 wrote to memory of 2016 2792 [DemonArchives]68d0fb679004d3c27c9efa840010881e.exe 28 PID 2792 wrote to memory of 2016 2792 [DemonArchives]68d0fb679004d3c27c9efa840010881e.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\[DemonArchives]68d0fb679004d3c27c9efa840010881e.exe"C:\Users\Admin\AppData\Local\Temp\[DemonArchives]68d0fb679004d3c27c9efa840010881e.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\Odhhgkib.exeC:\Windows\system32\Odhhgkib.exe2⤵
- Executes dropped EXE
PID:2016 -
C:\Windows\SysWOW64\Pdonhj32.exeC:\Windows\system32\Pdonhj32.exe3⤵PID:2752
-
C:\Windows\SysWOW64\Pgpgjepk.exeC:\Windows\system32\Pgpgjepk.exe4⤵PID:2336
-
C:\Windows\SysWOW64\Qkffng32.exeC:\Windows\system32\Qkffng32.exe5⤵PID:2552
-
C:\Windows\SysWOW64\Qfljkp32.exeC:\Windows\system32\Qfljkp32.exe6⤵PID:2992
-
C:\Windows\SysWOW64\Aqjdgmgd.exeC:\Windows\system32\Aqjdgmgd.exe7⤵PID:556
-
C:\Windows\SysWOW64\Anneqafn.exeC:\Windows\system32\Anneqafn.exe8⤵PID:808
-
C:\Windows\SysWOW64\Aggiigmn.exeC:\Windows\system32\Aggiigmn.exe9⤵PID:560
-
C:\Windows\SysWOW64\Aqonbm32.exeC:\Windows\system32\Aqonbm32.exe10⤵PID:2984
-
C:\Windows\SysWOW64\Ajgbkbjp.exeC:\Windows\system32\Ajgbkbjp.exe11⤵PID:2324
-
C:\Windows\SysWOW64\Bofgii32.exeC:\Windows\system32\Bofgii32.exe12⤵PID:948
-
C:\Windows\SysWOW64\Jhdlad32.exeC:\Windows\system32\Jhdlad32.exe13⤵PID:2584
-
C:\Windows\SysWOW64\Lhpglecl.exeC:\Windows\system32\Lhpglecl.exe14⤵PID:1704
-
C:\Windows\SysWOW64\Mkqqnq32.exeC:\Windows\system32\Mkqqnq32.exe15⤵PID:2344
-
C:\Windows\SysWOW64\Mmgfqh32.exeC:\Windows\system32\Mmgfqh32.exe16⤵PID:2912
-
C:\Windows\SysWOW64\Nedhjj32.exeC:\Windows\system32\Nedhjj32.exe17⤵PID:2072
-
C:\Windows\SysWOW64\Nbjeinje.exeC:\Windows\system32\Nbjeinje.exe18⤵PID:1540
-
C:\Windows\SysWOW64\Nlcibc32.exeC:\Windows\system32\Nlcibc32.exe19⤵PID:1148
-
C:\Windows\SysWOW64\Phlclgfc.exeC:\Windows\system32\Phlclgfc.exe20⤵PID:1536
-
C:\Windows\SysWOW64\Pdbdqh32.exeC:\Windows\system32\Pdbdqh32.exe21⤵PID:1828
-
C:\Windows\SysWOW64\Pgfjhcge.exeC:\Windows\system32\Pgfjhcge.exe22⤵PID:1924
-
C:\Windows\SysWOW64\Pdjjag32.exeC:\Windows\system32\Pdjjag32.exe23⤵PID:3020
-
C:\Windows\SysWOW64\Qppkfhlc.exeC:\Windows\system32\Qppkfhlc.exe24⤵PID:2120
-
C:\Windows\SysWOW64\Boogmgkl.exeC:\Windows\system32\Boogmgkl.exe25⤵PID:336
-
C:\Windows\SysWOW64\Cbblda32.exeC:\Windows\system32\Cbblda32.exe26⤵PID:2280
-
C:\Windows\SysWOW64\Cpfmmf32.exeC:\Windows\system32\Cpfmmf32.exe27⤵PID:2292
-
C:\Windows\SysWOW64\Cebeem32.exeC:\Windows\system32\Cebeem32.exe28⤵PID:2224
