Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
06/06/2024, 02:20
Static task
static1
Behavioral task
behavioral1
Sample
893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe
Resource
win10v2004-20240426-en
General
-
Target
893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe
-
Size
80KB
-
MD5
27e6d948a54bcdc26206761f3fee1169
-
SHA1
c770675b7e624e367ac01978faeff54c9fc2f99f
-
SHA256
893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875
-
SHA512
99dff3e9f03564b436dd15dfe91f31ea9ef77c045230e10ab6f34bbb696fc2523ef8e3307512157130a517dbf6bb16b9775d1e9ecb7bedd83b5a5aa57ca0d410
-
SSDEEP
1536:BwgpnBBr66ZEK0Q/aTJZz6tpJ2zDfWqdMVrlEFtyb7IYOOqw4Tv:npnBBrNGgl2zTWqAhELy1MTTv
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Flllcndm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Flllcndm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gakaqd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ggemclpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gmabeeef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gcojnmdn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gihbjfkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gihbjfkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Glgofbjn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gcagcl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gikopfih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gakaqd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmabeeef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gikopfih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gghjil32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gcojnmdn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glgofbjn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gcagcl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ggemclpl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gghjil32.exe -
Executes dropped EXE 10 IoCs
pid Process 1884 Flllcndm.exe 2648 Ggemclpl.exe 2932 Gakaqd32.exe 2628 Gghjil32.exe 2420 Gmabeeef.exe 2916 Gcojnmdn.exe 1276 Gihbjfkj.exe 2644 Glgofbjn.exe 2808 Gcagcl32.exe 1784 Gikopfih.exe -
Loads dropped DLL 21 IoCs
pid Process 1568 893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe 1568 893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe 1884 Flllcndm.exe 1884 Flllcndm.exe 2648 Ggemclpl.exe 2648 Ggemclpl.exe 2932 Gakaqd32.exe 2932 Gakaqd32.exe 2628 Gghjil32.exe 2628 Gghjil32.exe 2420 Gmabeeef.exe 2420 Gmabeeef.exe 2916 Gcojnmdn.exe 2916 Gcojnmdn.exe 1276 Gihbjfkj.exe 1276 Gihbjfkj.exe 2644 Glgofbjn.exe 2644 Glgofbjn.exe 2808 Gcagcl32.exe 2808 Gcagcl32.exe 1784 Gikopfih.exe -
Drops file in System32 directory 33 IoCs
description ioc Process File created C:\Windows\SysWOW64\Flllcndm.exe 893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe File created C:\Windows\SysWOW64\Ddcbmcdg.dll Flllcndm.exe File created C:\Windows\SysWOW64\Gcojnmdn.exe Gmabeeef.exe File created C:\Windows\SysWOW64\Libeng32.dll Glgofbjn.exe File opened for modification C:\Windows\SysWOW64\Gpegmq32.exe Gikopfih.exe File created C:\Windows\SysWOW64\Gcagcl32.exe Glgofbjn.exe File created C:\Windows\SysWOW64\Gikopfih.exe Gcagcl32.exe File created C:\Windows\SysWOW64\Hlkopgfi.dll