Analysis
-
max time kernel
136s -
max time network
142s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
05-05-2021 00:00
Static task
static1
Behavioral task
behavioral1
Sample
3894730d7c0d8a614dd2d59188ab70de82d24589e67b5c72b43de2b4cbb4c734.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
3894730d7c0d8a614dd2d59188ab70de82d24589e67b5c72b43de2b4cbb4c734.exe
Resource
win10v20210410
General
-
Target
3894730d7c0d8a614dd2d59188ab70de82d24589e67b5c72b43de2b4cbb4c734.exe
-
Size
1.3MB
-
MD5
6ccfd5766caccc7e5192cf67b440cb84
-
SHA1
7d501bda9ba46fa5e11176a061e91e2bb5cbce7b
-
SHA256
3894730d7c0d8a614dd2d59188ab70de82d24589e67b5c72b43de2b4cbb4c734
-
SHA512
a0e010ad1a7090bb5512e3b7caba1a9797de8c0ceca91573682e2cc74ca2bad55028a121397819534e65e7e22df50490fbda661f9a656dacd95f248007e8ad61
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs
-
Executes dropped EXE 64 IoCs
Processes:
Ecmfik32.exeGhqaad32.exeHkfcnn32.exeHniieicp.exeHcfampag.exeImelfd32.exeIbdadk32.exeIeejffke.exeJmeheh32.exeJpfagcbl.exeNmfnpidm.exeNmhjfibj.exeOfbhcaic.exePhmgah32.exeAoglmf32.exeBonanekg.exeCbljic32.exeCbognc32.exeCihokm32.exeCnegcd32.exeCfmpda32.exeCnhdid32.exeCeamen32.exeCklebhmo.exeDbemob32.exeDcgifjkj.exeDjaacd32.exeDeffqm32.exeDgebmiaq.exeDmakepoh.exeDclcaj32.exeDjekndna.exeDapckn32.exeDbqpbfkm.exeDikhopbi.exeDpeplj32.exeDfohidac.exeEmiaeo32.exeEbeine32.exeEhbafleo.exeEpijgjfa.exeEakfob32.exeEianpo32.exeEkckhgbp.exeEamcda32.exeEhgkalai.exeEoacnfif.exeEaopjahj.exeEglhbhfa.exeEmfpob32.exeFdphllek.exeFgoehhdo.exeFadieq32.exeFdbeal32.exeFklnnfje.exeFpiffmil.exeFcgbbhhp.exeFiajob32.exeFcjohh32.exeFidgdbmj.exeFlbcqnln.exeFcllmh32.exeFifdjbkg.exeGkgpbjaf.exepid process 1176 Ecmfik32.exe 1996 Ghqaad32.exe 1956 Hkfcnn32.exe 1712 Hniieicp.exe 1692 Hcfampag.exe 1464 Imelfd32.exe 1632 Ibdadk32.exe 1796 Ieejffke.exe 1636 Jmeheh32.exe 416 Jpfagcbl.exe 772 Nmfnpidm.exe 1316 Nmhjfibj.exe 2028 Ofbhcaic.exe 764 Phmgah32.exe 1684 Aoglmf32.exe 1276 Bonanekg.exe 1820 Cbljic32.exe 1744 Cbognc32.exe 1648 Cihokm32.exe 1688 Cnegcd32.exe 1976 Cfmpda32.exe 1840 Cnhdid32.exe 1792 Ceamen32.exe 1524 Cklebhmo.exe 1872 Dbemob32.exe 1472 Dcgifjkj.exe 1644 Djaacd32.exe 112 Deffqm32.exe 268 Dgebmiaq.exe 1728 Dmakepoh.exe 1640 Dclcaj32.exe 1080 Djekndna.exe 836 Dapckn32.exe 880 Dbqpbfkm.exe 304 Dikhopbi.exe 1104 Dpeplj32.exe 1600 Dfohidac.exe 1992 Emiaeo32.exe 1984 Ebeine32.exe 2000 Ehbafleo.exe 1584 Epijgjfa.exe 1952 Eakfob32.exe 428 Eianpo32.exe 1696 Ekckhgbp.exe 1972 Eamcda32.exe 1100 Ehgkalai.exe 760 Eoacnfif.exe 2004 Eaopjahj.exe 1852 Eglhbhfa.exe 276 Emfpob32.exe 1604 Fdphllek.exe 1596 Fgoehhdo.exe 2056 Fadieq32.exe 2068 Fdbeal32.exe 2080 Fklnnfje.exe 2092 Fpiffmil.exe 2104 Fcgbbhhp.exe 2116 Fiajob32.exe 2128 Fcjohh32.exe 2140 Fidgdbmj.exe 2152 Flbcqnln.exe 2164 Fcllmh32.exe 2176 Fifdjbkg.exe 2188 Gkgpbjaf.exe -
Loads dropped DLL 64 IoCs
Processes:
3894730d7c0d8a614dd2d59188ab70de82d24589e67b5c72b43de2b4cbb4c734.exeEcmfik32.exeGhqaad32.exeHkfcnn32.exeHniieicp.exeHcfampag.exeImelfd32.exeIbdadk32.exeIeejffke.exeJmeheh32.exeJpfagcbl.exeNmfnpidm.exeNmhjfibj.exeOfbhcaic.exePhmgah32.exeAoglmf32.exeBonanekg.exeCbljic32.exeCbognc32.exeCihokm32.exeCnegcd32.exeCfmpda32.exeCnhdid32.exeCeamen32.exeCklebhmo.exeDbemob32.exeDcgifjkj.exeDjaacd32.exeDeffqm32.exeDgebmiaq.exeDmakepoh.exeDclcaj32.exepid process 1652 3894730d7c0d8a614dd2d59188ab70de82d24589e67b5c72b43de2b4cbb4c734.exe 1652 3894730d7c0d8a614dd2d59188ab70de82d24589e67b5c72b43de2b4cbb4c734.exe 1176 Ecmfik32.exe 1176 Ecmfik32.exe 1996 Ghqaad32.exe 1996 Ghqaad32.exe 1956 Hkfcnn32.exe 1956 Hkfcnn32.exe 1712 Hniieicp.exe 1712 Hniieicp.exe 1692 Hcfampag.exe 1692 Hcfampag.exe 1464 Imelfd32.exe 1464 Imelfd32.exe 1632 Ibdadk32.exe 1632 Ibdadk32.exe 1796 Ieejffke.exe 1796 Ieejffke.exe 1636 Jmeheh32.exe 1636 Jmeheh32.exe 416 Jpfagcbl.exe 416 Jpfagcbl.exe 772 Nmfnpidm.exe 772 Nmfnpidm.exe 1316 Nmhjfibj.exe 1316 Nmhjfibj.exe 2028 Ofbhcaic.exe 2028 Ofbhcaic.exe 764 Phmgah32.exe 764 Phmgah32.exe 1684 Aoglmf32.exe 1684 Aoglmf32.exe 1276 Bonanekg.exe 1276 Bonanekg.exe 1820 Cbljic32.exe 1820 Cbljic32.exe 1744 Cbognc32.exe 1744 Cbognc32.exe 1648 Cihokm32.exe 1648 Cihokm32.exe 1688 Cnegcd32.exe 1688 Cnegcd32.exe 1976 Cfmpda32.exe 1976 Cfmpda32.exe 1840 Cnhdid32.exe 1840 Cnhdid32.exe 1792 Ceamen32.exe 1792 Ceamen32.exe 1524 Cklebhmo.exe 1524 Cklebhmo.exe 1872 Dbemob32.exe 1872 Dbemob32.exe 1472 Dcgifjkj.exe 1472 Dcgifjkj.exe 1644 Djaacd32.exe 1644 Djaacd32.exe 112 Deffqm32.exe 112 Deffqm32.exe 268 Dgebmiaq.exe 268 Dgebmiaq.exe 1728 Dmakepoh.exe 1728 Dmakepoh.exe 1640 Dclcaj32.exe 1640 