Analysis
-
max time kernel
72s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 10:41
Behavioral task
behavioral1
Sample
149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe
-
Size
1.3MB
-
MD5
149a7888a44bd4fe49beb87c0ef34af0
-
SHA1
5d167e207adea26e442e5aa0097ea0f3869e700e
-
SHA256
af0fb306067e174c2c2258829eb1b13c4e1b7f7e09595b1a32925d439723cc55
-
SHA512
ba23c0ad66e5b15202a2cc2b7b15c1bb26a3dd106730d6677e1e66b1986454935ecb2144c471ef99c923dbd9cb19b90df51eaf0980be70147670836df8fbedf0
-
SSDEEP
24576:6QWvr4B9f01ZmQvrb91v92W9C05wkEPSOdKkrzEoxrC9toC9Dq9onk8:6QWkB9f0VP91v92W805IPSOdKgzEoxrS
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" 149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000b0000000155e2-5.dat family_berbew behavioral1/files/0x0008000000015c7c-26.dat family_berbew behavioral1/files/0x0007000000015cb9-37.dat family_berbew behavioral1/files/0x00050000000186a0-68.dat family_berbew behavioral1/files/0x00070000000165ae-55.dat family_berbew behavioral1/files/0x0014000000015c52-75.dat family_berbew behavioral1/files/0x0006000000018b15-88.dat family_berbew behavioral1/files/0x0006000000018b37-108.dat family_berbew behavioral1/files/0x0006000000018b4a-115.dat family_berbew behavioral1/files/0x0006000000018b73-129.dat family_berbew behavioral1/files/0x0006000000018ba2-150.dat family_berbew behavioral1/files/0x00050000000192c9-157.dat family_berbew behavioral1/files/0x000500000001931b-179.dat family_berbew behavioral1/files/0x0005000000019368-192.dat family_berbew behavioral1/files/0x000500000001939b-201.dat family_berbew behavioral1/files/0x0005000000019410-211.dat family_berbew behavioral1/files/0x000500000001946f-227.dat family_berbew behavioral1/files/0x0005000000019485-238.dat family_berbew behavioral1/files/0x00040000000194d6-246.dat family_berbew behavioral1/files/0x00040000000194dc-257.dat family_berbew behavioral1/memory/1688-271-0x00000000002A0000-0x00000000002D3000-memory.dmp family_berbew behavioral1/files/0x00050000000194ea-270.dat family_berbew behavioral1/files/0x00050000000194ef-280.dat family_berbew behavioral1/files/0x00050000000194f4-288.dat family_berbew behavioral1/files/0x000500000001959e-321.dat family_berbew behavioral1/files/0x00050000000195a7-345.dat family_berbew behavioral1/files/0x00050000000195a4-331.dat family_berbew behavioral1/memory/2520-357-0x0000000000220000-0x0000000000253000-memory.dmp family_berbew behavioral1/memory/2520-356-0x0000000000220000-0x0000000000253000-memory.dmp family_berbew behavioral1/memory/2576-390-0x0000000000220000-0x0000000000253000-memory.dmp family_berbew behavioral1/files/0x0005000000019bd7-400.dat family_berbew behavioral1/files/0x0005000000019bef-411.dat family_berbew behavioral1/files/0x0005000000019ce6-420.dat family_berbew behavioral1/files/0x0005000000019d59-433.dat family_berbew behavioral1/files/0x0005000000019f60-443.dat family_berbew behavioral1/files/0x000500000001a3c2-479.dat family_berbew behavioral1/files/0x000500000001a2d0-467.dat family_berbew behavioral1/files/0x000500000001a3c8-492.dat