-
C:\Windows\SysWOW64\Cbffoabe.exeC:\Windows\system32\Cbffoabe.exe29⤵PID:2492
-
C:\Windows\SysWOW64\Dnpciaef.exeC:\Windows\system32\Dnpciaef.exe30⤵PID:264
-
C:\Windows\SysWOW64\Dhhhbg32.exeC:\Windows\system32\Dhhhbg32.exe31⤵PID:2980
-
C:\Windows\SysWOW64\Djiqdb32.exeC:\Windows\system32\Djiqdb32.exe32⤵PID:892
-
C:\Windows\SysWOW64\Debadpeg.exeC:\Windows\system32\Debadpeg.exe33⤵PID:2812
-
C:\Windows\SysWOW64\Dokfme32.exeC:\Windows\system32\Dokfme32.exe34⤵PID:2512
-
C:\Windows\SysWOW64\Edaalk32.exeC:\Windows\system32\Edaalk32.exe35⤵PID:3008
-
C:\Windows\SysWOW64\Einjdb32.exeC:\Windows\system32\Einjdb32.exe36⤵PID:2828
-
C:\Windows\SysWOW64\Egajnfoe.exeC:\Windows\system32\Egajnfoe.exe37⤵PID:804
-
C:\Windows\SysWOW64\Fdekgjno.exeC:\Windows\system32\Fdekgjno.exe38⤵PID:1356
-
C:\Windows\SysWOW64\Fmnopp32.exeC:\Windows\system32\Fmnopp32.exe39⤵PID:2660
-
C:\Windows\SysWOW64\Fckhhgcf.exeC:\Windows\system32\Fckhhgcf.exe40⤵PID:1624
-
C:\Windows\SysWOW64\Fhgppnan.exeC:\Windows\system32\Fhgppnan.exe41⤵PID:2272
-
C:\Windows\SysWOW64\Fodebh32.exeC:\Windows\system32\Fodebh32.exe42⤵PID:1032
-
C:\Windows\SysWOW64\Fdqnkoep.exeC:\Windows\system32\Fdqnkoep.exe43⤵PID:1064
-
C:\Windows\SysWOW64\Ggagmjbq.exeC:\Windows\system32\Ggagmjbq.exe44⤵PID:2908
-
C:\Windows\SysWOW64\Gdegfn32.exeC:\Windows\system32\Gdegfn32.exe45⤵PID:1948
-
C:\Windows\SysWOW64\Gaihob32.exeC:\Windows\system32\Gaihob32.exe46⤵PID:2164
-
C:\Windows\SysWOW64\Gfkmie32.exeC:\Windows\system32\Gfkmie32.exe47⤵PID:1944
-
C:\Windows\SysWOW64\Godaakic.exeC:\Windows\system32\Godaakic.exe48⤵PID:1480
-
C:\Windows\SysWOW64\Ghlfjq32.exeC:\Windows\system32\Ghlfjq32.exe49⤵PID:1176
-
C:\Windows\SysWOW64\Hcajhi32.exeC:\Windows\system32\Hcajhi32.exe50⤵PID:1612
-
C:\Windows\SysWOW64\Hinbppna.exeC:\Windows\system32\Hinbppna.exe51⤵PID:2008
-
C:\Windows\SysWOW64\Hohkmj32.exeC:\Windows\system32\Hohkmj32.exe52⤵PID:2576
-
C:\Windows\SysWOW64\Hdecea32.exeC:\Windows\system32\Hdecea32.exe53⤵PID:2720
-
C:\Windows\SysWOW64\Hkolakkb.exeC:\Windows\system32\Hkolakkb.exe54⤵PID:2140
-
C:\Windows\SysWOW64\Hbkqdepm.exeC:\Windows\system32\Hbkqdepm.exe55⤵PID:2036
-
C:\Windows\SysWOW64\Hghillnd.exeC:\Windows\system32\Hghillnd.exe56⤵PID:2724
-
C:\Windows\SysWOW64\Haqnea32.exeC:\Windows\system32\Haqnea32.exe57⤵PID:1508
-
C:\Windows\SysWOW64\Iacjjacb.exeC:\Windows\system32\Iacjjacb.exe58⤵PID:1596
-
C:\Windows\SysWOW64\Ifpcchai.exeC:\Windows\system32\Ifpcchai.exe59⤵PID:3048
-