Gcojnmdn.exe File opened for modification C:\Windows\SysWOW64\Gikopfih.exe Gcagcl32.exe File created C:\Windows\SysWOW64\Bppipk32.dll Gcagcl32.exe File created C:\Windows\SysWOW64\Ggmmim32.dll 893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe File created C:\Windows\SysWOW64\Ggemclpl.exe Flllcndm.exe File created C:\Windows\SysWOW64\Eohlcl32.dll Gakaqd32.exe File opened for modification C:\Windows\SysWOW64\Gmabeeef.exe Gghjil32.exe File created C:\Windows\SysWOW64\Gihbjfkj.exe Gcojnmdn.exe File opened for modification C:\Windows\SysWOW64\Ggemclpl.exe Flllcndm.exe File opened for modification C:\Windows\SysWOW64\Glgofbjn.exe Gihbjfkj.exe File opened for modification C:\Windows\SysWOW64\Gcagcl32.exe Glgofbjn.exe File created C:\Windows\SysWOW64\Gakaqd32.exe Ggemclpl.exe File opened for modification C:\Windows\SysWOW64\Flllcndm.exe 893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe File opened for modification C:\Windows\SysWOW64\Gakaqd32.exe Ggemclpl.exe File created C:\Windows\SysWOW64\Gmabeeef.exe Gghjil32.exe File opened for modification C:\Windows\SysWOW64\Gcojnmdn.exe Gmabeeef.exe File created C:\Windows\SysWOW64\Lfadklif.dll Gmabeeef.exe File opened for modification C:\Windows\SysWOW64\Gghjil32.exe Gakaqd32.exe File created C:\Windows\SysWOW64\Koafbbkn.dll Gghjil32.exe File created C:\Windows\SysWOW64\Mpiajnca.dll Gihbjfkj.exe File created C:\Windows\SysWOW64\Gpegmq32.exe Gikopfih.exe File created C:\Windows\SysWOW64\Amdpnk32.dll Gikopfih.exe File created C:\Windows\SysWOW64\Okjnpflh.dll Ggemclpl.exe File created C:\Windows\SysWOW64\Gghjil32.exe Gakaqd32.exe File opened for modification C:\Windows\SysWOW64\Gihbjfkj.exe Gcojnmdn.exe File created C:\Windows\SysWOW64\Glgofbjn.exe Gihbjfkj.exe -
Program crash 1 IoCs
pid pid_target Process 4612 5112 WerFault.exe -
Modifies registry class 36 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggmmim32.dll" 893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gmabeeef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bppipk32.dll" Gcagcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gikopfih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Flllcndm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ggemclpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlkopgfi.dll" Gcojnmdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Libeng32.dll" Glgofbjn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gikopfih.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gihbjfkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gihbjfkj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gcagcl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ggemclpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eohlcl32.dll" Gakaqd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gghjil32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gcojnmdn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Glgofbjn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amdpnk32.dll" Gikopfih.