Dclcaj32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Ehbafleo.exeJplhfn32.exeKhfbpmbf.exeHockjeco.exeBpdcoo32.exeEckkoomh.exeDbemob32.exeOephihqg.exeOljpfb32.exeFgoehhdo.exeHogblkhe.exeOhcmqc32.exePphekd32.exeMckhpf32.exeCnegcd32.exeIeidpa32.exeJjpagpph.exeGfbfpm32.exeCfmpda32.exeNkjcgo32.exeAieehb32.exeGpincb32.exeIpgnkojq.exeDbpihpha.exeLpeidi32.exePidcnenh.exeKjfdgblk.exeNgdcjiqo.exeDngjmqme.exeEakhhkcc.exeNodekg32.exeKjbjlc32.exeKlhqnj32.exeDkndqp32.exeGpidnibl.exeMegggben.exeGdmakjfm.exeDpebecaj.exeLkfpfe32.exeFeodlgad.exeFlbcqnln.exeHaqnca32.exeAkqkpole.exeDjekndna.exeKbojml32.exeLmojcbfp.exeAioohg32.exeBijkbdil.exeDoboem32.exeGmhebg32.exeCklebhmo.exeDlfqlf32.exeGgfipc32.exeQichbbmh.exeChfncp32.exeLllgqa32.exeJoogef32.exeEnglfi32.exeMogllj32.exeOmkecdjg.exeHaapljof.exeNmpijg32.exedescription ioc process File created C:\Windows\SysWOW64\Epijgjfa.exe Ehbafleo.exe File created C:\Windows\SysWOW64\Eebiphpc.dll Jplhfn32.exe File created C:\Windows\SysWOW64\Kobgaghp.exe Khfbpmbf.exe File opened for modification C:\Windows\SysWOW64\Hgjckbdq.exe Hockjeco.exe File opened for modification C:\Windows\SysWOW64\Beqkge32.exe Bpdcoo32.exe File created C:\Windows\SysWOW64\Ebhejieh.dll Eckkoomh.exe File created C:\Windows\SysWOW64\Dcgifjkj.exe Dbemob32.exe File created C:\Windows\SysWOW64\Mgpgfhea.dll Oephihqg.exe File opened for modification C:\Windows\SysWOW64\Onhlbn32.exe Oljpfb32.exe File created C:\Windows\SysWOW64\Fadieq32.exe Fgoehhdo.exe File opened for modification C:\Windows\SysWOW64\Hfajie32.exe Hogblkhe.exe File opened for modification C:\Windows\SysWOW64\Ojaimo32.exe Ohcmqc32.exe File created C:\Windows\SysWOW64\Bnpnhcfe.dll Pphekd32.exe File opened for modification C:\Windows\SysWOW64\Nhhphm32.exe Mckhpf32.exe File created C:\Windows\SysWOW64\Cfmpda32.exe Cnegcd32.exe File created C:\Windows\SysWOW64\Ikclmlid.exe Ieidpa32.exe File created C:\Windows\SysWOW64\Jchfpefh.exe Jjpagpph.exe File opened for modification C:\Windows\SysWOW64\Gpkjibmn.exe Gfbfpm32.exe File created C:\Windows\SysWOW64\Cnhdid32.exe Cfmpda32.exe File created C:\Windows\SysWOW64\Nbdldimf.exe Nkjcgo32.exe File created C:\Windows\SysWOW64\Gimadp32.dll Aieehb32.exe File opened for modification C:\Windows\SysWOW64\Gfbfpm32.exe Gpincb32.exe File opened for modification C:\Windows\SysWOW64\Epijgjfa.exe Ehbafleo.exe File opened for modification C:\Windows\SysWOW64\Fadieq32.exe Fgoehhdo.exe File created C:\Windows\SysWOW64\Ljgpfeoo.dll Ipgnkojq.exe File created C:\Windows\SysWOW64\Dngjmqme.exe Dbpihpha.exe File created C:\Windows\SysWOW64\Lebamp32.exe Lpeidi32.exe File created C:\Windows\SysWOW64\Caklkd32.dll Pidcnenh.exe File created C:\Windows\SysWOW64\Ilcpckkh.dll Kjfdgblk.exe File created C:\Windows\SysWOW64\Cpfdec32.dll Ngdcjiqo.exe File opened for modification C:\Windows\SysWOW64\Enifcqkb.exe Dngjmqme.exe File created C:\Windows\SysWOW64\Ebjeam32.exe Eakhhkcc.exe File created C:\Windows\SysWOW64\Ndqncn32.exe Nodekg32.exe File created C:\Windows\SysWOW64\Kalchmgn.exe Kjbjlc32.exe File created C:\Windows\SysWOW64\Kbaikdif.exe Klhqnj32.exe File opened for modification C:\Windows\SysWOW64\Ddghif32.exe Dkndqp32.exe File opened for modification C:\Windows\SysWOW64\Gkoikbbb.exe Gpidnibl.exe File opened for modification C:\Windows\SysWOW64\Mckhpf32.exe Megggben.exe File created C:\Windows\SysWOW64\Bnjpecja.dll Gdmakjfm.exe File created C:\Windows\SysWOW64\Qbppnqgk.dll Dpebecaj.exe File created C:\Windows\SysWOW64\Pkajdlmn.dll Lkfpfe32.exe File created C:\Windows\SysWOW64\Eopidodf.dll Feodlgad.exe File created C:\Windows\SysWOW64\Fcllmh32.exe Flbcqnln.exe File created C:\Windows\SysWOW64\Gijfjkpn.dll Haqnca32.exe File created C:\Windows\SysWOW64\Fjfcja32.dll Akqkpole.exe File created C:\Windows\SysWOW64\Dapckn32.exe Djekndna.exe File created C:\Windows\SysWOW64\Kiibifkb.exe Kbojml32.exe File opened for modification C:\Windows\SysWOW64\Lopfkkmn.exe Lmojcbfp.exe File opened for modification C:\Windows\SysWOW64\Akqkpole.exe Aioohg32.exe File opened for modification C:\Windows\SysWOW64\Bpdcoo32.exe Bijkbdil.exe File created C:\Windows\SysWOW64\Acjfeolf.dll Doboem32.exe File created C:\Windows\SysWOW64\Djlfcdlb.dll Gmhebg32.exe File opened for modification C:\Windows\SysWOW64\Dbemob32.exe Cklebhmo.exe File created C:\Windows\SysWOW64\Idiknc32.dll Dlfqlf32.exe File opened for modification C:\Windows\SysWOW64\Gmpamm32.exe Ggfipc32.exe File opened for modification C:\Windows\SysWOW64\Qpmqol32.exe Qichbbmh.exe File created C:\Windows\SysWOW64\Cjgjkhnj.exe Chfncp32.exe File created C:\Windows\SysWOW64\Hciiogqf.dll Lllgqa32.exe File opened for modification C:\Windows\SysWOW64\Jelomm32.exe Joogef32.exe File created C:\Windows\SysWOW64\Cckqbo32.dll Englfi32.exe File created C:\Windows\SysWOW64\Hpiibq32.dll Mogllj32.exe File created C:\Windows\SysWOW64\Opiaopik.exe Omkecdjg.exe File opened for modification C:\Windows\SysWOW64\Hgnidqmn.exe Haapljof.exe File created C:\Windows\SysWOW64\Efcdbafg.dll Nmpijg32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5940 5932 WerFault.exe Hdaine32.exe -
Modifies registry class 64 IoCs
Processes:
