Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 15:49
Static task
static1
Behavioral task
behavioral1
Sample
7b102e6a145bbf2ec1d025f9394b5670_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
7b102e6a145bbf2ec1d025f9394b5670_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
7b102e6a145bbf2ec1d025f9394b5670_NeikiAnalytics.exe
-
Size
1021KB
-
MD5
7b102e6a145bbf2ec1d025f9394b5670
-
SHA1
e5b2dc9a05506a11da37602f7f1d30e3ccbf15ea
-
SHA256
5d23bdba50759d46747a509b2ff8cac1a5307be98979276dedae5b27d7e50669
-
SHA512
17ca28ad228446cc3a1dbfb60ea941c4a8e329e48f2722b75abc9a1c65fb561a257280b06acca41ee57b448fe585c7eeb5e9e92fba15ea67088044eccf71381f
-
SSDEEP
24576:1qylFH50Dv6RwyeQvt6ot0h9HyrOgiruAUV:IylFHUv6ReIt0jSrOu
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 4W74P.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation I0WP5.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 3K90C.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation VUZU8.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 48T7D.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation K6B7L.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 184K3.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 8K21O.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 11Z6W.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation V6447.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 0XJ40.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation LO226.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Z7T8A.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation K3STA.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation NS81I.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation J89HR.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation KCA34.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation ZE9F1.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 8HXTZ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation SFL41.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 503BI.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 8WAGY.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 02Q2K.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 0LBIM.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation EBH9T.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 17CY5.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 7S7F2.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 4485W.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation PCR69.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation PG30W.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation VZXDS.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 49378.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 48U9D.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 20F46.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5032X.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 579TA.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation N2YP8.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation P3P3G.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation JA7IN.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 9L490.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation TZ44V.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 32689.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation J1IQM.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 21VCQ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation U1754.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation NA9YQ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 9E2XX.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation F1P64.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation I969V.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation S11E6.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation HP500.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5485Z.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5T7F0.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation H2Z8X.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 80872.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 17O43.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation V8P14.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 730UH.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation ZK932.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 4H6OT.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 36P28.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation WI6B2.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Z35PX.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 8T78D.exe -
