Analysis
-
max time kernel
1s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 04:17
Static task
static1
Behavioral task
behavioral1
Sample
34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe
-
Size
608KB
-
MD5
ce7606e59bcc18b1b2efae9354907820
-
SHA1
47f88ce3fba55e254c4a8555de1ea277e43d5af6
-
SHA256
34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e
-
SHA512
1dc6e17584401681befbe7403fe0fe5d978e65c1e3ba2f7f7f52634fc21c1280b404b65684e3e7075c2177cd858652b8b5b7589aecbb4719d923264c8d7ca8b4
-
SSDEEP
12288:NdYkY660fIaDZkY660f8jTK/XhdAwlt01t:NCgsaDZgQjGkwlg
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 18 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ohendqhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nlcnda32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ookmfk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngfflj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmbknddp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nmbknddp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Npccpo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ocdmaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ookmfk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohendqhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ngfflj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nlcnda32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nmnace32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Npccpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ocdmaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" 34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmnace32.exe -
Executes dropped EXE 9 IoCs
pid Process 3012 Nmnace32.exe 2728 Ngfflj32.exe 2600 Nlcnda32.exe 2416 Nmbknddp.exe 2480 Npccpo32.exe 2528 Ocdmaj32.exe 756 Ookmfk32.exe 2832 Ohendqhd.exe 2288 Oqacic32.exe -
Loads dropped DLL 18 IoCs
pid Process 2140 34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe 2140 34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe 3012 Nmnace32.exe 3012 Nmnace32.exe 2728 Ngfflj32.exe 2728 Ngfflj32.exe 2600 Nlcnda32.exe 2600 Nlcnda32.exe 2416 Nmbknddp.exe 2416 Nmbknddp.exe 2480 Npccpo32.exe 2480 Npccpo32.exe 2528 Ocdmaj32.exe 2528 Ocdmaj32.exe 756 Ookmfk32.exe 756 Ookmfk32.exe 2832 Ohendqhd.exe 2832 Ohendqhd.exe -
Drops file in System32 directory 27 IoCs
description ioc Process File created C:\Windows\SysWOW64\Blkepk32.dll Npccpo32.exe File created C:\Windows\SysWOW64\Ohendqhd.exe Ookmfk32.exe File created C:\Windows\SysWOW64\Hljdna32.dll Nmnace32.exe File created C:\Windows\SysWOW64\Npccpo32.exe Nmbknddp.exe File opened for modification C:\Windows\SysWOW64\Oqacic32.exe Ohendqhd.exe File created C:\Windows\SysWOW64\Ngoohnkj.dll Nlcnda32.exe File opened for modification C:\Windows\SysWOW64\Ohendqhd.exe Ookmfk32.exe File created C:\Windows\SysWOW64\Oqacic32.exe Ohendqhd.exe File created C:\Windows\SysWOW64\Ghkekdhl.dll Ohendqhd.exe File created C:\Windows\SysWOW64\Fibkpd32.dll 