Analysis
-
max time kernel
1s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 20:35
Static task
static1
Behavioral task
behavioral1
Sample
179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe
-
Size
407KB
-
MD5
c667a81f6277ff12fddbc1996a5b85a0
-
SHA1
807207d2e68aec0b0538b8b0d80f328f20498854
-
SHA256
179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4
-
SHA512
9202027bf11dbb1ba04cf25d9feafe9319493940de1a2dc0f56caa9616f8a36d67ccdf35e81b1d7ba3084ee039fa48ea6b06569637205bab910455e95b91fa31
-
SSDEEP
6144:lmvelnl0/rEd4Lcpui6yYPaIGcjDpui6yYPaIGckSU05836pui6yYPaIGckN:oWX0Q1pV6yYP3pV6yYPg058KpV6yYPS
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jjjacf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfqahgpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jfqahgpg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" 179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijgdngmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ijgdngmf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjjacf32.exe -
Executes dropped EXE 4 IoCs
pid Process 2812 Ijgdngmf.exe 2720 Jjjacf32.exe 2688 Jfqahgpg.exe 2884 Jfcnngnd.exe -
Loads dropped DLL 8 IoCs
pid Process 1384 179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe 1384 179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe 2812 Ijgdngmf.exe 2812 Ijgdngmf.exe 2720 Jjjacf32.exe 2720 Jjjacf32.exe 2688 Jfqahgpg.exe 2688 Jfqahgpg.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\Jjjacf32.exe Ijgdngmf.exe File opened for modification C:\Windows\SysWOW64\Jjjacf32.exe Ijgdngmf.exe File created C:\Windows\SysWOW64\Goipbehm.dll Ijgdngmf.exe File created C:\Windows\SysWOW64\Jfqahgpg.exe Jjjacf32.exe File opened for modification C:\Windows\SysWOW64\Jfqahgpg.exe Jjjacf32.exe File created C:\Windows\SysWOW64\Hjbpkign.dll Jjjacf32.exe File opened for modification C:\Windows\SysWOW64\Ijgdngmf.exe 179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Fpffnl32.dll 179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Ojchmpcd.dll Jfqahgpg.exe File opened for modification C:\Windows\SysWOW64\Jfcnngnd.exe Jfqahgpg.exe File created C:\Windows\SysWOW64\Ijgdngmf.exe 179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Jfcnngnd.exe Jfqahgpg.exe -
Program crash 1 IoCs
pid pid_target Process 4748 3864 WerFault.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jjjacf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpffnl32.dll" 179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ijgdngmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Goipbehm.dll" Ijgdngmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjbpkign.dll" Jjjacf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojchmpcd.dll" Jfqahgpg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831} 179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" 179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ijgdngmf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jjjacf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jfqahgpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jfqahgpg.