C:\Windows\SysWOW64\Iphgln32.exeC:\Windows\system32\Iphgln32.exe60⤵PID:2684
-
C:\Windows\SysWOW64\Ijnkifgp.exeC:\Windows\system32\Ijnkifgp.exe61⤵PID:928
-
C:\Windows\SysWOW64\Iahceq32.exeC:\Windows\system32\Iahceq32.exe62⤵PID:2368
-
C:\Windows\SysWOW64\Ipmqgmcd.exeC:\Windows\system32\Ipmqgmcd.exe63⤵PID:2556
-
C:\Windows\SysWOW64\Ibkmchbh.exeC:\Windows\system32\Ibkmchbh.exe64⤵PID:2440
-
C:\Windows\SysWOW64\Inbnhihl.exeC:\Windows\system32\Inbnhihl.exe65⤵PID:1940
-
C:\Windows\SysWOW64\Jlfnangf.exeC:\Windows\system32\Jlfnangf.exe66⤵PID:2960
-
C:\Windows\SysWOW64\Joggci32.exeC:\Windows\system32\Joggci32.exe67⤵PID:580
-
C:\Windows\SysWOW64\Jeqopcld.exeC:\Windows\system32\Jeqopcld.exe68⤵PID:1900
-
C:\Windows\SysWOW64\Jhoklnkg.exeC:\Windows\system32\Jhoklnkg.exe69⤵PID:1016
-
C:\Windows\SysWOW64\Kmegjdad.exeC:\Windows\system32\Kmegjdad.exe70⤵PID:2104
-
C:\Windows\SysWOW64\Keqkofno.exeC:\Windows\system32\Keqkofno.exe71⤵PID:2652
-
C:\Windows\SysWOW64\Kcdlhj32.exeC:\Windows\system32\Kcdlhj32.exe72⤵PID:2244
-
C:\Windows\SysWOW64\Kokmmkcm.exeC:\Windows\system32\Kokmmkcm.exe73⤵PID:2852
-
C:\Windows\SysWOW64\Lhcafa32.exeC:\Windows\system32\Lhcafa32.exe74⤵PID:2260
-
C:\Windows\SysWOW64\Laleof32.exeC:\Windows\system32\Laleof32.exe75⤵PID:1404
-
C:\Windows\SysWOW64\Lhfnkqgk.exeC:\Windows\system32\Lhfnkqgk.exe76⤵PID:364
-
C:\Windows\SysWOW64\Lncfcgeb.exeC:\Windows\system32\Lncfcgeb.exe77⤵PID:2148
-
C:\Windows\SysWOW64\Mjcjog32.exeC:\Windows\system32\Mjcjog32.exe78⤵PID:2472
-
C:\Windows\SysWOW64\Mbnocipg.exeC:\Windows\system32\Mbnocipg.exe79⤵PID:704
-
C:\Windows\SysWOW64\Nflchkii.exeC:\Windows\system32\Nflchkii.exe80⤵PID:2080
-
C:\Windows\SysWOW64\Obeacl32.exeC:\Windows\system32\Obeacl32.exe81⤵PID:2168
-
C:\Windows\SysWOW64\Olmela32.exeC:\Windows\system32\Olmela32.exe82⤵PID:3012
-
C:\Windows\SysWOW64\Omckoi32.exeC:\Windows\system32\Omckoi32.exe83⤵PID:2456
-
C:\Windows\SysWOW64\Pfnmmn32.exeC:\Windows\system32\Pfnmmn32.exe84⤵PID:1108
-
C:\Windows\SysWOW64\Ppfafcpb.exeC:\Windows\system32\Ppfafcpb.exe85⤵PID:1956
-
C:\Windows\SysWOW64\Pbgjgomc.exeC:\Windows\system32\Pbgjgomc.exe86⤵PID:1000
-
C:\Windows\SysWOW64\Ppkjac32.exeC:\Windows\system32\Ppkjac32.exe87⤵PID:1248
-
C:\Windows\SysWOW64\Pehcij32.exeC:\Windows\system32\Pehcij32.exe88⤵PID:1728
-
C:\Windows\SysWOW64\Popgboae.exeC:\Windows\system32\Popgboae.exe89⤵PID:692
-
C:\Windows\SysWOW64\Qkghgpfi.exeC:\Windows\system32\Qkghgpfi.exe90⤵PID:1684
-
C:\Windows\SysWOW64\Qoeamo32.exeC:\Windows\system32\Qoeamo32.exe91⤵PID:1560
-
