Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 18:43
Static task
static1
Behavioral task
behavioral1
Sample
79ce06ddc9e6a498c51878172cc969d0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
79ce06ddc9e6a498c51878172cc969d0N.exe
Resource
win10v2004-20240802-en
General
-
Target
79ce06ddc9e6a498c51878172cc969d0N.exe
-
Size
1.9MB
-
MD5
79ce06ddc9e6a498c51878172cc969d0
-
SHA1
cc270ba4f78adeaf7b9bfae45b90a530d20f8567
-
SHA256
8802990e2661c3d4cc0259d00d1a1286fd5b5687b96d47cc0e6afea35dbf16a9
-
SHA512
d843c500e3dccd1f5d0b0e63e544a708fe3e285f605523ddc23b01fcf5aef6f9fe43fa36959733b5b081dd2c4a072c27ad78edd3b7b8ee90603c36a1b619133e
-
SSDEEP
24576:IoNIVyeNIVy2jUChONIVyeNIVy2jU6Y+uoHXNIVyeNIVy2jUChONIVyeNIVy2jUO:IHyjbByjA+SyjbByjH
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gaoiol32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hejaon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hejaon32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jknlfg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jknlfg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 79ce06ddc9e6a498c51878172cc969d0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 79ce06ddc9e6a498c51878172cc969d0N.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gaoiol32.exe -
Executes dropped EXE 4 IoCs
pid Process 3064 Gaoiol32.exe 2152 Hejaon32.exe 2116 Jknlfg32.exe 2884 Jflfbdqe.exe -
Loads dropped DLL 8 IoCs
pid Process 2056 79ce06ddc9e6a498c51878172cc969d0N.exe 2056 79ce06ddc9e6a498c51878172cc969d0N.exe 3064 Gaoiol32.exe 3064 Gaoiol32.exe 2152 Hejaon32.exe 2152 Hejaon32.exe 2116 Jknlfg32.exe 2116 Jknlfg32.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\Bboqgikn.dll 79ce06ddc9e6a498c51878172cc969d0N.exe File created C:\Windows\SysWOW64\Hejaon32.exe Gaoiol32.exe File opened for modification C:\Windows\SysWOW64\Jknlfg32.exe Hejaon32.exe File created C:\Windows\SysWOW64\Eejgkg32.dll Hejaon32.exe File opened for modification C:\Windows\SysWOW64\Jflfbdqe.exe Jknlfg32.exe File created C:\Windows\SysWOW64\Lfphhb32.dll Jknlfg32.exe File created C:\Windows\SysWOW64\Gaoiol32.exe 79ce06ddc9e6a498c51878172cc969d0N.exe File opened for modification C:\Windows\SysWOW64\Hejaon32.exe Gaoiol32.exe File created C:\Windows\SysWOW64\Mikochhm.dll Gaoiol32.exe File created C:\Windows\SysWOW64\Jknlfg32.exe Hejaon32.exe File created C:\Windows\SysWOW64\Jflfbdqe.exe Jknlfg32.exe File opened for modification C:\Windows\SysWOW64\Gaoiol32.exe 79ce06ddc9e6a498c51878172cc969d0N.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2856 2696 WerFault.exe 596 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaoiol32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hejaon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jknlfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jflfbdqe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79ce06ddc9e6a498c51878172cc969d0N.