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1384 wrote to memory of 2812 1384 179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe 28 PID 1384 wrote to memory of 2812 1384 179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe 28 PID 1384 wrote to memory of 2812 1384 179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe 28 PID 1384 wrote to memory of 2812 1384 179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe 28 PID 2812 wrote to memory of 2720 2812 Ijgdngmf.exe 29 PID 2812 wrote to memory of 2720 2812 Ijgdngmf.exe 29 PID 2812 wrote to memory of 2720 2812 Ijgdngmf.exe 29 PID 2812 wrote to memory of 2720 2812 Ijgdngmf.exe 29 PID 2720 wrote to memory of 2688 2720 Jjjacf32.exe 30 PID 2720 wrote to memory of 2688 2720 Jjjacf32.exe 30 PID 2720 wrote to memory of 2688 2720 Jjjacf32.exe 30 PID 2720 wrote to memory of 2688 2720 Jjjacf32.exe 30 PID 2688 wrote to memory of 2884 2688 Jfqahgpg.exe 31 PID 2688 wrote to memory of 2884 2688 Jfqahgpg.exe 31 PID 2688 wrote to memory of 2884 2688 Jfqahgpg.exe 31 PID 2688 wrote to memory of 2884 2688 Jfqahgpg.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\179f73e0768014f5799b4590ac77156afb600d4b28f7d3614ddc1505d367edf4_NeikiAnalytics.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\Ijgdngmf.exeC:\Windows\system32\Ijgdngmf.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\Jjjacf32.exeC:\Windows\system32\Jjjacf32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\Jfqahgpg.exeC:\Windows\system32\Jfqahgpg.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\Jfcnngnd.exeC:\Windows\system32\Jfcnngnd.exe5⤵
- Executes dropped EXE
PID:2884 -
C:\Windows\SysWOW64\Jfghif32.exeC:\Windows\system32\Jfghif32.exe6⤵PID:1344
-
C:\Windows\SysWOW64\Jkdpanhg.exeC:\Windows\system32\Jkdpanhg.exe7⤵PID:2800
-
C:\Windows\SysWOW64\Kemejc32.exeC:\Windows\system32\Kemejc32.exe8⤵PID:2968
-
C:\Windows\SysWOW64\Kgnnln32.exeC:\Windows\system32\Kgnnln32.exe9⤵PID:1932
-
C:\Windows\SysWOW64\Kfbkmk32.exeC:\Windows\system32\Kfbkmk32.exe10⤵PID:2824
-
C:\Windows\SysWOW64\Kcfkfo32.exeC:\Windows\system32\Kcfkfo32.exe11⤵PID:764
-
C:\Windows\SysWOW64\Kjcpii32.exeC:\Windows\system32\Kjcpii32.exe12⤵PID:612
-
C:\Windows\SysWOW64\Leonofpp.exeC:\Windows\system32\Leonofpp.exe13⤵PID:1600
-
C:\Windows\SysWOW64\Llkbap32.exeC:\Windows\system32\Llkbap32.exe14⤵PID:2628
-
C:\Windows\SysWOW64\Mkgfckcj.exeC:\Windows\system32\Mkgfckcj.exe15⤵PID:1912
-
C:\Windows\SysWOW64\Nefpnhlc.exeC:\Windows\system32\Nefpnhlc.exe16⤵PID:668