family_berbew behavioral1/files/0x000500000001a3d4-505.dat family_berbew behavioral1/files/0x000500000001a429-513.dat family_berbew behavioral1/files/0x000500000001a431-523.dat family_berbew behavioral1/files/0x000500000001a43b-537.dat family_berbew behavioral1/files/0x000500000001a443-551.dat family_berbew behavioral1/files/0x000500000001a447-559.dat family_berbew behavioral1/files/0x000500000001a44b-570.dat family_berbew behavioral1/memory/940-458-0x00000000004A0000-0x00000000004D3000-memory.dmp family_berbew behavioral1/files/0x000500000001a013-456.dat family_berbew behavioral1/files/0x000500000001996e-388.dat family_berbew behavioral1/files/0x0005000000019646-375.dat family_berbew behavioral1/files/0x00050000000195ba-366.dat family_berbew behavioral1/files/0x000500000001a44f-582.dat family_berbew behavioral1/files/0x00050000000195a9-353.dat family_berbew behavioral1/files/0x000500000001a457-603.dat family_berbew behavioral1/files/0x000500000001a453-593.dat family_berbew behavioral1/files/0x000500000001a45b-617.dat family_berbew behavioral1/files/0x000500000001a463-637.dat family_berbew behavioral1/files/0x000500000001a467-648.dat family_berbew behavioral1/files/0x000500000001a45f-625.dat family_berbew behavioral1/files/0x000500000001a474-686.dat family_berbew behavioral1/files/0x000500000001a479-699.dat family_berbew behavioral1/files/0x000500000001a47d-712.dat family_berbew behavioral1/files/0x000500000001a484-726.dat family_berbew behavioral1/files/0x000500000001a489-743.dat family_berbew behavioral1/files/0x000500000001a543-756.dat family_berbew -
Executes dropped EXE 1 IoCs
pid Process 2940 Qjhmfekp.exe -
Loads dropped DLL 2 IoCs
pid Process 2988 149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe 2988 149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\Qjhmfekp.exe 149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Qjhmfekp.exe 149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Jmkgnjmo.dll 149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831} 149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmkgnjmo.dll" 149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" 149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2940 2988 149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe 28 PID 2988 wrote to memory of 2940 2988 149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe 28 PID 2988 wrote to memory of 2940 2988 149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe 28 PID 2988 wrote to memory of 2940 2988 149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\149a7888a44bd4fe49beb87c0ef34af0_NeikiAnalytics.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\Qjhmfekp.exeC:\Windows\system32\Qjhmfekp.exe2⤵
- Executes dropped EXE
PID:2940 -
C:\Windows\SysWOW64\Abfnpg32.exeC:\Windows\system32\Abfnpg32.exe3⤵PID:2628
-
C:\Windows\SysWOW64\Abhkfg32.exeC:\Windows\system32\Abhkfg32.exe4⤵PID:2536
-
C:\Windows\SysWOW64\Anolkh32.exeC:\Windows\system32\Anolkh32.exe5⤵PID:2860
-
C:\Windows\SysWOW64\Bepjha32.exeC:\Windows\system32\Bepjha32.exe6⤵PID:2452