Gdmakjfm.exeHockjeco.exeFifdjbkg.exeJibpjdon.exeOjfgikdi.exeCghlfd32.exeHgjckbdq.exeQibfii32.exeCblcnm32.exeHojakdmf.exeKjfdgblk.exeNgafei32.exeQoooap32.exeLpkijnhf.exeHlleoh32.exeAnienldn.exeOdecmqdf.exeEnifcqkb.exeLmojcbfp.exeEpijgjfa.exeImibockm.exeDhjcnbfb.exePikind32.exeAbqmqm32.exeDbemob32.exeCnegcd32.exeOqahidge.exeLkfpfe32.exeEkklon32.exeEdcahcjc.exeHkdiag32.exeDhaqgd32.exeOfbhcaic.exeIgofml32.exeJmeheh32.exeOiobhp32.exeGnqkkk32.exeBceckpae.exeDpebecaj.exeBeqkge32.exeEgdjjn32.exeMkbflj32.exeJfklgp32.exeBjmnbj32.exeEcmfik32.exeJidloc32.exeObjkak32.exeHlbknc32.exeOohkejfo.exeBbkijkfd.exeBdpfjc32.exeGdpgchoj.exeBnfnmi32.exeNodekg32.exeDnbbkjio.exeLcfpmknm.exeIjphaf32.exeMkidfk32.exeFcjohh32.exeJjmohk32.exeNmpijg32.exeCamlaldj.exeEoacnfif.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gdmakjfm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hockjeco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fifdjbkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbajckqg.dll" Jibpjdon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ojfgikdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohfdhg32.dll" Cghlfd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hgjckbdq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmdlbg32.dll" Qibfii32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cblcnm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hojakdmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kjfdgblk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eckdfm32.dll" Ngafei32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qoooap32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lpkijnhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cepicd32.dll" Hlleoh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Anienldn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Odecmqdf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpomln32.dll" Enifcqkb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lmojcbfp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Epijgjfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Imibockm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Godafadg.dll" Dhjcnbfb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pikind32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejhhodoh.dll" Abqmqm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcigjpam.dll" Dbemob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eflmdcoc.dll" Cnegcd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjjppj32.dll" Oqahidge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lkfpfe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ekklon32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Edcahcjc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hkdiag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dhaqgd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ofbhcaic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Igofml32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jmeheh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oiobhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfgghn32.dll" Gnqkkk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aobokafm.dll" Bceckpae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dpebecaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Beqkge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dhjcnbfb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Egdjjn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mkbflj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jfklgp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bjmnbj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ecmfik32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jidloc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Objkak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghnpifek.dll" Hlbknc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgpfnnbi.dll" Oohkejfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bbkijkfd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bdpfjc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gdpgchoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eapqge32.dll" Bnfnmi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nodekg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eolnig32.dll" Dnbbkjio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhagjjop.dll" Lcfpmknm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ijphaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpihno32.dll" Mkidfk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgqmoi32.dll" Fcjohh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jjmohk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efcdbafg.dll" Nmpijg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Camlaldj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdklmi32.dll" Eoacnfif.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