-
C:\Windows\SysWOW64\Nlbeqb32.exeC:\Windows\system32\Nlbeqb32.exe17⤵PID:1484
-
C:\Windows\SysWOW64\Onjgiiad.exeC:\Windows\system32\Onjgiiad.exe18⤵PID:904
-
C:\Windows\SysWOW64\Ogeigofa.exeC:\Windows\system32\Ogeigofa.exe19⤵PID:3060
-
C:\Windows\SysWOW64\Ohibdf32.exeC:\Windows\system32\Ohibdf32.exe20⤵PID:1392
-
C:\Windows\SysWOW64\Ocnfbo32.exeC:\Windows\system32\Ocnfbo32.exe21⤵PID:1804
-
C:\Windows\SysWOW64\Pogclp32.exeC:\Windows\system32\Pogclp32.exe22⤵PID:1624
-
C:\Windows\SysWOW64\Pedleg32.exeC:\Windows\system32\Pedleg32.exe23⤵PID:912
-
C:\Windows\SysWOW64\Pmdjdh32.exeC:\Windows\system32\Pmdjdh32.exe24⤵PID:2408
-
C:\Windows\SysWOW64\Qfokbnip.exeC:\Windows\system32\Qfokbnip.exe25⤵PID:2916
-
C:\Windows\SysWOW64\Qfahhm32.exeC:\Windows\system32\Qfahhm32.exe26⤵PID:1736
-
C:\Windows\SysWOW64\Alpmfdcb.exeC:\Windows\system32\Alpmfdcb.exe27⤵PID:2384
-
C:\Windows\SysWOW64\Adnopfoj.exeC:\Windows\system32\Adnopfoj.exe28⤵PID:1584
-
C:\Windows\SysWOW64\Aaaoij32.exeC:\Windows\system32\Aaaoij32.exe29⤵PID:1708
-
C:\Windows\SysWOW64\Bioqclil.exeC:\Windows\system32\Bioqclil.exe30⤵PID:2684
-
C:\Windows\SysWOW64\Bmmiij32.exeC:\Windows\system32\Bmmiij32.exe31⤵PID:2556
-
C:\Windows\SysWOW64\Bghjhp32.exeC:\Windows\system32\Bghjhp32.exe32⤵PID:2412
-
C:\Windows\SysWOW64\Cafecmlj.exeC:\Windows\system32\Cafecmlj.exe33⤵PID:2776
-
C:\Windows\SysWOW64\Cojema32.exeC:\Windows\system32\Cojema32.exe34⤵PID:1984
-
C:\Windows\SysWOW64\Caknol32.exeC:\Windows\system32\Caknol32.exe35⤵PID:1432
-
C:\Windows\SysWOW64\Cppkph32.exeC:\Windows\system32\Cppkph32.exe36⤵PID:2316
-
C:\Windows\SysWOW64\Dndlim32.exeC:\Windows\system32\Dndlim32.exe37⤵PID:1700
-
C:\Windows\SysWOW64\Djmicm32.exeC:\Windows\system32\Djmicm32.exe38⤵PID:1212
-
C:\Windows\SysWOW64\Dfdjhndl.exeC:\Windows\system32\Dfdjhndl.exe39⤵PID:2040
-
C:\Windows\SysWOW64\Dnoomqbg.exeC:\Windows\system32\Dnoomqbg.exe40⤵PID:2332
-
C:\Windows\SysWOW64\Ehgppi32.exeC:\Windows\system32\Ehgppi32.exe41⤵PID:2600
-
C:\Windows\SysWOW64\Eqbddk32.exeC:\Windows\system32\Eqbddk32.exe42⤵PID:1264
-
C:\Windows\SysWOW64\Ejkima32.exeC:\Windows\system32\Ejkima32.exe43⤵PID:2940
-
C:\Windows\SysWOW64\Eqgnokip.exeC:\Windows\system32\Eqgnokip.exe44⤵PID:2460
-
C:\Windows\SysWOW64\Eplkpgnh.exeC:\Windows\system32\Eplkpgnh.exe45⤵PID:2044
-
C:\Windows\SysWOW64\Fjaonpnn.exeC:\Windows\system32\Fjaonpnn.exe46⤵PID:1596
-
C:\Windows\SysWOW64\Ffhpbacb.exeC:\Windows\system32\Ffhpbacb.exe47⤵PID:1864
-
C:\Windows\SysWOW64\Fmbhok32.exeC:\Windows\system32\Fmbhok32.exe48⤵PID:2980
-
C:\Windows\SysWOW64\Ffklhqao.exeC:\Windows\system32\Ffklhqao.exe49⤵PID:604
-
C:\Windows\SysWOW64\Flgeqgog.exeC:\Windows\system32\Flgeqgog.exe50⤵PID:2992
-
C:\Windows\SysWOW64\Fhneehek.exeC:\Windows\system32\Fhneehek.exe51⤵PID:1704
-
C:\Windows\SysWOW64\Fhqbkhch.exeC:\Windows\system32\Fhqbkhch.exe52⤵PID:3004