34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Ogjgkqaa.dll Ngfflj32.exe File created C:\Windows\SysWOW64\Nlcnda32.exe Ngfflj32.exe File opened for modification C:\Windows\SysWOW64\Ocdmaj32.exe Npccpo32.exe File created C:\Windows\SysWOW64\Nmnace32.exe 34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Ngfflj32.exe Nmnace32.exe File created C:\Windows\SysWOW64\Lmpgcm32.dll Ocdmaj32.exe File opened for modification C:\Windows\SysWOW64\Ngfflj32.exe Nmnace32.exe File created C:\Windows\SysWOW64\Ookmfk32.exe Ocdmaj32.exe File created C:\Windows\SysWOW64\Oackeakj.dll Nmbknddp.exe File created C:\Windows\SysWOW64\Ocdmaj32.exe Npccpo32.exe File opened for modification C:\Windows\SysWOW64\Ookmfk32.exe Ocdmaj32.exe File opened for modification C:\Windows\SysWOW64\Nmbknddp.exe Nlcnda32.exe File opened for modification C:\Windows\SysWOW64\Npccpo32.exe Nmbknddp.exe File created C:\Windows\SysWOW64\Aaapnkij.dll Ookmfk32.exe File opened for modification C:\Windows\SysWOW64\Nmnace32.exe 34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Nlcnda32.exe Ngfflj32.exe File created C:\Windows\SysWOW64\Nmbknddp.exe Nlcnda32.exe -
Program crash 1 IoCs
pid pid_target Process 4392 4280 WerFault.exe -
Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aaapnkij.dll" Ookmfk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ohendqhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghkekdhl.dll" Ohendqhd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nmnace32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hljdna32.dll" Nmnace32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngoohnkj.dll" Nlcnda32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nmbknddp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oackeakj.dll" Nmbknddp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blkepk32.dll" Npccpo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ocdmaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ookmfk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogjgkqaa.dll" Ngfflj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nlcnda32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Npccpo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nmnace32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nlcnda32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Npccpo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717} 34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" 34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nmbknddp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmpgcm32.dll" Ocdmaj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ngfflj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ngfflj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ookmfk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibkpd32.dll" 34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ocdmaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ohendqhd.