WerFault.exepid process 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe 5940 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 5940 WerFault.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3894730d7c0d8a614dd2d59188ab70de82d24589e67b5c72b43de2b4cbb4c734.exeEcmfik32.exeGhqaad32.exeHkfcnn32.exeHniieicp.exeHcfampag.exeImelfd32.exeIbdadk32.exeIeejffke.exeJmeheh32.exeJpfagcbl.exeNmfnpidm.exeNmhjfibj.exeOfbhcaic.exePhmgah32.exeAoglmf32.exedescription pid process target process PID 1652 wrote to memory of 1176 1652 3894730d7c0d8a614dd2d59188ab70de82d24589e67b5c72b43de2b4cbb4c734.exe Ecmfik32.exe PID 1652 wrote to memory of 1176 1652 3894730d7c0d8a614dd2d59188ab70de82d24589e67b5c72b43de2b4cbb4c734.exe Ecmfik32.exe PID 1652 wrote to memory of 1176 1652 3894730d7c0d8a614dd2d59188ab70de82d24589e67b5c72b43de2b4cbb4c734.exe Ecmfik32.exe PID 1652 wrote to memory of 1176 1652 3894730d7c0d8a614dd2d59188ab70de82d24589e67b5c72b43de2b4cbb4c734.exe Ecmfik32.exe PID 1176 wrote to memory of 1996 1176 Ecmfik32.exe Ghqaad32.exe PID 1176 wrote to memory of 1996 1176 Ecmfik32.exe Ghqaad32.exe PID 1176 wrote to memory of 1996 1176 Ecmfik32.exe Ghqaad32.exe PID 1176 wrote to memory of 1996 1176 Ecmfik32.exe Ghqaad32.exe PID 1996 wrote to memory of 1956 1996 Ghqaad32.exe Hkfcnn32.exe PID 1996 wrote to memory of 1956 1996 Ghqaad32.exe Hkfcnn32.exe PID 1996 wrote to memory of 1956 1996 Ghqaad32.exe Hkfcnn32.exe PID 1996 wrote to memory of 1956 1996 Ghqaad32.exe Hkfcnn32.exe PID 1956 wrote to memory of 1712 1956 Hkfcnn32.exe Hniieicp.exe PID 1956 wrote to memory of 1712 1956 Hkfcnn32.exe Hniieicp.exe PID 1956 wrote to memory of 1712 1956 Hkfcnn32.exe Hniieicp.exe PID 1956 wrote to memory of 1712 1956 Hkfcnn32.exe Hniieicp.exe PID 1712 wrote to memory of 1692 1712 Hniieicp.exe Hcfampag.exe PID 1712 wrote to memory of 1692 1712 Hniieicp.exe Hcfampag.exe PID 1712 wrote to memory of 1692 1712 Hniieicp.exe Hcfampag.exe PID 1712 wrote to memory of 1692 1712 Hniieicp.exe Hcfampag.exe PID 1692 wrote to memory of 1464 1692 Hcfampag.exe Imelfd32.exe PID 1692 wrote to memory of 1464 1692 Hcfampag.exe Imelfd32.exe PID 1692 wrote to memory of 1464 1692 Hcfampag.exe Imelfd32.exe PID 1692 wrote to memory of 1464 1692 Hcfampag.exe Imelfd32.exe PID 1464 wrote to memory of 1632 1464 Imelfd32.exe Ibdadk32.exe PID 1464 wrote to memory of 1632 1464 Imelfd32.exe Ibdadk32.exe PID 1464 wrote to memory of 1632 1464 Imelfd32.exe Ibdadk32.exe PID 1464 wrote to memory of 1632 1464 Imelfd32.exe Ibdadk32.exe PID 1632 wrote to memory of 1796 1632 Ibdadk32.exe Ieejffke.exe PID 1632 wrote to memory of 1796 1632 Ibdadk32.exe Ieejffke.exe PID 1632 wrote to memory of 1796 1632 Ibdadk32.exe Ieejffke.exe PID 1632 wrote to memory of 1796 1632 Ibdadk32.exe Ieejffke.exe PID 1796 wrote to memory of 1636 1796 Ieejffke.exe Jmeheh32.exe PID 1796 wrote to memory of 1636 1796 Ieejffke.exe Jmeheh32.exe PID 1796 wrote to memory of 1636 1796 Ieejffke.exe Jmeheh32.exe PID 1796 wrote to memory of 1636 1796 Ieejffke.exe Jmeheh32.exe PID 1636 wrote to memory of 416 1636 Jmeheh32.exe Jpfagcbl.exe PID 1636 wrote to memory of 416 1636 Jmeheh32.exe Jpfagcbl.exe PID 1636 wrote to memory of 416 1636 Jmeheh32.exe Jpfagcbl.exe PID 1636 wrote to memory of 416 1636 Jmeheh32.exe Jpfagcbl.exe PID 416 wrote to memory of 772 416 Jpfagcbl.exe Nmfnpidm.exe PID 416 wrote to memory of 772 416 Jpfagcbl.exe Nmfnpidm.exe PID 416 wrote to memory of 772 416 Jpfagcbl.exe Nmfnpidm.exe PID 416 wrote to memory of 772 416 Jpfagcbl.exe Nmfnpidm.exe PID 772 wrote to memory of 1316 772 Nmfnpidm.exe Nmhjfibj.exe PID 772 wrote to memory of 1316 772 Nmfnpidm.exe Nmhjfibj.exe PID 772 wrote to memory of 1316 772 Nmfnpidm.exe Nmhjfibj.exe PID 772 wrote to memory of 1316 772 Nmfnpidm.exe Nmhjfibj.exe PID 1316 wrote to memory of 2028 1316 Nmhjfibj.exe Ofbhcaic.exe PID 1316 wrote to memory of 2028 1316 Nmhjfibj.exe Ofbhcaic.exe PID 1316 wrote to memory of 2028 1316 Nmhjfibj.exe Ofbhcaic.exe PID 1316 wrote to memory of 2028 1316 Nmhjfibj.exe Ofbhcaic.exe PID 2028 wrote to memory of 764 2028 Ofbhcaic.exe Phmgah32.exe PID 2028 wrote to memory of 764 2028 Ofbhcaic.exe Phmgah32.exe PID 2028 wrote to memory of 764 2028 Ofbhcaic.exe Phmgah32.exe PID 2028 wrote to memory of 764 2028 Ofbhcaic.exe Phmgah32.exe PID 764 wrote to memory of 1684 764 Phmgah32.exe Aoglmf32.exe PID 764 wrote to memory of 1684 764 Phmgah32.exe Aoglmf32.exe PID 764 wrote to memory of 1684 764 Phmgah32.exe Aoglmf32.exe PID 764 wrote to memory of 1684 764 Phmgah32.exe Aoglmf32.exe PID 1684 wrote to memory of 1276 1684 Aoglmf32.exe Bonanekg.exe PID 1684 wrote to memory of 1276 1684 Aoglmf32.exe Bonanekg.exe PID 1684 wrote to memory of 1276 1684 Aoglmf32.exe Bonanekg.exe PID 1684 wrote to memory of 1276 1684 Aoglmf32.exe Bonanekg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3894730d7c0d8a614dd2d59188ab70de82d24589e67b5c72b43de2b4cbb4c734.exe"C:\Users\Admin\AppData\Local\Temp\3894730d7c0d8a614dd2d59188ab70de82d24589e67b5c72b43de2b4cbb4c734.