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okjnpflh.dll" Ggemclpl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gakaqd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gmabeeef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfadklif.dll" Gmabeeef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Glgofbjn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gcojnmdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gcagcl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gakaqd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gghjil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Koafbbkn.dll" Gghjil32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Flllcndm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddcbmcdg.dll" Flllcndm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpiajnca.dll" Gihbjfkj.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1568 wrote to memory of 1884 1568 893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe 28 PID 1568 wrote to memory of 1884 1568 893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe 28 PID 1568 wrote to memory of 1884 1568 893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe 28 PID 1568 wrote to memory of 1884 1568 893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe 28 PID 1884 wrote to memory of 2648 1884 Flllcndm.exe 29 PID 1884 wrote to memory of 2648 1884 Flllcndm.exe 29 PID 1884 wrote to memory of 2648 1884 Flllcndm.exe 29 PID 1884 wrote to memory of 2648 1884 Flllcndm.exe 29 PID 2648 wrote to memory of 2932 2648 Ggemclpl.exe 30 PID 2648 wrote to memory of 2932 2648 Ggemclpl.exe 30 PID 2648 wrote to memory of 2932 2648 Ggemclpl.exe 30 PID 2648 wrote to memory of 2932 2648 Ggemclpl.exe 30 PID 2932 wrote to memory of 2628 2932 Gakaqd32.exe 452 PID 2932 wrote to memory of 2628 2932 Gakaqd32.exe 452 PID 2932 wrote to memory of 2628 2932 Gakaqd32.exe 452 PID 2932 wrote to memory of 2628 2932 Gakaqd32.exe 452 PID 2628 wrote to memory of 2420 2628 Gghjil32.exe 32 PID 2628 wrote to memory of 2420 2628 Gghjil32.exe 32 PID 2628 wrote to memory of 2420 2628 Gghjil32.exe 32 PID 2628 wrote to memory of 2420 2628 Gghjil32.exe 32 PID 2420 wrote to memory of 2916 2420 Gmabeeef.exe 33 PID 2420 wrote to memory of 2916 2420 Gmabeeef.exe 33 PID 2420 wrote to memory of 2916 2420 Gmabeeef.exe 33 PID 2420 wrote to memory of 2916 2420 Gmabeeef.exe 33 PID 2916 wrote to memory of 1276 2916 Gcojnmdn.exe 34 PID 2916 wrote to memory of 1276 2916 Gcojnmdn.exe 34 PID 2916 wrote to memory of 1276 2916 Gcojnmdn.exe 34 PID 2916 wrote to memory of 1276 2916 Gcojnmdn.exe 34 PID 1276 wrote to memory of 2644 1276 Gihbjfkj.exe 35 PID 1276 wrote to memory of 2644 1276 Gihbjfkj.exe 35 PID 1276 wrote to memory of 2644 1276 Gihbjfkj.exe 35 PID 1276 wrote to memory of 2644 1276 Gihbjfkj.exe 35 PID 2644 wrote to memory of 2808 2644 Glgofbjn.exe 36 PID 2644 wrote to memory of 2808 2644 Glgofbjn.exe 36 PID 2644 wrote to memory of 2808 2644 Glgofbjn.exe 36 PID 2644 wrote to memory of 2808 2644 Glgofbjn.exe 36 PID 2808 wrote to memory of 1784 2808 Gcagcl32.exe 37 PID 2808 wrote to memory of 1784 2808 Gcagcl32.exe 37 PID 2808 wrote to memory of 1784 2808 Gcagcl32.exe 37 PID 2808 wrote to memory of 1784 2808 Gcagcl32.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe"C:\Users\Admin\AppData\Local\Temp\893d76a63bf3a23315593324e1a62f420fcfb0446f175d07c1ee77eb6248c875.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\Flllcndm.exeC:\Windows\system32\Flllcndm.