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2140 wrote to memory of 3012 2140 34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe 28 PID 2140 wrote to memory of 3012 2140 34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe 28 PID 2140 wrote to memory of 3012 2140 34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe 28 PID 2140 wrote to memory of 3012 2140 34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe 28 PID 3012 wrote to memory of 2728 3012 Nmnace32.exe 29 PID 3012 wrote to memory of 2728 3012 Nmnace32.exe 29 PID 3012 wrote to memory of 2728 3012 Nmnace32.exe 29 PID 3012 wrote to memory of 2728 3012 Nmnace32.exe 29 PID 2728 wrote to memory of 2600 2728 Ngfflj32.exe 30 PID 2728 wrote to memory of 2600 2728 Ngfflj32.exe 30 PID 2728 wrote to memory of 2600 2728 Ngfflj32.exe 30 PID 2728 wrote to memory of 2600 2728 Ngfflj32.exe 30 PID 2600 wrote to memory of 2416 2600 Nlcnda32.exe 31 PID 2600 wrote to memory of 2416 2600 Nlcnda32.exe 31 PID 2600 wrote to memory of 2416 2600 Nlcnda32.exe 31 PID 2600 wrote to memory of 2416 2600 Nlcnda32.exe 31 PID 2416 wrote to memory of 2480 2416 Nmbknddp.exe 32 PID 2416 wrote to memory of 2480 2416 Nmbknddp.exe 32 PID 2416 wrote to memory of 2480 2416 Nmbknddp.exe 32 PID 2416 wrote to memory of 2480 2416 Nmbknddp.exe 32 PID 2480 wrote to memory of 2528 2480 Npccpo32.exe 33 PID 2480 wrote to memory of 2528 2480 Npccpo32.exe 33 PID 2480 wrote to memory of 2528 2480 Npccpo32.exe 33 PID 2480 wrote to memory of 2528 2480 Npccpo32.exe 33 PID 2528 wrote to memory of 756 2528 Ocdmaj32.exe 34 PID 2528 wrote to memory of 756 2528 Ocdmaj32.exe 34 PID 2528 wrote to memory of 756 2528 Ocdmaj32.exe 34 PID 2528 wrote to memory of 756 2528 Ocdmaj32.exe 34 PID 756 wrote to memory of 2832 756 Ookmfk32.exe 35 PID 756 wrote to memory of 2832 756 Ookmfk32.exe 35 PID 756 wrote to memory of 2832 756 Ookmfk32.exe 35 PID 756 wrote to memory of 2832 756 Ookmfk32.exe 35 PID 2832 wrote to memory of 2288 2832 Ohendqhd.exe 36 PID 2832 wrote to memory of 2288 2832 Ohendqhd.exe 36 PID 2832 wrote to memory of 2288 2832 Ohendqhd.exe 36 PID 2832 wrote to memory of 2288 2832 Ohendqhd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e_NeikiAnalytics.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\Nmnace32.exeC:\Windows\system32\Nmnace32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\Ngfflj32.exeC:\Windows\system32\Ngfflj32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\Nlcnda32.exeC:\Windows\system32\Nlcnda32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\Nmbknddp.exeC:\Windows\system32\Nmbknddp.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\Npccpo32.exeC:\Windows\system32\Npccpo32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\Ocdmaj32.exeC:\Windows\system32\Ocdmaj32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\Ookmfk32.exeC:\Windows\system32\Ookmfk32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\Ohendqhd.exeC:\Windows\system32\Ohendqhd.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\Oqacic32.exeC:\Windows\system32\Oqacic32.exe10⤵