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ecmfik32.exeC:\Windows\system32\Ecmfik32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ghqaad32.exeC:\Windows\system32\Ghqaad32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Hkfcnn32.exeC:\Windows\system32\Hkfcnn32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Hniieicp.exeC:\Windows\system32\Hniieicp.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Hcfampag.exeC:\Windows\system32\Hcfampag.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Imelfd32.exeC:\Windows\system32\Imelfd32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ibdadk32.exeC:\Windows\system32\Ibdadk32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ieejffke.exeC:\Windows\system32\Ieejffke.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jmeheh32.exeC:\Windows\system32\Jmeheh32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jpfagcbl.exeC:\Windows\system32\Jpfagcbl.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Nmfnpidm.exeC:\Windows\system32\Nmfnpidm.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Nmhjfibj.exeC:\Windows\system32\Nmhjfibj.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ofbhcaic.exeC:\Windows\system32\Ofbhcaic.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Phmgah32.exeC:\Windows\system32\Phmgah32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Aoglmf32.exeC:\Windows\system32\Aoglmf32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bonanekg.exeC:\Windows\system32\Bonanekg.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Cbljic32.exeC:\Windows\system32\Cbljic32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Cbognc32.exeC:\Windows\system32\Cbognc32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Cihokm32.exeC:\Windows\system32\Cihokm32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Cnegcd32.exeC:\Windows\system32\Cnegcd32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Cfmpda32.exeC:\Windows\system32\Cfmpda32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Cnhdid32.exeC:\Windows\system32\Cnhdid32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Ceamen32.exeC:\Windows\system32\Ceamen32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Cklebhmo.exeC:\Windows\system32\Cklebhmo.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dbemob32.exeC:\Windows\system32\Dbemob32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Dcgifjkj.exeC:\Windows\system32\Dcgifjkj.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Djaacd32.exeC:\Windows\system32\Djaacd32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Deffqm32.exeC:\Windows\system32\Deffqm32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Dgebmiaq.exeC:\Windows\system32\Dgebmiaq.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Dmakepoh.exeC:\Windows\system32\Dmakepoh.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Dclcaj32.exeC:\Windows\system32\Dclcaj32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Djekndna.exeC:\Windows\system32\Djekndna.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dapckn32.exeC:\Windows\system32\Dapckn32.exe34⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dbqpbfkm.exeC:\Windows\system32\Dbqpbfkm.exe35⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dikhopbi.exeC:\Windows\system32\Dikhopbi.exe36⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dpeplj32.exeC:\Windows\system32\Dpeplj32.exe37⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dfohidac.exeC:\Windows\system32\Dfohidac.exe38⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Emiaeo32.exeC:\Windows\system32\Emiaeo32.exe39⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ebeine32.exeC:\Windows\system32\Ebeine32.exe40⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ehbafleo.exeC:\Windows\system32\Ehbafleo.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Epijgjfa.exeC:\Windows\system32\Epijgjfa.exe42⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Eakfob32.exeC:\Windows\system32\Eakfob32.exe43⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Eianpo32.exeC:\Windows\system32\Eianpo32.exe44⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ekckhgbp.exeC:\Windows\system32\Ekckhgbp.exe45⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Eamcda32.exeC:\Windows\system32\Eamcda32.exe46⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ehgkalai.exeC:\Windows\system32\Ehgkalai.exe47⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Eoacnfif.exeC:\Windows\system32\Eoacnfif.exe48⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Eaopjahj.exeC:\Windows\system32\Eaopjahj.exe49⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Eglhbhfa.exeC:\Windows\system32\Eglhbhfa.exe50⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Emfpob32.exeC:\Windows\system32\Emfpob32.exe51⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fdphllek.exeC:\Windows\system32\Fdphllek.exe52⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fgoehhdo.exeC:\Windows\system32\Fgoehhdo.