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\Ggemclpl.exeC:\Windows\system32\Ggemclpl.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\Gakaqd32.exeC:\Windows\system32\Gakaqd32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\Gghjil32.exeC:\Windows\system32\Gghjil32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\Gmabeeef.exeC:\Windows\system32\Gmabeeef.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\Gcojnmdn.exeC:\Windows\system32\Gcojnmdn.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\Gihbjfkj.exeC:\Windows\system32\Gihbjfkj.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\Glgofbjn.exeC:\Windows\system32\Glgofbjn.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\Gcagcl32.exeC:\Windows\system32\Gcagcl32.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\Gikopfih.exeC:\Windows\system32\Gikopfih.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1784 -
C:\Windows\SysWOW64\Gpegmq32.exeC:\Windows\system32\Gpegmq32.exe12⤵PID:1684
-
C:\Windows\SysWOW64\Gccdil32.exeC:\Windows\system32\Gccdil32.exe13⤵PID:1012
-
C:\Windows\SysWOW64\Gimlefge.exeC:\Windows\system32\Gimlefge.exe14⤵PID:1280
-
C:\Windows\SysWOW64\Gpgdbpob.exeC:\Windows\system32\Gpgdbpob.exe15⤵PID:1716
-
C:\Windows\SysWOW64\Hahqjh32.exeC:\Windows\system32\Hahqjh32.exe16⤵PID:1872
-
C:\Windows\SysWOW64\Hjpike32.exeC:\Windows\system32\Hjpike32.exe17⤵PID:540
-
C:\Windows\SysWOW64\Holacm32.exeC:\Windows\system32\Holacm32.exe18⤵PID:584
-
C:\Windows\SysWOW64\Hefipfkg.exeC:\Windows\system32\Hefipfkg.exe19⤵PID:1816
-
C:\Windows\SysWOW64\Hdijlc32.exeC:\Windows\system32\Hdijlc32.exe20⤵PID:1908
-
C:\Windows\SysWOW64\Hlpamq32.exeC:\Windows\system32\Hlpamq32.exe21⤵PID:412
-
C:\Windows\SysWOW64\Hoonilag.exeC:\Windows\system32\Hoonilag.exe22⤵PID:2968
-
C:\Windows\SysWOW64\Hamjehqk.exeC:\Windows\system32\Hamjehqk.exe23⤵PID:984
-
C:\Windows\SysWOW64\Hdkfacpo.exeC:\Windows\system32\Hdkfacpo.exe24⤵PID:2132
-
C:\Windows\SysWOW64\Hgjbmoob.exeC:\Windows\system32\Hgjbmoob.exe25⤵PID:2920
-
C:\Windows\SysWOW64\Hoakolod.exeC:\Windows\system32\Hoakolod.exe26⤵PID:1948
-
C:\Windows\SysWOW64\Haogkgoh.exeC:\Windows\system32\Haogkgoh.exe27⤵PID:1540
-
C:\Windows\SysWOW64\Hglocnmp.exeC:\Windows\system32\Hglocnmp.exe28⤵PID:3020
-
C:\Windows\SysWOW64\Hjkkojlc.exeC:\Windows\system32\Hjkkojlc.exe29⤵PID:2608
-
C:\Windows\SysWOW64\Hjmhdi32.exeC:\Windows\system32\Hjmhdi32.exe30⤵PID:2656
-
C:\Windows\SysWOW64\Imkdqe32.exeC:\Windows\system32\Imkdqe32.exe31⤵PID:2836
-
C:\Windows\SysWOW64\Igainn32.exeC:\Windows\system32\Igainn32.exe32⤵PID:1376
-
C:\Windows\SysWOW64\Ijoeji32.exeC:\Windows\system32\Ijoeji32.exe33⤵PID:2632
-
C:\Windows\SysWOW64\Imnafd32.exeC:\Windows\system32\Imnafd32.exe34⤵PID:288
-
C:\Windows\SysWOW64\Igcecmfg.exeC:\Windows\system32\Igcecmfg.exe35⤵PID:2304
-
C:\Windows\SysWOW64\Ijaapifk.exeC:\Windows\system32\Ijaapifk.exe36⤵PID:2732
-
C:\Windows\SysWOW64\Iqljlb32.exeC:\Windows\system32\Iqljlb32.exe37⤵PID:2040
-
C:\Windows\SysWOW64\Ibmfdkcf.exeC:\Windows\system32\Ibmfdkcf.exe38⤵PID:1776
-
C:\Windows\SysWOW64\Iigoqe32.exeC:\Windows\system32\Iigoqe32.exe39⤵PID:2448
-
C:\Windows\SysWOW64\Ioagno32.exeC:\Windows\system32\Ioagno32.exe40⤵PID:2768
-