-
C:\Windows\SysWOW64\Caidaeak.exeC:\Windows\system32\Caidaeak.exe7⤵PID:880
-
C:\Windows\SysWOW64\Cakqgeoi.exeC:\Windows\system32\Cakqgeoi.exe8⤵PID:1496
-
C:\Windows\SysWOW64\Dohgomgf.exeC:\Windows\system32\Dohgomgf.exe9⤵PID:1868
-
C:\Windows\SysWOW64\Daipqhdg.exeC:\Windows\system32\Daipqhdg.exe10⤵PID:2360
-
C:\Windows\SysWOW64\Elqaca32.exeC:\Windows\system32\Elqaca32.exe11⤵PID:2196
-
C:\Windows\SysWOW64\Fgcejm32.exeC:\Windows\system32\Fgcejm32.exe12⤵PID:1824
-
C:\Windows\SysWOW64\Ggcaiqhj.exeC:\Windows\system32\Ggcaiqhj.exe13⤵PID:1608
-
C:\Windows\SysWOW64\Gqlebf32.exeC:\Windows\system32\Gqlebf32.exe14⤵PID:2336
-
C:\Windows\SysWOW64\Gnpflj32.exeC:\Windows\system32\Gnpflj32.exe15⤵PID:2564
-
C:\Windows\SysWOW64\Jhlmmfef.exeC:\Windows\system32\Jhlmmfef.exe16⤵PID:564
-
C:\Windows\SysWOW64\Jdejhfig.exeC:\Windows\system32\Jdejhfig.exe17⤵PID:2244
-
C:\Windows\SysWOW64\Khabghdl.exeC:\Windows\system32\Khabghdl.exe18⤵PID:3052
-
C:\Windows\SysWOW64\Knnkpobc.exeC:\Windows\system32\Knnkpobc.exe19⤵PID:2880
-
C:\Windows\SysWOW64\Lnpgeopa.exeC:\Windows\system32\Lnpgeopa.exe20⤵PID:2316
-
C:\Windows\SysWOW64\Lgkhdddo.exeC:\Windows\system32\Lgkhdddo.exe21⤵PID:1688
-
C:\Windows\SysWOW64\Lfpeeqig.exeC:\Windows\system32\Lfpeeqig.exe22⤵PID:2948
-
C:\Windows\SysWOW64\Ljnnko32.exeC:\Windows\system32\Ljnnko32.exe23⤵PID:1976
-
C:\Windows\SysWOW64\Mfdopp32.exeC:\Windows\system32\Mfdopp32.exe24⤵PID:1720
-
C:\Windows\SysWOW64\Mlfacfpc.exeC:\Windows\system32\Mlfacfpc.exe25⤵PID:1980
-
C:\Windows\SysWOW64\Mngjeamd.exeC:\Windows\system32\Mngjeamd.exe26⤵PID:2268
-
C:\Windows\SysWOW64\Mccbmh32.exeC:\Windows\system32\Mccbmh32.exe27⤵PID:2744
-
C:\Windows\SysWOW64\Nhakcfab.exeC:\Windows\system32\Nhakcfab.exe28⤵PID:1484
-
C:\Windows\SysWOW64\Nfidjbdg.exeC:\Windows\system32\Nfidjbdg.exe29⤵PID:2520
-
C:\Windows\SysWOW64\Nenakoho.exeC:\Windows\system32\Nenakoho.exe30⤵PID:2552
-
C:\Windows\SysWOW64\Npdfhhhe.exeC:\Windows\system32\Npdfhhhe.exe31⤵PID:2540
-
C:\Windows\SysWOW64\Oeckfndj.exeC:\Windows\system32\Oeckfndj.exe32⤵PID:2576
-
C:\Windows\SysWOW64\Oeehln32.exeC:\Windows\system32\Oeehln32.exe33⤵PID:1164
-
C:\Windows\SysWOW64\Odjdmjgo.exeC:\Windows\system32\Odjdmjgo.exe34⤵PID:2544
-
C:\Windows\SysWOW64\Opaebkmc.exeC:\Windows\system32\Opaebkmc.exe35⤵PID:2424
-
C:\Windows\SysWOW64\Pcbncfjd.exeC:\Windows\system32\Pcbncfjd.exe36⤵PID:1432
-
C:\Windows\SysWOW64\Pljcllqe.exeC:\Windows\system32\Pljcllqe.exe37⤵PID:2140
-
C:\Windows\SysWOW64\Pnjofo32.exeC:\Windows\system32\Pnjofo32.exe38⤵PID:940
-
C:\Windows\SysWOW64\Pdmnam32.exeC:\Windows\system32\Pdmnam32.exe39⤵PID:1768
-
C:\Windows\SysWOW64\Qobbofgn.exeC:\Windows\system32\Qobbofgn.exe40⤵PID:1696
-
C:\Windows\SysWOW64\Qhjfgl32.exeC:\Windows\system32\Qhjfgl32.exe41⤵PID:2312
-
C:\Windows\SysWOW64\Aknlofim.exeC:\Windows\system32\Aknlofim.exe42⤵PID:2272
-
C:\Windows\SysWOW64\Aciqcifh.exeC:\Windows\system32\Aciqcifh.exe43⤵PID:2472
-
C:\Windows\SysWOW64\Anneqafn.exeC:\Windows\system32\Anneqafn.exe44⤵PID:588
-
C:\Windows\SysWOW64\Afjjed32.exeC:\Windows\system32\Afjjed32.exe45⤵PID:2192