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fadieq32.exeC:\Windows\system32\Fadieq32.exe54⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fdbeal32.exeC:\Windows\system32\Fdbeal32.exe55⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fklnnfje.exeC:\Windows\system32\Fklnnfje.exe56⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fpiffmil.exeC:\Windows\system32\Fpiffmil.exe57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fcgbbhhp.exeC:\Windows\system32\Fcgbbhhp.exe58⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fiajob32.exeC:\Windows\system32\Fiajob32.exe59⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fcjohh32.exeC:\Windows\system32\Fcjohh32.exe60⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Fidgdbmj.exeC:\Windows\system32\Fidgdbmj.exe61⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Flbcqnln.exeC:\Windows\system32\Flbcqnln.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fcllmh32.exeC:\Windows\system32\Fcllmh32.exe63⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fifdjbkg.exeC:\Windows\system32\Fifdjbkg.exe64⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Gkgpbjaf.exeC:\Windows\system32\Gkgpbjaf.exe65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Gdpekp32.exeC:\Windows\system32\Gdpekp32.exe66⤵
-
C:\Windows\SysWOW64\Glgmlm32.exeC:\Windows\system32\Glgmlm32.exe67⤵
-
C:\Windows\SysWOW64\Gnhiceng.exeC:\Windows\system32\Gnhiceng.exe68⤵
-
C:\Windows\SysWOW64\Gdbapo32.exeC:\Windows\system32\Gdbapo32.exe69⤵
-
C:\Windows\SysWOW64\Ggqnlk32.exeC:\Windows\system32\Ggqnlk32.exe70⤵
-
C:\Windows\SysWOW64\Gpibep32.exeC:\Windows\system32\Gpibep32.exe71⤵
-
C:\Windows\SysWOW64\Ghpjfn32.exeC:\Windows\system32\Ghpjfn32.exe72⤵
-
C:\Windows\SysWOW64\Gjagnfah.exeC:\Windows\system32\Gjagnfah.exe73⤵
-
C:\Windows\SysWOW64\Gahoocbk.exeC:\Windows\system32\Gahoocbk.exe74⤵
-
C:\Windows\SysWOW64\Gcjkgk32.exeC:\Windows\system32\Gcjkgk32.exe75⤵
-
C:\Windows\SysWOW64\Gkachi32.exeC:\Windows\system32\Gkachi32.exe76⤵
-
C:\Windows\SysWOW64\Gnopdd32.exeC:\Windows\system32\Gnopdd32.exe77⤵
-
C:\Windows\SysWOW64\Gqnlppgb.exeC:\Windows\system32\Gqnlppgb.exe78⤵
-
C:\Windows\SysWOW64\Hfjdhfej.exeC:\Windows\system32\Hfjdhfej.exe79⤵
-
C:\Windows\SysWOW64\Hnaljdfl.exeC:\Windows\system32\Hnaljdfl.exe80⤵
-
C:\Windows\SysWOW64\Hqphfoep.exeC:\Windows\system32\Hqphfoep.exe81⤵
-
C:\Windows\SysWOW64\Hcndbkdc.exeC:\Windows\system32\Hcndbkdc.exe82⤵
-
C:\Windows\SysWOW64\Hjhmoe32.exeC:\Windows\system32\Hjhmoe32.exe83⤵
-
C:\Windows\SysWOW64\Hmgikp32.exeC:\Windows\system32\Hmgikp32.exe84⤵
-
C:\Windows\SysWOW64\Hoeegljh.exeC:\Windows\system32\Hoeegljh.exe85⤵
-
C:\Windows\SysWOW64\Hfoncf32.exeC:\Windows\system32\Hfoncf32.exe86⤵
-
C:\Windows\SysWOW64\Hmifppia.exeC:\Windows\system32\Hmifppia.exe87⤵
-
C:\Windows\SysWOW64\Hogblkhe.exeC:\Windows\system32\Hogblkhe.exe88⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hfajie32.exeC:\Windows\system32\Hfajie32.exe89⤵
-
C:\Windows\SysWOW64\Hipfea32.exeC:\Windows\system32\Hipfea32.exe90⤵
-
C:\Windows\SysWOW64\Hojobkfb.exeC:\Windows\system32\Hojobkfb.exe91⤵
-
C:\Windows\SysWOW64\Hbhknf32.exeC:\Windows\system32\Hbhknf32.exe92⤵
-
C:\Windows\SysWOW64\Hibckqlc.exeC:\Windows\system32\Hibckqlc.exe93⤵
-
C:\Windows\SysWOW64\Holkgk32.exeC:\Windows\system32\Holkgk32.exe94⤵
-
C:\Windows\SysWOW64\Ibkhdf32.exeC:\Windows\system32\Ibkhdf32.exe95⤵
-
C:\Windows\SysWOW64\Ieidpa32.exeC:\Windows\system32\Ieidpa32.exe96⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ikclmlid.exeC:\Windows\system32\Ikclmlid.exe97⤵
-
C:\Windows\SysWOW64\Inahighh.exeC:\Windows\system32\Inahighh.exe98⤵
-
C:\Windows\SysWOW64\Iapdeb32.exeC:\Windows\system32\Iapdeb32.exe99⤵
-
C:\Windows\SysWOW64\Igjmamoh.exeC:\Windows\system32\Igjmamoh.exe100⤵
-
C:\Windows\SysWOW64\Ijhinhnl.exeC:\Windows\system32\Ijhinhnl.exe101⤵
-
C:\Windows\SysWOW64\Imfejcmp.exeC:\Windows\system32\Imfejcmp.exe102⤵
-
C:\Windows\SysWOW64\Icqnfn32.exeC:\Windows\system32\Icqnfn32.exe103⤵
-
C:\Windows\SysWOW64\Ifojbi32.exeC:\Windows\system32\Ifojbi32.exe104⤵
-
C:\Windows\SysWOW64\Imibockm.exeC:\Windows\system32\Imibockm.exe105⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ipgnkojq.exeC:\Windows\system32\Ipgnkojq.exe106⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Igofml32.exeC:\Windows\system32\Igofml32.exe107⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Iipcddaa.exeC:\Windows\system32\Iipcddaa.exe108⤵
-
C:\Windows\SysWOW64\Ipjkan32.exeC:\Windows\system32\Ipjkan32.exe109⤵
-
C:\Windows\SysWOW64\Ibhgmj32.exeC:\Windows\system32\Ibhgmj32.exe110⤵
-
C:\Windows\SysWOW64\Jibpjdon.exeC:\Windows\system32\Jibpjdon.exe111⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Jplhfn32.exeC:\Windows\system32\Jplhfn32.exe112⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Jbjdbi32.exeC:\Windows\system32\Jbjdbi32.exe113⤵
-