C:\Windows\SysWOW64\Aeoijidl.exeC:\Windows\system32\Aeoijidl.exe92⤵PID:1528
-
C:\Windows\SysWOW64\Aklabp32.exeC:\Windows\system32\Aklabp32.exe93⤵PID:1352
-
C:\Windows\SysWOW64\Ajckilei.exeC:\Windows\system32\Ajckilei.exe94⤵PID:2916
-
C:\Windows\SysWOW64\Anadojlo.exeC:\Windows\system32\Anadojlo.exe95⤵PID:2200
-
C:\Windows\SysWOW64\Bcpimq32.exeC:\Windows\system32\Bcpimq32.exe96⤵PID:2020
-
C:\Windows\SysWOW64\Blinefnd.exeC:\Windows\system32\Blinefnd.exe97⤵PID:1916
-
C:\Windows\SysWOW64\Bfabnl32.exeC:\Windows\system32\Bfabnl32.exe98⤵PID:2028
-
C:\Windows\SysWOW64\Bknjfb32.exeC:\Windows\system32\Bknjfb32.exe99⤵PID:1580
-
C:\Windows\SysWOW64\Bfcodkcb.exeC:\Windows\system32\Bfcodkcb.exe100⤵PID:2296
-
C:\Windows\SysWOW64\Bolcma32.exeC:\Windows\system32\Bolcma32.exe101⤵PID:584
-
C:\Windows\SysWOW64\Bkbdabog.exeC:\Windows\system32\Bkbdabog.exe102⤵PID:1608
-
C:\Windows\SysWOW64\Bdkhjgeh.exeC:\Windows\system32\Bdkhjgeh.exe103⤵PID:1984
-
C:\Windows\SysWOW64\Cqaiph32.exeC:\Windows\system32\Cqaiph32.exe104⤵PID:2476
-
C:\Windows\SysWOW64\Cmkfji32.exeC:\Windows\system32\Cmkfji32.exe105⤵PID:1884
-
C:\Windows\SysWOW64\Cjogcm32.exeC:\Windows\system32\Cjogcm32.exe106⤵PID:1732
-
C:\Windows\SysWOW64\Ckbpqe32.exeC:\Windows\system32\Ckbpqe32.exe107⤵PID:2832
-
C:\Windows\SysWOW64\Dgiaefgg.exeC:\Windows\system32\Dgiaefgg.exe108⤵PID:2420
-
C:\Windows\SysWOW64\Daaenlng.exeC:\Windows\system32\Daaenlng.exe109⤵PID:3040
-
C:\Windows\SysWOW64\Dgknkf32.exeC:\Windows\system32\Dgknkf32.exe110⤵PID:860
-
C:\Windows\SysWOW64\Deondj32.exeC:\Windows\system32\Deondj32.exe111⤵PID:2540
-
C:\Windows\SysWOW64\Djlfma32.exeC:\Windows\system32\Djlfma32.exe112⤵PID:2448
-
C:\Windows\SysWOW64\Dcdkef32.exeC:\Windows\system32\Dcdkef32.exe113⤵PID:1892
-
C:\Windows\SysWOW64\Dmmpolof.exeC:\Windows\system32\Dmmpolof.exe114⤵PID:1724
-
C:\Windows\SysWOW64\Emoldlmc.exeC:\Windows\system32\Emoldlmc.exe115⤵PID:1960
-
C:\Windows\SysWOW64\Eblelb32.exeC:\Windows\system32\Eblelb32.exe116⤵PID:2052
-
C:\Windows\SysWOW64\Efljhq32.exeC:\Windows\system32\Efljhq32.exe117⤵PID:1132
-
C:\Windows\SysWOW64\Eogolc32.exeC:\Windows\system32\Eogolc32.exe118⤵PID:1384
-
C:\Windows\SysWOW64\Eimcjl32.exeC:\Windows\system32\Eimcjl32.exe119⤵PID:2872
-
C:\Windows\SysWOW64\Eojlbb32.exeC:\Windows\system32\Eojlbb32.exe120⤵PID:1632
-
C:\Windows\SysWOW64\Fooembgb.exeC:\Windows\system32\Fooembgb.exe121⤵PID:1700
-
C:\Windows\SysWOW64\Fppaej32.exeC:\Windows\system32\Fppaej32.exe122⤵PID:1756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-