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gaoiol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mikochhm.dll" Gaoiol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gaoiol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eejgkg32.dll" Hejaon32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jknlfg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bboqgikn.dll" 79ce06ddc9e6a498c51878172cc969d0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 79ce06ddc9e6a498c51878172cc969d0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hejaon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jknlfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 79ce06ddc9e6a498c51878172cc969d0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 79ce06ddc9e6a498c51878172cc969d0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hejaon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfphhb32.dll" Jknlfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 79ce06ddc9e6a498c51878172cc969d0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 79ce06ddc9e6a498c51878172cc969d0N.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2056 wrote to memory of 3064 2056 79ce06ddc9e6a498c51878172cc969d0N.exe 29 PID 2056 wrote to memory of 3064 2056 79ce06ddc9e6a498c51878172cc969d0N.exe 29 PID 2056 wrote to memory of 3064 2056 79ce06ddc9e6a498c51878172cc969d0N.exe 29 PID 2056 wrote to memory of 3064 2056 79ce06ddc9e6a498c51878172cc969d0N.exe 29 PID 3064 wrote to memory of 2152 3064 Gaoiol32.exe 30 PID 3064 wrote to memory of 2152 3064 Gaoiol32.exe 30 PID 3064 wrote to memory of 2152 3064 Gaoiol32.exe 30 PID 3064 wrote to memory of 2152 3064 Gaoiol32.exe 30 PID 2152 wrote to memory of 2116 2152 Hejaon32.exe 31 PID 2152 wrote to memory of 2116 2152 Hejaon32.exe 31 PID 2152 wrote to memory of 2116 2152 Hejaon32.exe 31 PID 2152 wrote to memory of 2116 2152 Hejaon32.exe 31 PID 2116 wrote to memory of 2884 2116 Jknlfg32.exe 524 PID 2116 wrote to memory of 2884 2116 Jknlfg32.exe 524 PID 2116 wrote to memory of 2884 2116 Jknlfg32.exe 524 PID 2116 wrote to memory of 2884 2116 Jknlfg32.exe 524
Processes
-
C:\Users\Admin\AppData\Local\Temp\79ce06ddc9e6a498c51878172cc969d0N.exe"C:\Users\Admin\AppData\Local\Temp\79ce06ddc9e6a498c51878172cc969d0N.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\Gaoiol32.exeC:\Windows\system32\Gaoiol32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\Hejaon32.exeC:\Windows\system32\Hejaon32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\Jknlfg32.exeC:\Windows\system32\Jknlfg32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\Jflfbdqe.exeC:\Windows\system32\Jflfbdqe.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Windows\SysWOW64\Lfbibfmi.exeC:\Windows\system32\Lfbibfmi.exe6⤵PID:2900
-
C:\Windows\SysWOW64\Lfgbmf32.exeC:\Windows\system32\Lfgbmf32.exe7⤵PID:1092
-
C:\Windows\SysWOW64\Miekhd32.exeC:\Windows\system32\Miekhd32.exe8⤵PID:2624
-
C:\Windows\SysWOW64\Npbpjn32.exeC:\Windows\system32\Npbpjn32.exe9⤵PID:2844
-