C:\Windows\SysWOW64\Jidloc32.exeC:\Windows\system32\Jidloc32.exe114⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Jekmddbp.exeC:\Windows\system32\Jekmddbp.exe115⤵
-
C:\Windows\SysWOW64\Jpqaambf.exeC:\Windows\system32\Jpqaambf.exe116⤵
-
C:\Windows\SysWOW64\Jhlffp32.exeC:\Windows\system32\Jhlffp32.exe117⤵
-
C:\Windows\SysWOW64\Jbajch32.exeC:\Windows\system32\Jbajch32.exe118⤵
-
C:\Windows\SysWOW64\Jdbfkqee.exeC:\Windows\system32\Jdbfkqee.exe119⤵
-
C:\Windows\SysWOW64\Jjmohk32.exeC:\Windows\system32\Jjmohk32.exe120⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kebcec32.exeC:\Windows\system32\Kebcec32.exe121⤵
-
C:\Windows\SysWOW64\Kjolmjko.exeC:\Windows\system32\Kjolmjko.exe122⤵
-
C:\Windows\SysWOW64\Kpldeaig.exeC:\Windows\system32\Kpldeaig.exe123⤵
-
C:\Windows\SysWOW64\Kkahcjim.exeC:\Windows\system32\Kkahcjim.exe124⤵
-
C:\Windows\SysWOW64\Kbmmglfh.exeC:\Windows\system32\Kbmmglfh.exe125⤵
-
C:\Windows\SysWOW64\Kbojml32.exeC:\Windows\system32\Kbojml32.exe126⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kiibifkb.exeC:\Windows\system32\Kiibifkb.exe127⤵
-
C:\Windows\SysWOW64\Lohggm32.exeC:\Windows\system32\Lohggm32.exe128⤵
-
C:\Windows\SysWOW64\Lllgqa32.exeC:\Windows\system32\Lllgqa32.exe129⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Lcfpmknm.exeC:\Windows\system32\Lcfpmknm.exe130⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Lkadbm32.exeC:\Windows\system32\Lkadbm32.exe131⤵
-
C:\Windows\SysWOW64\Lghegnal.exeC:\Windows\system32\Lghegnal.exe132⤵
-
C:\Windows\SysWOW64\Ldnbfb32.exeC:\Windows\system32\Ldnbfb32.exe133⤵
-
C:\Windows\SysWOW64\Mccogobk.exeC:\Windows\system32\Mccogobk.exe134⤵
-
C:\Windows\SysWOW64\Mjmgci32.exeC:\Windows\system32\Mjmgci32.exe135⤵
-
C:\Windows\SysWOW64\Mcflln32.exeC:\Windows\system32\Mcflln32.exe136⤵
-
C:\Windows\SysWOW64\Mffeni32.exeC:\Windows\system32\Mffeni32.exe137⤵
-
C:\Windows\SysWOW64\Mooigo32.exeC:\Windows\system32\Mooigo32.exe138⤵
-
C:\Windows\SysWOW64\Mkejlpjn.exeC:\Windows\system32\Mkejlpjn.exe139⤵
-
C:\Windows\SysWOW64\Ndnoee32.exeC:\Windows\system32\Ndnoee32.exe140⤵
-
C:\Windows\SysWOW64\Nbbonjoh.exeC:\Windows\system32\Nbbonjoh.exe141⤵
-
C:\Windows\SysWOW64\Nkjcgo32.exeC:\Windows\system32\Nkjcgo32.exe142⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nbdldimf.exeC:\Windows\system32\Nbdldimf.exe143⤵
-
C:\Windows\SysWOW64\Ngadlpkm.exeC:\Windows\system32\Ngadlpkm.exe144⤵
-
C:\Windows\SysWOW64\Nmnmdg32.exeC:\Windows\system32\Nmnmdg32.exe145⤵
-
C:\Windows\SysWOW64\Ncheaaaa.exeC:\Windows\system32\Ncheaaaa.exe146⤵
-
C:\Windows\SysWOW64\Nmpijg32.exeC:\Windows\system32\Nmpijg32.exe147⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Npoffb32.exeC:\Windows\system32\Npoffb32.exe148⤵
-
C:\Windows\SysWOW64\Nfinblnb.exeC:\Windows\system32\Nfinblnb.exe149⤵
-
C:\Windows\SysWOW64\Oigjohmf.exeC:\Windows\system32\Oigjohmf.exe150⤵
-
C:\Windows\SysWOW64\Oqnbpe32.exeC:\Windows\system32\Oqnbpe32.exe151⤵
-
C:\Windows\SysWOW64\Oboogmcf.exeC:\Windows\system32\Oboogmcf.exe152⤵
-
C:\Windows\SysWOW64\Ojfgikdi.exeC:\Windows\system32\Ojfgikdi.exe153⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Omecefcm.exeC:\Windows\system32\Omecefcm.exe154⤵
-
C:\Windows\SysWOW64\Obakmmad.exeC:\Windows\system32\Obakmmad.exe155⤵
-
C:\Windows\SysWOW64\Oephihqg.exeC:\Windows\system32\Oephihqg.exe156⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Oljpfb32.exeC:\Windows\system32\Oljpfb32.exe157⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Onhlbn32.exeC:\Windows\system32\Onhlbn32.exe158⤵
-
C:\Windows\SysWOW64\Ofpdckhj.exeC:\Windows\system32\Ofpdckhj.exe159⤵
-
C:\Windows\SysWOW64\Ohaqkc32.exeC:\Windows\system32\Ohaqkc32.exe160⤵
-
C:\Windows\SysWOW64\Ophila32.exeC:\Windows\system32\Ophila32.exe161⤵
-
C:\Windows\SysWOW64\Oaiedidi.exeC:\Windows\system32\Oaiedidi.exe162⤵
-
C:\Windows\SysWOW64\Ohcmqc32.exeC:\Windows\system32\Ohcmqc32.exe163⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ojaimo32.exeC:\Windows\system32\Ojaimo32.exe164⤵
-
C:\Windows\SysWOW64\Obianlkl.exeC:\Windows\system32\Obianlkl.exe165⤵
-
C:\Windows\SysWOW64\Pdjned32.exeC:\Windows\system32\Pdjned32.exe166⤵
-
C:\Windows\SysWOW64\Plaffa32.exeC:\Windows\system32\Plaffa32.exe167⤵
-
C:\Windows\SysWOW64\Pnpbcm32.exeC:\Windows\system32\Pnpbcm32.exe168⤵
-
C:\Windows\SysWOW64\Peijpghm.exeC:\Windows\system32\Peijpghm.exe169⤵
-
C:\Windows\SysWOW64\Phhglbhq.exeC:\Windows\system32\Phhglbhq.exe170⤵
-
C:\Windows\SysWOW64\Pjfchngd.exeC:\Windows\system32\Pjfchngd.exe171⤵
-
C:\Windows\SysWOW64\Pmeodifh.exeC:\Windows\system32\Pmeodifh.exe172⤵
-
C:\Windows\SysWOW64\Pdogqcme.exeC:\Windows\system32\Pdogqcme.exe173⤵
-
C:\Windows\SysWOW64\Pfmcmolh.exeC:\Windows\system32\Pfmcmolh.exe174⤵
-
C:\Windows\SysWOW64\Pikpijll.exeC:\Windows\system32\Pikpijll.exe175⤵
-
C:\Windows\SysWOW64\Pdadfckb.exeC:\Windows\system32\Pdadfckb.exe176⤵
-
C:\Windows\SysWOW64\Pphekd32.exeC:\Windows\system32\Pphekd32.exe177⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Qbhnmong.exeC:\Windows\system32\Qbhnmong.exe178⤵