- Executes dropped EXE
PID:2288 -
C:\Windows\SysWOW64\Pgpeal32.exeC:\Windows\system32\Pgpeal32.exe11⤵PID:1784
-
C:\Windows\SysWOW64\Pqhijbog.exeC:\Windows\system32\Pqhijbog.exe12⤵PID:1924
-
C:\Windows\SysWOW64\Picnndmb.exeC:\Windows\system32\Picnndmb.exe13⤵PID:2248
-
C:\Windows\SysWOW64\Pbkbgjcc.exeC:\Windows\system32\Pbkbgjcc.exe14⤵PID:1044
-
C:\Windows\SysWOW64\Afgkfl32.exeC:\Windows\system32\Afgkfl32.exe15⤵PID:1580
-
C:\Windows\SysWOW64\Apoooa32.exeC:\Windows\system32\Apoooa32.exe16⤵PID:2296
-
C:\Windows\SysWOW64\Aaolidlk.exeC:\Windows\system32\Aaolidlk.exe17⤵PID:2388
-
C:\Windows\SysWOW64\Bfpnmj32.exeC:\Windows\system32\Bfpnmj32.exe18⤵PID:2412
-
C:\Windows\SysWOW64\Bnkbam32.exeC:\Windows\system32\Bnkbam32.exe19⤵PID:2428
-
C:\Windows\SysWOW64\Bjbcfn32.exeC:\Windows\system32\Bjbcfn32.exe20⤵PID:2148
-
C:\Windows\SysWOW64\Bdkgocpm.exeC:\Windows\system32\Bdkgocpm.exe21⤵PID:1624
-
C:\Windows\SysWOW64\Bfkpqn32.exeC:\Windows\system32\Bfkpqn32.exe22⤵PID:1556
-
C:\Windows\SysWOW64\Cdoajb32.exeC:\Windows\system32\Cdoajb32.exe23⤵PID:1028
-
C:\Windows\SysWOW64\Cilibi32.exeC:\Windows\system32\Cilibi32.exe24⤵PID:1048
-
C:\Windows\SysWOW64\Cbdnko32.exeC:\Windows\system32\Cbdnko32.exe25⤵PID:1736
-
C:\Windows\SysWOW64\Cddjebgb.exeC:\Windows\system32\Cddjebgb.exe26⤵PID:2864
-
C:\Windows\SysWOW64\Cegcbjkn.exeC:\Windows\system32\Cegcbjkn.exe27⤵PID:2960
-
C:\Windows\SysWOW64\Cpmhpbkc.exeC:\Windows\system32\Cpmhpbkc.exe28⤵PID:2092
-
C:\Windows\SysWOW64\Cejphiik.exeC:\Windows\system32\Cejphiik.exe29⤵PID:1596
-
C:\Windows\SysWOW64\Dobdqo32.exeC:\Windows\system32\Dobdqo32.exe30⤵PID:2636
-
C:\Windows\SysWOW64\Djqoll32.exeC:\Windows\system32\Djqoll32.exe31⤵PID:2620
-
C:\Windows\SysWOW64\Dgdpfp32.exeC:\Windows\system32\Dgdpfp32.exe32⤵PID:2556
-
C:\Windows\SysWOW64\Efjlgmlf.exeC:\Windows\system32\Efjlgmlf.exe33⤵PID:580
-
C:\Windows\SysWOW64\Eobapbbg.exeC:\Windows\system32\Eobapbbg.exe34⤵PID:2116
-
C:\Windows\SysWOW64\Fokdfajl.exeC:\Windows\system32\Fokdfajl.exe35⤵PID:1232
-
C:\Windows\SysWOW64\Fblmglgm.exeC:\Windows\system32\Fblmglgm.exe36⤵PID:1428
-
C:\Windows\SysWOW64\Fgkbeb32.exeC:\Windows\system32\Fgkbeb32.exe37⤵PID:948
-
C:\Windows\SysWOW64\Fpffje32.exeC:\Windows\system32\Fpffje32.exe38⤵PID:1944
-
C:\Windows\SysWOW64\Fmjgcipg.exeC:\Windows\system32\Fmjgcipg.exe39⤵PID:928
-
C:\Windows\SysWOW64\Giahhj32.exeC:\Windows\system32\Giahhj32.exe40⤵PID:2880
-
C:\Windows\SysWOW64\Gfehan32.exeC:\Windows\system32\Gfehan32.exe41⤵PID:1308
-
C:\Windows\SysWOW64\Gbnflo32.exeC:\Windows\system32\Gbnflo32.exe42⤵PID:544
-
C:\Windows\SysWOW64\Ghkndf32.exeC:\Windows\system32\Ghkndf32.exe43⤵PID:2012
-
C:\Windows\SysWOW64\Gdboig32.exeC:\Windows\system32\Gdboig32.exe44⤵PID:2200
-
C:\Windows\SysWOW64\Gngcgp32.exeC:\Windows\system32\Gngcgp32.exe45⤵PID:1388
-
C:\Windows\SysWOW64\Heakcjcd.exeC:\Windows\system32\Heakcjcd.exe46⤵PID:2256
-
C:\Windows\SysWOW64\Hjndlqal.exeC:\Windows\system32\Hjndlqal.exe47⤵PID:2380