C:\Windows\SysWOW64\Oqdioaqf.exeC:\Windows\system32\Oqdioaqf.exe10⤵PID:1996
-
C:\Windows\SysWOW64\Oceaql32.exeC:\Windows\system32\Oceaql32.exe11⤵PID:2088
-
C:\Windows\SysWOW64\Pbohmh32.exeC:\Windows\system32\Pbohmh32.exe12⤵PID:760
-
C:\Windows\SysWOW64\Pobhfl32.exeC:\Windows\system32\Pobhfl32.exe13⤵PID:592
-
C:\Windows\SysWOW64\Pbcahgjd.exeC:\Windows\system32\Pbcahgjd.exe14⤵PID:1128
-
C:\Windows\SysWOW64\Qfegakmc.exeC:\Windows\system32\Qfegakmc.exe15⤵PID:3016
-
C:\Windows\SysWOW64\Apgnpo32.exeC:\Windows\system32\Apgnpo32.exe16⤵PID:2292
-
C:\Windows\SysWOW64\Boohgk32.exeC:\Windows\system32\Boohgk32.exe17⤵PID:2256
-
C:\Windows\SysWOW64\Bgablmfa.exeC:\Windows\system32\Bgablmfa.exe18⤵PID:2500
-
C:\Windows\SysWOW64\Cekihh32.exeC:\Windows\system32\Cekihh32.exe19⤵PID:1820
-
C:\Windows\SysWOW64\Cocnanmd.exeC:\Windows\system32\Cocnanmd.exe20⤵PID:816
-
C:\Windows\SysWOW64\Ehphdf32.exeC:\Windows\system32\Ehphdf32.exe21⤵PID:2028
-
C:\Windows\SysWOW64\Eqklhh32.exeC:\Windows\system32\Eqklhh32.exe22⤵PID:2536
-
C:\Windows\SysWOW64\Ffmnloih.exeC:\Windows\system32\Ffmnloih.exe23⤵PID:1288
-
C:\Windows\SysWOW64\Fpecddpi.exeC:\Windows\system32\Fpecddpi.exe24⤵PID:2308
-
C:\Windows\SysWOW64\Fjmdgmnl.exeC:\Windows\system32\Fjmdgmnl.exe25⤵PID:2964
-
C:\Windows\SysWOW64\Fcehpbdm.exeC:\Windows\system32\Fcehpbdm.exe26⤵PID:2532
-
C:\Windows\SysWOW64\Fnoiqpqk.exeC:\Windows\system32\Fnoiqpqk.exe27⤵PID:1572
-
C:\Windows\SysWOW64\Gnaffpoi.exeC:\Windows\system32\Gnaffpoi.exe28⤵PID:1700
-
C:\Windows\SysWOW64\Gibmglep.exeC:\Windows\system32\Gibmglep.exe29⤵PID:2236
-
C:\Windows\SysWOW64\Gffmqq32.exeC:\Windows\system32\Gffmqq32.exe30⤵PID:2748
-
C:\Windows\SysWOW64\Hfhjfp32.exeC:\Windows\system32\Hfhjfp32.exe31⤵PID:2240
-
C:\Windows\SysWOW64\Hlebog32.exeC:\Windows\system32\Hlebog32.exe32⤵PID:852
-
C:\Windows\SysWOW64\Hbagaa32.exeC:\Windows\system32\Hbagaa32.exe33⤵PID:2648
-
C:\Windows\SysWOW64\Hebqbl32.exeC:\Windows\system32\Hebqbl32.exe34⤵PID:2764
-
C:\Windows\SysWOW64\Ilneef32.exeC:\Windows\system32\Ilneef32.exe35⤵PID:2892
-
C:\Windows\SysWOW64\Idlgohcl.exeC:\Windows\system32\Idlgohcl.exe36⤵PID:528
-
C:\Windows\SysWOW64\Infhmmhi.exeC:\Windows\system32\Infhmmhi.exe37⤵PID:2296
-
C:\Windows\SysWOW64\Iebmaoed.exeC:\Windows\system32\Iebmaoed.exe38⤵PID:1808
-
C:\Windows\SysWOW64\Jhbfcj32.exeC:\Windows\system32\Jhbfcj32.exe39⤵PID:836
-
C:\Windows\SysWOW64\Jhebij32.exeC:\Windows\system32\Jhebij32.exe40⤵PID:2388
-
C:\Windows\SysWOW64\Jhgonj32.exeC:\Windows\system32\Jhgonj32.exe41⤵PID:412
-
C:\Windows\SysWOW64\Jhjldiln.exeC:\Windows\system32\Jhjldiln.exe42⤵PID:2476
-
C:\Windows\SysWOW64\Jbbpmo32.exeC:\Windows\system32\Jbbpmo32.exe43⤵PID:2936
-
C:\Windows\SysWOW64\Kkjeedio.exeC:\Windows\system32\Kkjeedio.exe44⤵PID:964
-
C:\Windows\SysWOW64\Kgaejeoc.exeC:\Windows\system32\Kgaejeoc.exe45⤵PID:972
-
C:\Windows\SysWOW64\Kmnnblmj.exeC:\Windows\system32\Kmnnblmj.exe46⤵PID:2052
-
C:\Windows\SysWOW64\Kjbnlqld.exeC:\Windows\system32\Kjbnlqld.exe47⤵PID:1620
-