C:\Windows\SysWOW64\Ifkojiim.exeC:\Windows\system32\Ifkojiim.exe41⤵PID:604
-
C:\Windows\SysWOW64\Ikggbpgd.exeC:\Windows\system32\Ikggbpgd.exe42⤵PID:2112
-
C:\Windows\SysWOW64\Ifmlpigj.exeC:\Windows\system32\Ifmlpigj.exe43⤵PID:624
-
C:\Windows\SysWOW64\Jnhqdkde.exeC:\Windows\system32\Jnhqdkde.exe44⤵PID:2984
-
C:\Windows\SysWOW64\Jagmpg32.exeC:\Windows\system32\Jagmpg32.exe45⤵PID:2972
-
C:\Windows\SysWOW64\Jinead32.exeC:\Windows\system32\Jinead32.exe46⤵PID:3068
-
C:\Windows\SysWOW64\Jjoailji.exeC:\Windows\system32\Jjoailji.exe47⤵PID:108
-
C:\Windows\SysWOW64\Jbfijjkl.exeC:\Windows\system32\Jbfijjkl.exe48⤵PID:1192
-
C:\Windows\SysWOW64\Jcgfbb32.exeC:\Windows\system32\Jcgfbb32.exe49⤵PID:2964
-
C:\Windows\SysWOW64\Jkonco32.exeC:\Windows\system32\Jkonco32.exe50⤵PID:2208
-
C:\Windows\SysWOW64\Jmpjkggj.exeC:\Windows\system32\Jmpjkggj.exe51⤵PID:2676
-
C:\Windows\SysWOW64\Jegble32.exeC:\Windows\system32\Jegble32.exe52⤵PID:2580
-
C:\Windows\SysWOW64\Jfhocmnk.exeC:\Windows\system32\Jfhocmnk.exe53⤵PID:2700
-
C:\Windows\SysWOW64\Jmbgpg32.exeC:\Windows\system32\Jmbgpg32.exe54⤵PID:2148
-
C:\Windows\SysWOW64\Jclomamd.exeC:\Windows\system32\Jclomamd.exe55⤵PID:2444
-
C:\Windows\SysWOW64\Jfkkimlh.exeC:\Windows\system32\Jfkkimlh.exe56⤵PID:1272
-
C:\Windows\SysWOW64\Jiigehkl.exeC:\Windows\system32\Jiigehkl.exe57⤵PID:344
-
C:\Windows\SysWOW64\Kappfeln.exeC:\Windows\system32\Kappfeln.exe58⤵PID:560
-
C:\Windows\SysWOW64\Kbalnnam.exeC:\Windows\system32\Kbalnnam.exe59⤵PID:2320
-
C:\Windows\SysWOW64\Kjhdokbo.exeC:\Windows\system32\Kjhdokbo.exe60⤵PID:2840
-
C:\Windows\SysWOW64\Kikdkh32.exeC:\Windows\system32\Kikdkh32.exe61⤵PID:2212
-
C:\Windows\SysWOW64\Kpemgbqf.exeC:\Windows\system32\Kpemgbqf.exe62⤵PID:2852
-
C:\Windows\SysWOW64\Kbcicmpj.exeC:\Windows\system32\Kbcicmpj.exe63⤵PID:2232
-
C:\Windows\SysWOW64\Kebepion.exeC:\Windows\system32\Kebepion.exe64⤵PID:596
-
C:\Windows\SysWOW64\Kmimafop.exeC:\Windows\system32\Kmimafop.exe65⤵PID:1696
-
C:\Windows\SysWOW64\Knjiin32.exeC:\Windows\system32\Knjiin32.exe66⤵PID:1904
-
C:\Windows\SysWOW64\Kfaajlfp.exeC:\Windows\system32\Kfaajlfp.exe67⤵PID:2688
-
C:\Windows\SysWOW64\Kipnfged.exeC:\Windows\system32\Kipnfged.exe68⤵PID:2568
-
C:\Windows\SysWOW64\Khcnad32.exeC:\Windows\system32\Khcnad32.exe69⤵PID:1748
-
C:\Windows\SysWOW64\Kpjfba32.exeC:\Windows\system32\Kpjfba32.exe70⤵PID:2524
-
C:\Windows\SysWOW64\Kbhbom32.exeC:\Windows\system32\Kbhbom32.exe71⤵PID:1524
-
C:\Windows\SysWOW64\Kibjkgca.exeC:\Windows\system32\Kibjkgca.exe72⤵PID:2532
-
C:\Windows\SysWOW64\Klqfhbbe.exeC:\Windows\system32\Klqfhbbe.exe73⤵PID:1228
-
C:\Windows\SysWOW64\Kbkodl32.exeC:\Windows\system32\Kbkodl32.exe74⤵PID:2172
-
C:\Windows\SysWOW64\Keikqhhe.exeC:\Windows\system32\Keikqhhe.exe75⤵PID:2124
-
C:\Windows\SysWOW64\Llccmb32.exeC:\Windows\system32\Llccmb32.exe76⤵PID:2780
-
C:\Windows\SysWOW64\Loapim32.exeC:\Windows\system32\Loapim32.exe77⤵PID:1428
-
C:\Windows\SysWOW64\Lkhpnnej.exeC:\Windows\system32\Lkhpnnej.exe78⤵PID:1876
-
C:\Windows\SysWOW64\Lmgmjjdn.exeC:\Windows\system32\Lmgmjjdn.exe79⤵PID:676
-
C:\Windows\SysWOW64\Lpeifeca.exeC:\Windows\system32\Lpeifeca.exe80⤵PID:1608
-
C:\Windows\SysWOW64\Ldqegd32.exeC:\Windows\system32\Ldqegd32.exe81⤵PID:1448
-
C:\Windows\SysWOW64\Lkkmdn32.exeC:\Windows\system32\Lkkmdn32.exe82⤵PID:1976