-
C:\Windows\SysWOW64\Acnjnh32.exeC:\Windows\system32\Acnjnh32.exe46⤵PID:1268
-
C:\Windows\SysWOW64\Akiobk32.exeC:\Windows\system32\Akiobk32.exe47⤵PID:2228
-
C:\Windows\SysWOW64\Beackp32.exeC:\Windows\system32\Beackp32.exe48⤵PID:1736
-
C:\Windows\SysWOW64\Biolanld.exeC:\Windows\system32\Biolanld.exe49⤵PID:2868
-
C:\Windows\SysWOW64\Bajqfq32.exeC:\Windows\system32\Bajqfq32.exe50⤵PID:1404
-
C:\Windows\SysWOW64\Ddblgn32.exeC:\Windows\system32\Ddblgn32.exe51⤵PID:2904
-
C:\Windows\SysWOW64\Dhpemm32.exeC:\Windows\system32\Dhpemm32.exe52⤵PID:2064
-
C:\Windows\SysWOW64\Ddfebnoo.exeC:\Windows\system32\Ddfebnoo.exe53⤵PID:1556
-
C:\Windows\SysWOW64\Eldglp32.exeC:\Windows\system32\Eldglp32.exe54⤵PID:1900
-
C:\Windows\SysWOW64\Ehkhaqpk.exeC:\Windows\system32\Ehkhaqpk.exe55⤵PID:2512
-
C:\Windows\SysWOW64\Eacljf32.exeC:\Windows\system32\Eacljf32.exe56⤵PID:2088
-
C:\Windows\SysWOW64\Eaeipfei.exeC:\Windows\system32\Eaeipfei.exe57⤵PID:1744
-
C:\Windows\SysWOW64\Eknmhk32.exeC:\Windows\system32\Eknmhk32.exe58⤵PID:2068
-
C:\Windows\SysWOW64\Eaheeecg.exeC:\Windows\system32\Eaheeecg.exe59⤵PID:948
-
C:\Windows\SysWOW64\Fgdnnl32.exeC:\Windows\system32\Fgdnnl32.exe60⤵PID:1908
-
C:\Windows\SysWOW64\Fajbke32.exeC:\Windows\system32\Fajbke32.exe61⤵PID:1540
-
C:\Windows\SysWOW64\Fpoolael.exeC:\Windows\system32\Fpoolael.exe62⤵PID:2852
-
C:\Windows\SysWOW64\Fncpef32.exeC:\Windows\system32\Fncpef32.exe63⤵PID:2380
-
C:\Windows\SysWOW64\Fcphnm32.exeC:\Windows\system32\Fcphnm32.exe64⤵PID:1764
-
C:\Windows\SysWOW64\Fogibnha.exeC:\Windows\system32\Fogibnha.exe65⤵PID:596
-
C:\Windows\SysWOW64\Gjojef32.exeC:\Windows\system32\Gjojef32.exe66⤵PID:1236
-
C:\Windows\SysWOW64\Gfejjgli.exeC:\Windows\system32\Gfejjgli.exe67⤵PID:1140
-
C:\Windows\SysWOW64\Gkbcbn32.exeC:\Windows\system32\Gkbcbn32.exe68⤵PID:924
-
C:\Windows\SysWOW64\Gblkoham.exeC:\Windows\system32\Gblkoham.exe69⤵PID:2768
-
C:\Windows\SysWOW64\Gkephn32.exeC:\Windows\system32\Gkephn32.exe70⤵PID:2072
-
C:\Windows\SysWOW64\Giipab32.exeC:\Windows\system32\Giipab32.exe71⤵PID:2008
-
C:\Windows\SysWOW64\Gjjmijme.exeC:\Windows\system32\Gjjmijme.exe72⤵PID:2004
-
C:\Windows\SysWOW64\Ggnmbn32.exeC:\Windows\system32\Ggnmbn32.exe73⤵PID:2764
-
C:\Windows\SysWOW64\Hmkeke32.exeC:\Windows\system32\Hmkeke32.exe74⤵PID:2436
-
C:\Windows\SysWOW64\Hgpjhn32.exeC:\Windows\system32\Hgpjhn32.exe75⤵PID:1684
-
C:\Windows\SysWOW64\Hcldhnkk.exeC:\Windows\system32\Hcldhnkk.exe76⤵PID:1960
-
C:\Windows\SysWOW64\Hihlqeib.exeC:\Windows\system32\Hihlqeib.exe77⤵PID:1544
-
C:\Windows\SysWOW64\Iafnjg32.exeC:\Windows\system32\Iafnjg32.exe78⤵PID:308
-
C:\Windows\SysWOW64\Ibejdjln.exeC:\Windows\system32\Ibejdjln.exe79⤵PID:1568
-
C:\Windows\SysWOW64\Ijqoilii.exeC:\Windows\system32\Ijqoilii.exe80⤵PID:1636
-
C:\Windows\SysWOW64\Iefcfe32.exeC:\Windows\system32\Iefcfe32.exe81⤵PID:2688
-
C:\Windows\SysWOW64\Iamdkfnc.exeC:\Windows\system32\Iamdkfnc.exe82⤵PID:1740
-
C:\Windows\SysWOW64\Ijehdl32.exeC:\Windows\system32\Ijehdl32.exe83⤵PID:2176
-
C:\Windows\SysWOW64\Jbqmhnbo.exeC:\Windows\system32\Jbqmhnbo.exe84⤵PID:1964