-
C:\Windows\SysWOW64\Gjakmc32.exeC:\Windows\system32\Gjakmc32.exe53⤵PID:872
-
C:\Windows\SysWOW64\Gfhladfn.exeC:\Windows\system32\Gfhladfn.exe54⤵PID:3040
-
C:\Windows\SysWOW64\Gpqpjj32.exeC:\Windows\system32\Gpqpjj32.exe55⤵PID:2772
-
C:\Windows\SysWOW64\Giieco32.exeC:\Windows\system32\Giieco32.exe56⤵PID:1788
-
C:\Windows\SysWOW64\Gikaio32.exeC:\Windows\system32\Gikaio32.exe57⤵PID:2564
-
C:\Windows\SysWOW64\Hlljjjnm.exeC:\Windows\system32\Hlljjjnm.exe58⤵PID:3036
-
C:\Windows\SysWOW64\Haiccald.exeC:\Windows\system32\Haiccald.exe59⤵PID:1944
-
C:\Windows\SysWOW64\Hbhomd32.exeC:\Windows\system32\Hbhomd32.exe60⤵PID:2336
-
C:\Windows\SysWOW64\Hoopae32.exeC:\Windows\system32\Hoopae32.exe61⤵PID:2548
-
C:\Windows\SysWOW64\Hdlhjl32.exeC:\Windows\system32\Hdlhjl32.exe62⤵PID:1988
-
C:\Windows\SysWOW64\Hgmalg32.exeC:\Windows\system32\Hgmalg32.exe63⤵PID:2560
-
C:\Windows\SysWOW64\Iimjmbae.exeC:\Windows\system32\Iimjmbae.exe64⤵PID:572
-
C:\Windows\SysWOW64\Iefhhbef.exeC:\Windows\system32\Iefhhbef.exe65⤵PID:660
-
C:\Windows\SysWOW64\Ioaifhid.exeC:\Windows\system32\Ioaifhid.exe66⤵PID:688
-
C:\Windows\SysWOW64\Jnffgd32.exeC:\Windows\system32\Jnffgd32.exe67⤵PID:1748
-
C:\Windows\SysWOW64\Jnicmdli.exeC:\Windows\system32\Jnicmdli.exe68⤵PID:2000
-
C:\Windows\SysWOW64\Jhngjmlo.exeC:\Windows\system32\Jhngjmlo.exe69⤵PID:1648
-
C:\Windows\SysWOW64\Jqilooij.exeC:\Windows\system32\Jqilooij.exe70⤵PID:1660
-
C:\Windows\SysWOW64\Jcjdpj32.exeC:\Windows\system32\Jcjdpj32.exe71⤵PID:1488
-
C:\Windows\SysWOW64\Jcmafj32.exeC:\Windows\system32\Jcmafj32.exe72⤵PID:2216
-
C:\Windows\SysWOW64\Kqqboncb.exeC:\Windows\system32\Kqqboncb.exe73⤵PID:2360
-
C:\Windows\SysWOW64\Kkjcplpa.exeC:\Windows\system32\Kkjcplpa.exe74⤵PID:2220
-
C:\Windows\SysWOW64\Kohkfj32.exeC:\Windows\system32\Kohkfj32.exe75⤵PID:2456
-
C:\Windows\SysWOW64\Kpjhkjde.exeC:\Windows\system32\Kpjhkjde.exe76⤵PID:2756
-
C:\Windows\SysWOW64\Kgemplap.exeC:\Windows\system32\Kgemplap.exe77⤵PID:1560
-
C:\Windows\SysWOW64\Lnbbbffj.exeC:\Windows\system32\Lnbbbffj.exe78⤵PID:2104
-
C:\Windows\SysWOW64\Lmgocb32.exeC:\Windows\system32\Lmgocb32.exe79⤵PID:2488
-
C:\Windows\SysWOW64\Linphc32.exeC:\Windows\system32\Linphc32.exe80⤵PID:2528
-
C:\Windows\SysWOW64\Lbfdaigg.exeC:\Windows\system32\Lbfdaigg.exe81⤵PID:1512
-
C:\Windows\SysWOW64\Lcfqkl32.exeC:\Windows\system32\Lcfqkl32.exe82⤵PID:1808
-
C:\Windows\SysWOW64\Mlaeonld.exeC:\Windows\system32\Mlaeonld.exe83⤵PID:1612
-
C:\Windows\SysWOW64\Mponel32.exeC:\Windows\system32\Mponel32.exe84⤵PID:2752
-
C:\Windows\SysWOW64\Modkfi32.exeC:\Windows\system32\Modkfi32.exe85⤵PID:2484
-
C:\Windows\SysWOW64\Mlhkpm32.exeC:\Windows\system32\Mlhkpm32.exe86⤵PID:984
-
C:\Windows\SysWOW64\Mholen32.exeC:\Windows\system32\Mholen32.exe87⤵PID:2076
-