-
C:\Windows\SysWOW64\Hdfhdfgl.exeC:\Windows\system32\Hdfhdfgl.exe48⤵PID:2896
-
C:\Windows\SysWOW64\Hpmiig32.exeC:\Windows\system32\Hpmiig32.exe49⤵PID:2236
-
C:\Windows\SysWOW64\Hjcmgp32.exeC:\Windows\system32\Hjcmgp32.exe50⤵PID:2192
-
C:\Windows\SysWOW64\Hdkape32.exeC:\Windows\system32\Hdkape32.exe51⤵PID:2664
-
C:\Windows\SysWOW64\Hmcfhkjg.exeC:\Windows\system32\Hmcfhkjg.exe52⤵PID:2676
-
C:\Windows\SysWOW64\Hflkaq32.exeC:\Windows\system32\Hflkaq32.exe53⤵PID:1956
-
C:\Windows\SysWOW64\Ilicig32.exeC:\Windows\system32\Ilicig32.exe54⤵PID:264
-
C:\Windows\SysWOW64\Iaelanmg.exeC:\Windows\system32\Iaelanmg.exe55⤵PID:2908
-
C:\Windows\SysWOW64\Ilkpogmm.exeC:\Windows\system32\Ilkpogmm.exe56⤵PID:2032
-
C:\Windows\SysWOW64\Ibehla32.exeC:\Windows\system32\Ibehla32.exe57⤵PID:2156
-
C:\Windows\SysWOW64\Ihbqdh32.exeC:\Windows\system32\Ihbqdh32.exe58⤵PID:1948
-
C:\Windows\SysWOW64\Iajemnia.exeC:\Windows\system32\Iajemnia.exe59⤵PID:2552
-
C:\Windows\SysWOW64\Iggned32.exeC:\Windows\system32\Iggned32.exe60⤵PID:2844
-
C:\Windows\SysWOW64\Ippbnjni.exeC:\Windows\system32\Ippbnjni.exe61⤵PID:1728
-
C:\Windows\SysWOW64\Iihfgp32.exeC:\Windows\system32\Iihfgp32.exe62⤵PID:536
-
C:\Windows\SysWOW64\Ipbocjlg.exeC:\Windows\system32\Ipbocjlg.exe63⤵PID:1628
-
C:\Windows\SysWOW64\Jjjclobg.exeC:\Windows\system32\Jjjclobg.exe64⤵PID:2152
-
C:\Windows\SysWOW64\Jcbhee32.exeC:\Windows\system32\Jcbhee32.exe65⤵PID:1848
-
C:\Windows\SysWOW64\Jnhlbn32.exeC:\Windows\system32\Jnhlbn32.exe66⤵PID:1532
-
C:\Windows\SysWOW64\Jcedkd32.exeC:\Windows\system32\Jcedkd32.exe67⤵PID:2356
-
C:\Windows\SysWOW64\Jajala32.exeC:\Windows\system32\Jajala32.exe68⤵PID:2320
-
C:\Windows\SysWOW64\Jhdihkcj.exeC:\Windows\system32\Jhdihkcj.exe69⤵PID:2696
-
C:\Windows\SysWOW64\Jcjnfdbp.exeC:\Windows\system32\Jcjnfdbp.exe70⤵PID:2616
-
C:\Windows\SysWOW64\Jdkjnl32.exeC:\Windows\system32\Jdkjnl32.exe71⤵PID:1156
-
C:\Windows\SysWOW64\Kopokehd.exeC:\Windows\system32\Kopokehd.exe72⤵PID:1780
-
C:\Windows\SysWOW64\Kdpcikdi.exeC:\Windows\system32\Kdpcikdi.exe73⤵PID:2824
-
C:\Windows\SysWOW64\Kjllab32.exeC:\Windows\system32\Kjllab32.exe74⤵PID:2512
-
C:\Windows\SysWOW64\Kdbpnk32.exeC:\Windows\system32\Kdbpnk32.exe75⤵PID:1112
-
C:\Windows\SysWOW64\Kklikejc.exeC:\Windows\system32\Kklikejc.exe76⤵PID:1692
-
C:\Windows\SysWOW64\Kqiaclhj.exeC:\Windows\system32\Kqiaclhj.exe77⤵PID:2456
-
C:\Windows\SysWOW64\Kfeikcfa.exeC:\Windows\system32\Kfeikcfa.exe78⤵PID:1700
-
C:\Windows\SysWOW64\Konndhmb.exeC:\Windows\system32\Konndhmb.exe79⤵PID:2348
-
C:\Windows\SysWOW64\Lfhfab32.exeC:\Windows\system32\Lfhfab32.exe80⤵PID:2708
-
C:\Windows\SysWOW64\Lbogfcjc.exeC:\Windows\system32\Lbogfcjc.exe81⤵PID:1732
-
C:\Windows\SysWOW64\Lmdkcl32.exeC:\Windows\system32\Lmdkcl32.exe82⤵PID:3048
-
C:\Windows\SysWOW64\Lbackc32.exeC:\Windows\system32\Lbackc32.exe83⤵PID:2924
-
C:\Windows\SysWOW64\Lkihdioa.exeC:\Windows\system32\Lkihdioa.exe84⤵PID:2328
-
C:\Windows\SysWOW64\Lfolaang.exeC:\Windows\system32\Lfolaang.exe85⤵PID:2484