-
C:\Windows\SysWOW64\Jeafjiop.exeC:\Windows\system32\Jeafjiop.exe85⤵PID:1788
-
C:\Windows\SysWOW64\Jojkco32.exeC:\Windows\system32\Jojkco32.exe86⤵PID:1232
-
C:\Windows\SysWOW64\Jedcpi32.exeC:\Windows\system32\Jedcpi32.exe87⤵PID:1252
-
C:\Windows\SysWOW64\Jolghndm.exeC:\Windows\system32\Jolghndm.exe88⤵PID:2052
-
C:\Windows\SysWOW64\Jefpeh32.exeC:\Windows\system32\Jefpeh32.exe89⤵PID:2012
-
C:\Windows\SysWOW64\Jbjpom32.exeC:\Windows\system32\Jbjpom32.exe90⤵PID:2252
-
C:\Windows\SysWOW64\Khghgchk.exeC:\Windows\system32\Khghgchk.exe91⤵PID:912
-
C:\Windows\SysWOW64\Kekiphge.exeC:\Windows\system32\Kekiphge.exe92⤵PID:2588
-
C:\Windows\SysWOW64\Kpgffe32.exeC:\Windows\system32\Kpgffe32.exe93⤵PID:1624
-
C:\Windows\SysWOW64\Kgqocoin.exeC:\Windows\system32\Kgqocoin.exe94⤵PID:2492
-
C:\Windows\SysWOW64\Lclicpkm.exeC:\Windows\system32\Lclicpkm.exe95⤵PID:2376
-
C:\Windows\SysWOW64\Lhiakf32.exeC:\Windows\system32\Lhiakf32.exe96⤵PID:572
-
C:\Windows\SysWOW64\Lcofio32.exeC:\Windows\system32\Lcofio32.exe97⤵PID:1292
-
C:\Windows\SysWOW64\Lhpglecl.exeC:\Windows\system32\Lhpglecl.exe98⤵PID:1760
-
C:\Windows\SysWOW64\Mjaddn32.exeC:\Windows\system32\Mjaddn32.exe99⤵PID:764
-
C:\Windows\SysWOW64\Mdghaf32.exeC:\Windows\system32\Mdghaf32.exe100⤵PID:2656
-
C:\Windows\SysWOW64\Mmbmeifk.exeC:\Windows\system32\Mmbmeifk.exe101⤵PID:1584
-
C:\Windows\SysWOW64\Opihgfop.exeC:\Windows\system32\Opihgfop.exe102⤵PID:320
-
C:\Windows\SysWOW64\Omnipjni.exeC:\Windows\system32\Omnipjni.exe103⤵PID:2120
-
C:\Windows\SysWOW64\Odgamdef.exeC:\Windows\system32\Odgamdef.exe104⤵PID:2036
-
C:\Windows\SysWOW64\Oidiekdn.exeC:\Windows\system32\Oidiekdn.exe105⤵PID:1692
-
C:\Windows\SysWOW64\Oekjjl32.exeC:\Windows\system32\Oekjjl32.exe106⤵PID:2804
-
C:\Windows\SysWOW64\Olebgfao.exeC:\Windows\system32\Olebgfao.exe107⤵PID:856
-
C:\Windows\SysWOW64\Oemgplgo.exeC:\Windows\system32\Oemgplgo.exe108⤵PID:1800
-
C:\Windows\SysWOW64\Pkjphcff.exeC:\Windows\system32\Pkjphcff.exe109⤵PID:2352
-
C:\Windows\SysWOW64\Pepcelel.exeC:\Windows\system32\Pepcelel.exe110⤵PID:2304
-
C:\Windows\SysWOW64\Pplaki32.exeC:\Windows\system32\Pplaki32.exe111⤵PID:2644
-
C:\Windows\SysWOW64\Paknelgk.exeC:\Windows\system32\Paknelgk.exe112⤵PID:2856
-
C:\Windows\SysWOW64\Pdjjag32.exeC:\Windows\system32\Pdjjag32.exe113⤵PID:1480
-
C:\Windows\SysWOW64\Pifbjn32.exeC:\Windows\system32\Pifbjn32.exe114⤵PID:1536
-
C:\Windows\SysWOW64\Qpbglhjq.exeC:\Windows\system32\Qpbglhjq.exe115⤵PID:616
-
C:\Windows\SysWOW64\Qeppdo32.exeC:\Windows\system32\Qeppdo32.exe116⤵PID:1920
-
C:\Windows\SysWOW64\Aohdmdoh.exeC:\Windows\system32\Aohdmdoh.exe117⤵PID:2884
-
C:\Windows\SysWOW64\Allefimb.exeC:\Windows\system32\Allefimb.exe118⤵PID:2548
-
C:\Windows\SysWOW64\Acfmcc32.exeC:\Windows\system32\Acfmcc32.exe119⤵PID:2660
-
C:\Windows\SysWOW64\Ajpepm32.exeC:\Windows\system32\Ajpepm32.exe120⤵PID:944
-
C:\Windows\SysWOW64\Aomnhd32.exeC:\Windows\system32\Aomnhd32.exe121⤵PID:2168
-
C:\Windows\SysWOW64\Aakjdo32.exeC:\Windows\system32\Aakjdo32.exe122⤵PID:2528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-