C:\Windows\SysWOW64\Koogdg32.exeC:\Windows\system32\Koogdg32.exe48⤵PID:2548
-
C:\Windows\SysWOW64\Kqncnjan.exeC:\Windows\system32\Kqncnjan.exe49⤵PID:1724
-
C:\Windows\SysWOW64\Kjfhgp32.exeC:\Windows\system32\Kjfhgp32.exe50⤵PID:2736
-
C:\Windows\SysWOW64\Lcolpe32.exeC:\Windows\system32\Lcolpe32.exe51⤵PID:1696
-
C:\Windows\SysWOW64\Lmgaikep.exeC:\Windows\system32\Lmgaikep.exe52⤵PID:1312
-
C:\Windows\SysWOW64\Lebemmbk.exeC:\Windows\system32\Lebemmbk.exe53⤵PID:2960
-
C:\Windows\SysWOW64\Lbffga32.exeC:\Windows\system32\Lbffga32.exe54⤵PID:2040
-
C:\Windows\SysWOW64\Llagegfb.exeC:\Windows\system32\Llagegfb.exe55⤵PID:2828
-
C:\Windows\SysWOW64\Lfkhed32.exeC:\Windows\system32\Lfkhed32.exe56⤵PID:324
-
C:\Windows\SysWOW64\Mhjdpgic.exeC:\Windows\system32\Mhjdpgic.exe57⤵PID:2276
-
C:\Windows\SysWOW64\Mbdepe32.exeC:\Windows\system32\Mbdepe32.exe58⤵PID:1732
-
C:\Windows\SysWOW64\Mphfji32.exeC:\Windows\system32\Mphfji32.exe59⤵PID:792
-
C:\Windows\SysWOW64\Mlogojjp.exeC:\Windows\system32\Mlogojjp.exe60⤵PID:1552
-
C:\Windows\SysWOW64\Niednn32.exeC:\Windows\system32\Niednn32.exe61⤵PID:2688
-
C:\Windows\SysWOW64\Neldbo32.exeC:\Windows\system32\Neldbo32.exe62⤵PID:868
-
C:\Windows\SysWOW64\Nphbhm32.exeC:\Windows\system32\Nphbhm32.exe63⤵PID:2272
-
C:\Windows\SysWOW64\Nchkjhdh.exeC:\Windows\system32\Nchkjhdh.exe64⤵PID:3028
-
C:\Windows\SysWOW64\Ocmdeg32.exeC:\Windows\system32\Ocmdeg32.exe65⤵PID:2092
-
C:\Windows\SysWOW64\Pgfpoimj.exeC:\Windows\system32\Pgfpoimj.exe66⤵PID:2600
-
C:\Windows\SysWOW64\Abnmae32.exeC:\Windows\system32\Abnmae32.exe67⤵PID:3040
-
C:\Windows\SysWOW64\Aaegha32.exeC:\Windows\system32\Aaegha32.exe68⤵PID:976
-
C:\Windows\SysWOW64\Bajqcqli.exeC:\Windows\system32\Bajqcqli.exe69⤵PID:2840
-
C:\Windows\SysWOW64\Bieegcid.exeC:\Windows\system32\Bieegcid.exe70⤵PID:2780
-
C:\Windows\SysWOW64\Belfldoh.exeC:\Windows\system32\Belfldoh.exe71⤵PID:1608
-
C:\Windows\SysWOW64\Bpdgolml.exeC:\Windows\system32\Bpdgolml.exe72⤵PID:2068
-
C:\Windows\SysWOW64\Ceclmc32.exeC:\Windows\system32\Ceclmc32.exe73⤵PID:536
-
C:\Windows\SysWOW64\Cokqfhpa.exeC:\Windows\system32\Cokqfhpa.exe74⤵PID:1780
-
C:\Windows\SysWOW64\Ckbakiee.exeC:\Windows\system32\Ckbakiee.exe75⤵PID:2920
-
C:\Windows\SysWOW64\Cdkfco32.exeC:\Windows\system32\Cdkfco32.exe76⤵PID:1028
-
C:\Windows\SysWOW64\Dljdcqek.exeC:\Windows\system32\Dljdcqek.exe77⤵PID:1376
-
C:\Windows\SysWOW64\Dgphpi32.exeC:\Windows\system32\Dgphpi32.exe78⤵PID:804
-
C:\Windows\SysWOW64\Dphmiokb.exeC:\Windows\system32\Dphmiokb.exe79⤵PID:2816
-
C:\Windows\SysWOW64\Danblfmk.exeC:\Windows\system32\Danblfmk.exe80⤵PID:2916
-
C:\Windows\SysWOW64\Dgkkdnkb.exeC:\Windows\system32\Dgkkdnkb.exe81⤵PID:1720
-
C:\Windows\SysWOW64\Daqoafkh.exeC:\Windows\system32\Daqoafkh.exe82⤵PID:1712
-
C:\Windows\SysWOW64\Epflbbpp.exeC:\Windows\system32\Epflbbpp.exe83⤵PID:1116
-
C:\Windows\SysWOW64\Fbqkqj32.exeC:\Windows\system32\Fbqkqj32.exe84⤵PID:3048
-
C:\Windows\SysWOW64\Fnglekch.exeC:\Windows\system32\Fnglekch.exe85⤵PID:1744
-