-
C:\Windows\SysWOW64\Lpgajgeg.exeC:\Windows\system32\Lpgajgeg.exe86⤵PID:1488
-
C:\Windows\SysWOW64\Lipecm32.exeC:\Windows\system32\Lipecm32.exe87⤵PID:1484
-
C:\Windows\SysWOW64\Mbhjlbbh.exeC:\Windows\system32\Mbhjlbbh.exe88⤵PID:1788
-
C:\Windows\SysWOW64\Mgebdipp.exeC:\Windows\system32\Mgebdipp.exe89⤵PID:932
-
C:\Windows\SysWOW64\Mamgmofp.exeC:\Windows\system32\Mamgmofp.exe90⤵PID:2684
-
C:\Windows\SysWOW64\Mnaggcej.exeC:\Windows\system32\Mnaggcej.exe91⤵PID:2440
-
C:\Windows\SysWOW64\Mfllkece.exeC:\Windows\system32\Mfllkece.exe92⤵PID:2892
-
C:\Windows\SysWOW64\Mabphn32.exeC:\Windows\system32\Mabphn32.exe93⤵PID:2316
-
C:\Windows\SysWOW64\Mfoiqe32.exeC:\Windows\system32\Mfoiqe32.exe94⤵PID:1620
-
C:\Windows\SysWOW64\Mpgmijgc.exeC:\Windows\system32\Mpgmijgc.exe95⤵PID:1540
-
C:\Windows\SysWOW64\Mioabp32.exeC:\Windows\system32\Mioabp32.exe96⤵PID:2064
-
C:\Windows\SysWOW64\Npijoj32.exeC:\Windows\system32\Npijoj32.exe97⤵PID:1748
-
C:\Windows\SysWOW64\Nfcbldmm.exeC:\Windows\system32\Nfcbldmm.exe98⤵PID:2752
-
C:\Windows\SysWOW64\Nlpkdkkd.exeC:\Windows\system32\Nlpkdkkd.exe99⤵PID:2660
-
C:\Windows\SysWOW64\Nehomq32.exeC:\Windows\system32\Nehomq32.exe100⤵PID:2604
-
C:\Windows\SysWOW64\Nlbgikia.exeC:\Windows\system32\Nlbgikia.exe101⤵PID:2856
-
C:\Windows\SysWOW64\Naopaa32.exeC:\Windows\system32\Naopaa32.exe102⤵PID:2500
-
C:\Windows\SysWOW64\Nledoj32.exeC:\Windows\system32\Nledoj32.exe103⤵PID:1680
-
C:\Windows\SysWOW64\Ogcnkgoh.exeC:\Windows\system32\Ogcnkgoh.exe104⤵PID:2268
-
C:\Windows\SysWOW64\Opkccm32.exeC:\Windows\system32\Opkccm32.exe105⤵PID:2372
-
C:\Windows\SysWOW64\Oidglb32.exeC:\Windows\system32\Oidglb32.exe106⤵PID:1576
-
C:\Windows\SysWOW64\Ooqpdj32.exeC:\Windows\system32\Ooqpdj32.exe107⤵PID:2900
-
C:\Windows\SysWOW64\Oifdbb32.exeC:\Windows\system32\Oifdbb32.exe108⤵PID:1516
-
C:\Windows\SysWOW64\Ohkaco32.exeC:\Windows\system32\Ohkaco32.exe109⤵PID:1688
-
C:\Windows\SysWOW64\Padeldeo.exeC:\Windows\system32\Padeldeo.exe110⤵PID:560
-
C:\Windows\SysWOW64\Plijimee.exeC:\Windows\system32\Plijimee.exe111⤵PID:632
-
C:\Windows\SysWOW64\Pgckjk32.exeC:\Windows\system32\Pgckjk32.exe112⤵PID:1844
-
C:\Windows\SysWOW64\Pnmcfeia.exeC:\Windows\system32\Pnmcfeia.exe113⤵PID:752
-
C:\Windows\SysWOW64\Phbgcnig.exeC:\Windows\system32\Phbgcnig.exe114⤵PID:852
-
C:\Windows\SysWOW64\Pqnlhpfb.exeC:\Windows\system32\Pqnlhpfb.exe115⤵PID:924
-
C:\Windows\SysWOW64\Pnalad32.exeC:\Windows\system32\Pnalad32.exe116⤵PID:2392
-
C:\Windows\SysWOW64\Qgjqjjll.exeC:\Windows\system32\Qgjqjjll.exe117⤵PID:2360
-
C:\Windows\SysWOW64\Qoeeolig.exeC:\Windows\system32\Qoeeolig.exe118⤵PID:2768
-
C:\Windows\SysWOW64\Qinjgbpg.exeC:\Windows\system32\Qinjgbpg.exe119⤵PID:3064
-
C:\Windows\SysWOW64\Ajmfad32.exeC:\Windows\system32\Ajmfad32.exe120⤵PID:1768
-
C:\Windows\SysWOW64\Abhkfg32.exeC:\Windows\system32\Abhkfg32.exe121⤵PID:2952
-
C:\Windows\SysWOW64\Aibcba32.exeC:\Windows\system32\Aibcba32.exe122⤵PID:1392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-