-
C:\Windows\SysWOW64\Lmiipi32.exeC:\Windows\system32\Lmiipi32.exe83⤵PID:2924
-
C:\Windows\SysWOW64\Ladeqhjd.exeC:\Windows\system32\Ladeqhjd.exe84⤵PID:816
-
C:\Windows\SysWOW64\Ldcamcih.exeC:\Windows\system32\Ldcamcih.exe85⤵PID:2452
-
C:\Windows\SysWOW64\Lganiohl.exeC:\Windows\system32\Lganiohl.exe86⤵PID:1652
-
C:\Windows\SysWOW64\Lipjejgp.exeC:\Windows\system32\Lipjejgp.exe87⤵PID:1616
-
C:\Windows\SysWOW64\Llnfaffc.exeC:\Windows\system32\Llnfaffc.exe88⤵PID:2624
-
C:\Windows\SysWOW64\Lchnnp32.exeC:\Windows\system32\Lchnnp32.exe89⤵PID:608
-
C:\Windows\SysWOW64\Lgdjnofi.exeC:\Windows\system32\Lgdjnofi.exe90⤵PID:2104
-
C:\Windows\SysWOW64\Libgjj32.exeC:\Windows\system32\Libgjj32.exe91⤵PID:1564
-
C:\Windows\SysWOW64\Llqcfe32.exeC:\Windows\system32\Llqcfe32.exe92⤵PID:1712
-
C:\Windows\SysWOW64\Lplogdmj.exeC:\Windows\system32\Lplogdmj.exe93⤵PID:1576
-
C:\Windows\SysWOW64\Mcjkcplm.exeC:\Windows\system32\Mcjkcplm.exe94⤵PID:980
-
C:\Windows\SysWOW64\Meigpkka.exeC:\Windows\system32\Meigpkka.exe95⤵PID:2480
-
C:\Windows\SysWOW64\Mhgclfje.exeC:\Windows\system32\Mhgclfje.exe96⤵PID:2880
-
C:\Windows\SysWOW64\Mpolmdkg.exeC:\Windows\system32\Mpolmdkg.exe97⤵PID:2288
-
C:\Windows\SysWOW64\Maphdl32.exeC:\Windows\system32\Maphdl32.exe98⤵PID:2684
-
C:\Windows\SysWOW64\Migpeiag.exeC:\Windows\system32\Migpeiag.exe99⤵PID:2044
-
C:\Windows\SysWOW64\Mhjpaf32.exeC:\Windows\system32\Mhjpaf32.exe100⤵PID:2144
-
C:\Windows\SysWOW64\Mochnppo.exeC:\Windows\system32\Mochnppo.exe101⤵PID:936
-
C:\Windows\SysWOW64\Mcodno32.exeC:\Windows\system32\Mcodno32.exe102⤵PID:1244
-
C:\Windows\SysWOW64\Menakj32.exeC:\Windows\system32\Menakj32.exe103⤵PID:2404
-
C:\Windows\SysWOW64\Mhlmgf32.exeC:\Windows\system32\Mhlmgf32.exe104⤵PID:1580
-
C:\Windows\SysWOW64\Mkjica32.exeC:\Windows\system32\Mkjica32.exe105⤵PID:1416
-
C:\Windows\SysWOW64\Mnieom32.exeC:\Windows\system32\Mnieom32.exe106⤵PID:2672
-
C:\Windows\SysWOW64\Mepnpj32.exeC:\Windows\system32\Mepnpj32.exe107⤵PID:2680
-
C:\Windows\SysWOW64\Mgajhbkg.exeC:\Windows\system32\Mgajhbkg.exe108⤵PID:2512
-
C:\Windows\SysWOW64\Mohbip32.exeC:\Windows\system32\Mohbip32.exe109⤵PID:2856
-
C:\Windows\SysWOW64\Magnek32.exeC:\Windows\system32\Magnek32.exe110⤵PID:2280
-
C:\Windows\SysWOW64\Mdejaf32.exeC:\Windows\system32\Mdejaf32.exe111⤵PID:1960
-
C:\Windows\SysWOW64\Mkobnqan.exeC:\Windows\system32\Mkobnqan.exe112⤵PID:820
-
C:\Windows\SysWOW64\Naikkk32.exeC:\Windows\system32\Naikkk32.exe113⤵PID:2696
-
C:\Windows\SysWOW64\Nplkfgoe.exeC:\Windows\system32\Nplkfgoe.exe114⤵PID:1532
-
C:\Windows\SysWOW64\Ncjgbcoi.exeC:\Windows\system32\Ncjgbcoi.exe115⤵PID:1644
-
C:\Windows\SysWOW64\Nkaocp32.exeC:\Windows\system32\Nkaocp32.exe116⤵PID:1896
-
C:\Windows\SysWOW64\Nlblkhei.exeC:\Windows\system32\Nlblkhei.exe117⤵PID:2436
-
C:\Windows\SysWOW64\Nghphaeo.exeC:\Windows\system32\Nghphaeo.exe118⤵PID:2752
-
C:\Windows\SysWOW64\Njgldmdc.exeC:\Windows\system32\Njgldmdc.exe119⤵PID:1544
-
C:\Windows\SysWOW64\Nleiqhcg.exeC:\Windows\system32\Nleiqhcg.exe120⤵PID:1964
-
C:\Windows\SysWOW64\Nocemcbj.exeC:\Windows\system32\Nocemcbj.exe121⤵PID:2056
-
C:\Windows\SysWOW64\Ngkmnacm.exeC:\Windows\system32\Ngkmnacm.exe122⤵PID:2136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-