-
C:\Windows\SysWOW64\Qibfii32.exeC:\Windows\system32\Qibfii32.exe179⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Qoooap32.exeC:\Windows\system32\Qoooap32.exe180⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ahhckf32.exeC:\Windows\system32\Ahhckf32.exe181⤵
-
C:\Windows\SysWOW64\Aoakgpai.exeC:\Windows\system32\Aoakgpai.exe182⤵
-
C:\Windows\SysWOW64\Adodpgpp.exeC:\Windows\system32\Adodpgpp.exe183⤵
-
C:\Windows\SysWOW64\Aenpij32.exeC:\Windows\system32\Aenpij32.exe184⤵
-
C:\Windows\SysWOW64\Anienldn.exeC:\Windows\system32\Anienldn.exe185⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Adejpf32.exeC:\Windows\system32\Adejpf32.exe186⤵
-
C:\Windows\SysWOW64\Aibbhmhp.exeC:\Windows\system32\Aibbhmhp.exe187⤵
-
C:\Windows\SysWOW64\Bjdonlfm.exeC:\Windows\system32\Bjdonlfm.exe188⤵
-
C:\Windows\SysWOW64\Bekpcn32.exeC:\Windows\system32\Bekpcn32.exe189⤵
-
C:\Windows\SysWOW64\Bcambahh.exeC:\Windows\system32\Bcambahh.exe190⤵
-
C:\Windows\SysWOW64\Bhabph32.exeC:\Windows\system32\Bhabph32.exe191⤵
-
C:\Windows\SysWOW64\Cblcnm32.exeC:\Windows\system32\Cblcnm32.exe192⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Cghlfd32.exeC:\Windows\system32\Cghlfd32.exe193⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Cmedok32.exeC:\Windows\system32\Cmedok32.exe194⤵
-
C:\Windows\SysWOW64\Cjieho32.exeC:\Windows\system32\Cjieho32.exe195⤵
-
C:\Windows\SysWOW64\Cqcmei32.exeC:\Windows\system32\Cqcmei32.exe196⤵
-
C:\Windows\SysWOW64\Cmjnjjad.exeC:\Windows\system32\Cmjnjjad.exe197⤵
-
C:\Windows\SysWOW64\Dcfbldgn.exeC:\Windows\system32\Dcfbldgn.exe198⤵
-
C:\Windows\SysWOW64\Dickdkef.exeC:\Windows\system32\Dickdkef.exe199⤵
-
C:\Windows\SysWOW64\Diehjkcc.exeC:\Windows\system32\Diehjkcc.exe200⤵
-
C:\Windows\SysWOW64\Dbnlbpjc.exeC:\Windows\system32\Dbnlbpjc.exe201⤵
-
C:\Windows\SysWOW64\Dlfqlf32.exeC:\Windows\system32\Dlfqlf32.exe202⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dbpihpha.exeC:\Windows\system32\Dbpihpha.exe203⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dngjmqme.exeC:\Windows\system32\Dngjmqme.exe204⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Enifcqkb.exeC:\Windows\system32\Enifcqkb.exe205⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Eicgcnha.exeC:\Windows\system32\Eicgcnha.exe206⤵
-
C:\Windows\SysWOW64\Ebklldna.exeC:\Windows\system32\Ebklldna.exe207⤵
-
C:\Windows\SysWOW64\Elcpei32.exeC:\Windows\system32\Elcpei32.exe208⤵
-
C:\Windows\SysWOW64\Elfmji32.exeC:\Windows\system32\Elfmji32.exe209⤵
-
C:\Windows\SysWOW64\Eenaco32.exeC:\Windows\system32\Eenaco32.exe210⤵
-
C:\Windows\SysWOW64\Flkfehoj.exeC:\Windows\system32\Flkfehoj.exe211⤵
-
C:\Windows\SysWOW64\Fmnpcpbf.exeC:\Windows\system32\Fmnpcpbf.exe212⤵
-
C:\Windows\SysWOW64\Fhddpibl.exeC:\Windows\system32\Fhddpibl.exe213⤵
-
C:\Windows\SysWOW64\Falhio32.exeC:\Windows\system32\Falhio32.exe214⤵
-
C:\Windows\SysWOW64\Fkdmbd32.exeC:\Windows\system32\Fkdmbd32.exe215⤵
-
C:\Windows\SysWOW64\Gdmakjfm.exeC:\Windows\system32\Gdmakjfm.exe216⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Gphkkjgl.exeC:\Windows\system32\Gphkkjgl.exe217⤵
-
C:\Windows\SysWOW64\Geedca32.exeC:\Windows\system32\Geedca32.exe218⤵
-
C:\Windows\SysWOW64\Galdhbkh.exeC:\Windows\system32\Galdhbkh.exe219⤵
-
C:\Windows\SysWOW64\Hkdiag32.exeC:\Windows\system32\Hkdiag32.exe220⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Hdmnjm32.exeC:\Windows\system32\Hdmnjm32.exe221⤵
-
C:\Windows\SysWOW64\Haqnca32.exeC:\Windows\system32\Haqnca32.exe222⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hcdgpikn.exeC:\Windows\system32\Hcdgpikn.exe223⤵
-
C:\Windows\SysWOW64\Hdccjlbq.exeC:\Windows\system32\Hdccjlbq.exe224⤵
-
C:\Windows\SysWOW64\Hjqlbcqh.exeC:\Windows\system32\Hjqlbcqh.exe225⤵
-
C:\Windows\SysWOW64\Hciqkh32.exeC:\Windows\system32\Hciqkh32.exe226⤵
-
C:\Windows\SysWOW64\Iopapi32.exeC:\Windows\system32\Iopapi32.exe227⤵
-
C:\Windows\SysWOW64\Iobnfi32.exeC:\Windows\system32\Iobnfi32.exe228⤵
-
C:\Windows\SysWOW64\Iodkkiig.exeC:\Windows\system32\Iodkkiig.exe229⤵
-
C:\Windows\SysWOW64\Ifnchc32.exeC:\Windows\system32\Ifnchc32.exe230⤵
-
C:\Windows\SysWOW64\Ioggahge.exeC:\Windows\system32\Ioggahge.exe231⤵
-
C:\Windows\SysWOW64\Ijphaf32.exeC:\Windows\system32\Ijphaf32.exe232⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Jcimjljd.exeC:\Windows\system32\Jcimjljd.exe233⤵
-
C:\Windows\SysWOW64\Jjbegf32.exeC:\Windows\system32\Jjbegf32.exe234⤵
-
C:\Windows\SysWOW64\Jehido32.exeC:\Windows\system32\Jehido32.exe235⤵
-
C:\Windows\SysWOW64\Jpbjelmf.exeC:\Windows\system32\Jpbjelmf.exe236⤵
-
C:\Windows\SysWOW64\Jbbcfgjg.exeC:\Windows\system32\Jbbcfgjg.exe237⤵
-
C:\Windows\SysWOW64\Kmjdip32.exeC:\Windows\system32\Kmjdip32.exe238⤵
-
C:\Windows\SysWOW64\Kbgmag32.exeC:\Windows\system32\Kbgmag32.exe239⤵
-
C:\Windows\SysWOW64\Knnmgh32.exeC:\Windows\system32\Knnmgh32.exe240⤵
-
C:\Windows\SysWOW64\Kehecbcb.exeC:\Windows\system32\Kehecbcb.exe241⤵