C:\Windows\SysWOW64\Mpjqiq32.exeC:\Windows\system32\Mpjqiq32.exe88⤵PID:2232
-
C:\Windows\SysWOW64\Naimccpo.exeC:\Windows\system32\Naimccpo.exe89⤵PID:2004
-
C:\Windows\SysWOW64\Npojdpef.exeC:\Windows\system32\Npojdpef.exe90⤵PID:864
-
C:\Windows\SysWOW64\Nigome32.exeC:\Windows\system32\Nigome32.exe91⤵PID:856
-
C:\Windows\SysWOW64\Ngkogj32.exeC:\Windows\system32\Ngkogj32.exe92⤵PID:2108
-
C:\Windows\SysWOW64\Npccpo32.exeC:\Windows\system32\Npccpo32.exe93⤵PID:2956
-
C:\Windows\SysWOW64\Nhohda32.exeC:\Windows\system32\Nhohda32.exe94⤵PID:624
-
C:\Windows\SysWOW64\Okoafmkm.exeC:\Windows\system32\Okoafmkm.exe95⤵PID:2272
-
C:\Windows\SysWOW64\Okanklik.exeC:\Windows\system32\Okanklik.exe96⤵PID:2184
-
C:\Windows\SysWOW64\Ohendqhd.exeC:\Windows\system32\Ohendqhd.exe97⤵PID:1948
-
C:\Windows\SysWOW64\Oqacic32.exeC:\Windows\system32\Oqacic32.exe98⤵PID:1228
-
C:\Windows\SysWOW64\Oqcpob32.exeC:\Windows\system32\Oqcpob32.exe99⤵PID:2376
-
C:\Windows\SysWOW64\Pcdipnqn.exeC:\Windows\system32\Pcdipnqn.exe100⤵PID:268
-
C:\Windows\SysWOW64\Pqhijbog.exeC:\Windows\system32\Pqhijbog.exe101⤵PID:2196
-
C:\Windows\SysWOW64\Pjbjhgde.exeC:\Windows\system32\Pjbjhgde.exe102⤵PID:1048
-
C:\Windows\SysWOW64\Pdlkiepd.exeC:\Windows\system32\Pdlkiepd.exe103⤵PID:3000
-
C:\Windows\SysWOW64\Poapfn32.exeC:\Windows\system32\Poapfn32.exe104⤵PID:2740
-
C:\Windows\SysWOW64\Qkhpkoen.exeC:\Windows\system32\Qkhpkoen.exe105⤵PID:2692
-
C:\Windows\SysWOW64\Qqeicede.exeC:\Windows\system32\Qqeicede.exe106⤵PID:1832
-
C:\Windows\SysWOW64\Aganeoip.exeC:\Windows\system32\Aganeoip.exe107⤵PID:2116
-
C:\Windows\SysWOW64\Amnfnfgg.exeC:\Windows\system32\Amnfnfgg.exe108⤵PID:2168
-
C:\Windows\SysWOW64\Ajbggjfq.exeC:\Windows\system32\Ajbggjfq.exe109⤵PID:1312
-
C:\Windows\SysWOW64\Apoooa32.exeC:\Windows\system32\Apoooa32.exe110⤵PID:1572
-
C:\Windows\SysWOW64\Agfgqo32.exeC:\Windows\system32\Agfgqo32.exe111⤵PID:1632
-
C:\Windows\SysWOW64\Aaolidlk.exeC:\Windows\system32\Aaolidlk.exe112⤵PID:772
-
C:\Windows\SysWOW64\Aijpnfif.exeC:\Windows\system32\Aijpnfif.exe113⤵PID:1308
-
C:\Windows\SysWOW64\Abbeflpf.exeC:\Windows\system32\Abbeflpf.exe114⤵PID:2904
-
C:\Windows\SysWOW64\Bnielm32.exeC:\Windows\system32\Bnielm32.exe115⤵PID:1556
-
C:\Windows\SysWOW64\Beejng32.exeC:\Windows\system32\Beejng32.exe116⤵PID:2928
-
C:\Windows\SysWOW64\Blobjaba.exeC:\Windows\system32\Blobjaba.exe117⤵PID:2880
-
C:\Windows\SysWOW64\Behgcf32.exeC:\Windows\system32\Behgcf32.exe118⤵PID:2820
-
C:\Windows\SysWOW64\Bdmddc32.exeC:\Windows\system32\Bdmddc32.exe119⤵PID:2268
-
C:\Windows\SysWOW64\Baadng32.exeC:\Windows\system32\Baadng32.exe120⤵PID:2804
-
C:\Windows\SysWOW64\Cfnmfn32.exeC:\Windows\system32\Cfnmfn32.exe121⤵PID:1856
-
C:\Windows\SysWOW64\Cbdnko32.exeC:\Windows\system32\Cbdnko32.exe122⤵PID:2504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-