C:\Windows\SysWOW64\Fdadbd32.exeC:\Windows\system32\Fdadbd32.exe86⤵PID:1156
-
C:\Windows\SysWOW64\Fbeeliin.exeC:\Windows\system32\Fbeeliin.exe87⤵PID:472
-
C:\Windows\SysWOW64\Fknido32.exeC:\Windows\system32\Fknido32.exe88⤵PID:1692
-
C:\Windows\SysWOW64\Fcinia32.exeC:\Windows\system32\Fcinia32.exe89⤵PID:2160
-
C:\Windows\SysWOW64\Fmabaf32.exeC:\Windows\system32\Fmabaf32.exe90⤵PID:2268
-
C:\Windows\SysWOW64\Gjjlfjoo.exeC:\Windows\system32\Gjjlfjoo.exe91⤵PID:2680
-
C:\Windows\SysWOW64\Gcbaop32.exeC:\Windows\system32\Gcbaop32.exe92⤵PID:2924
-
C:\Windows\SysWOW64\Gnlbpman.exeC:\Windows\system32\Gnlbpman.exe93⤵PID:2672
-
C:\Windows\SysWOW64\Gpknjp32.exeC:\Windows\system32\Gpknjp32.exe94⤵PID:2868
-
C:\Windows\SysWOW64\Hehgbg32.exeC:\Windows\system32\Hehgbg32.exe95⤵PID:2120
-
C:\Windows\SysWOW64\Hdpqhc32.exeC:\Windows\system32\Hdpqhc32.exe96⤵PID:2252
-
C:\Windows\SysWOW64\Hhmioa32.exeC:\Windows\system32\Hhmioa32.exe97⤵PID:1280
-
C:\Windows\SysWOW64\Hmjagh32.exeC:\Windows\system32\Hmjagh32.exe98⤵PID:1680
-
C:\Windows\SysWOW64\Ifecen32.exeC:\Windows\system32\Ifecen32.exe99⤵PID:2948
-
C:\Windows\SysWOW64\Ibnppn32.exeC:\Windows\system32\Ibnppn32.exe100⤵PID:1684
-
C:\Windows\SysWOW64\Jknnoppp.exeC:\Windows\system32\Jknnoppp.exe101⤵PID:2904
-
C:\Windows\SysWOW64\Jgeoda32.exeC:\Windows\system32\Jgeoda32.exe102⤵PID:2568
-
C:\Windows\SysWOW64\Kogjib32.exeC:\Windows\system32\Kogjib32.exe103⤵PID:1200
-
C:\Windows\SysWOW64\Kjmnfk32.exeC:\Windows\system32\Kjmnfk32.exe104⤵PID:1172
-
C:\Windows\SysWOW64\Koifob32.exeC:\Windows\system32\Koifob32.exe105⤵PID:2812
-
C:\Windows\SysWOW64\Kdfogiil.exeC:\Windows\system32\Kdfogiil.exe106⤵PID:2856
-
C:\Windows\SysWOW64\Knocpn32.exeC:\Windows\system32\Knocpn32.exe107⤵PID:2412
-
C:\Windows\SysWOW64\Khdhmg32.exeC:\Windows\system32\Khdhmg32.exe108⤵PID:1368
-
C:\Windows\SysWOW64\Kbllfmfc.exeC:\Windows\system32\Kbllfmfc.exe109⤵PID:2204
-
C:\Windows\SysWOW64\Kgienc32.exeC:\Windows\system32\Kgienc32.exe110⤵PID:2716
-
C:\Windows\SysWOW64\Lkgmdbja.exeC:\Windows\system32\Lkgmdbja.exe111⤵PID:2968
-
C:\Windows\SysWOW64\Lgnnicpe.exeC:\Windows\system32\Lgnnicpe.exe112⤵PID:1800
-
C:\Windows\SysWOW64\Lbjlppja.exeC:\Windows\system32\Lbjlppja.exe113⤵PID:1844
-
C:\Windows\SysWOW64\Liddljan.exeC:\Windows\system32\Liddljan.exe114⤵PID:588
-
C:\Windows\SysWOW64\Lfhdeoqh.exeC:\Windows\system32\Lfhdeoqh.exe115⤵PID:2328
-
C:\Windows\SysWOW64\Mahlgkgo.exeC:\Windows\system32\Mahlgkgo.exe116⤵PID:2464
-
C:\Windows\SysWOW64\Nfogeamk.exeC:\Windows\system32\Nfogeamk.exe117⤵PID:1736
-
C:\Windows\SysWOW64\Nkqlodpk.exeC:\Windows\system32\Nkqlodpk.exe118⤵PID:824
-
C:\Windows\SysWOW64\Oooeeb32.exeC:\Windows\system32\Oooeeb32.exe119⤵PID:2692
-
C:\Windows\SysWOW64\Odnjbibf.exeC:\Windows\system32\Odnjbibf.exe120⤵PID:2980
-
C:\Windows\SysWOW64\Omfoko32.exeC:\Windows\system32\Omfoko32.exe121⤵PID:828
-
C:\Windows\SysWOW64\Onhkan32.exeC:\Windows\system32\Onhkan32.exe122⤵PID:2416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-