Executes dropped EXE 64 IoCs
pid Process 1012 D83E2.exe 4472 5485Z.exe 4796 T0G67.exe 3180 I1302.exe 4196 048K7.exe 4208 NMJ88.exe 4448 67U56.exe 2232 UWAZ6.exe 4952 0M8SV.exe 712 C7B60.exe 1160 W5VU7.exe 2104 2BL1O.exe 2608 184K3.exe 3996 920T2.exe 2380 LAV1M.exe 1384 ZK932.exe 208 K17X5.exe 224 21VCQ.exe 2028 33OQ3.exe 4004 46273.exe 4484 P3P3G.exe 4728 5Z2L3.exe 4564 0SM2Y.exe 1728 6CU9E.exe 2724 3RVYW.exe 2040 5Z2WE.exe 1724 H589J.exe 3644 JA7IN.exe 4552 Z35PX.exe 4192 F4MZM.exe 5116 S46KM.exe 2336 5T7F0.exe 1160 LDOO6.exe 776 BOQOC.exe 2692 T2QN2.exe 4108 YBMO5.exe 3672 PFJOA.exe 1212 R5F50.exe 912 MSBP6.exe 2892 RF1J4.exe 3628 76K08.exe 4172 T74EW.exe 2028 68560.exe 2632 ZE9F1.exe 3640 CA875.exe 4472 CFD44.exe 2980 ZPF0I.exe 4476 013O2.exe 3068 5KJGA.exe 684 14WJN.exe 2040 C42Q3.exe 2372 NA9YQ.exe 532 0QRRN.exe 2976 4634B.exe 4192 KBFL5.exe 4700 5D328.exe 1648 0HN71.exe 3664 06901.exe 3932 4485W.exe 980 0LBIM.exe 1932 BJ573.exe 3240 Z7T8A.exe 2120 64B6I.exe 4504 B3MS5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1452 7b102e6a145bbf2ec1d025f9394b5670_NeikiAnalytics.exe 1452 7b102e6a145bbf2ec1d025f9394b5670_NeikiAnalytics.exe 1012 D83E2.exe 1012 D83E2.exe 4472 5485Z.exe 4472 5485Z.exe 4796 T0G67.exe 4796 T0G67.exe 3180 I1302.exe 3180 I1302.exe 4196 048K7.exe 4196 048K7.exe 4208 NMJ88.exe 4208 NMJ88.exe 4448 67U56.exe 4448 67U56.exe 2232 UWAZ6.exe 2232 UWAZ6.exe 4952 0M8SV.exe 4952 0M8SV.exe 712 C7B60.exe 712 C7B60.exe 1160 W5VU7.exe 1160 W5VU7.exe 2104 2BL1O.exe 2104 2BL1O.exe 2608 184K3.exe 2608 184K3.exe 3996 920T2.exe 3996 920T2.exe 2380 LAV1M.exe 2380 LAV1M.exe 1384 ZK932.exe 1384 ZK932.exe 208 K17X5.exe 208 K17X5.exe 224 21VCQ.exe 224 21VCQ.exe 2028 33OQ3.exe 2028 33OQ3.exe 4004 46273.exe 4004 46273.exe 4484 P3P3G.exe 4484 P3P3G.exe 4728 5Z2L3.exe 4728 5Z2L3.exe 4564 0SM2Y.exe 4564 0SM2Y.exe 1728 6CU9E.exe 1728 6CU9E.exe 2724 3RVYW.exe 2724 3RVYW.exe 2040 5Z2WE.exe 2040 5Z2WE.exe 1724 H589J.exe 1724 H589J.exe 3644 JA7IN.exe 3644 JA7IN.exe 4552 Z35PX.exe 4552 Z35PX.exe 4192 F4MZM.exe 4192 F4MZM.exe 5116 S46KM.exe 5116 S46KM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1452 wrote to memory of 1012 1452 7b102e6a145bbf2ec1d025f9394b5670_NeikiAnalytics.exe 83 PID 1452 wrote to memory of 1012 1452 7b102e6a145bbf2ec1d025f9394b5670_NeikiAnalytics.exe 83 PID 1452 wrote to memory of 1012 1452 7b102e6a145bbf2ec1d025f9394b5670_NeikiAnalytics.exe 83 PID 1012 wrote to memory of 4472 1012 D83E2.exe 84 PID 1012 wrote to memory of 4472 1012 D83E2.exe 84 PID 1012 wrote to memory of 4472 1012 D83E2.exe 84 PID 4472 wrote to memory of 4796 4472 5485Z.exe 85 PID 4472 wrote to memory of 4796 4472 5485Z.exe 85 PID 4472 wrote to memory of 4796 4472 5485Z.exe 85 PID 4796 wrote to memory of 3180 4796 T0G67.exe 86 PID 4796 wrote to memory of 3180 4796 T0G67.exe 86 PID 4796 wrote to memory of 3180 4796 T0G67.exe 86 PID 3180 wrote to memory of 4196 3180 I1302.exe 88 PID 3180 wrote to memory of 4196 3180 I1302.exe 88 PID 3180 wrote to memory of 4196 3180 I1302.exe 88 PID 4196 wrote to memory of 4208 4196 048K7.exe 89 PID 4196 wrote to memory of 4208 4196 048K7.exe 89 PID 4196 wrote to memory of 4208 4196 048K7.exe 89 PID 4208 wrote to memory of 4448 4208 NMJ88.exe 90 PID 4208 wrote to memory of 4448 4208 NMJ88.exe 90 PID 4208 wrote to memory of 4448 4208 NMJ88.exe 90 PID 4448 wrote to memory of 2232 4448 67U56.exe 91 PID 4448 wrote to memory of 2232 4448 67U56.exe 91 PID 4448 wrote to memory of 2232 4448 67U56.exe 91 PID 2232 wrote to memory of 4952 2232 UWAZ6.exe 92 PID 2232 wrote to memory of 4952 2232 UWAZ6.exe 92 PID 2232 wrote to memory of 4952 2232 UWAZ6.exe 92 PID 4952 wrote to memory of 712 4952 0M8SV.exe 94 PID 4952 wrote to memory of 712 4952 0M8SV.exe 94 PID 4952 wrote to memory of 712 4952 0M8SV.exe 94 PID 712 wrote to memory of 1160 712 C7B60.exe 95 PID 712 wrote to memory of 1160 712 C7B60.exe 95 PID 712 wrote to memory of 1160 712 C7B60.exe 95 PID 1160 wrote to memory of 2104 1160 W5VU7.exe 96 PID 1160 wrote to memory of 2104 1160 W5VU7.exe 96 PID 1160 wrote to memory of 2104 1160 W5VU7.exe 96 PID 2104 wrote to memory of 2608 2104 2BL1O.exe 97 PID 2104 wrote to memory of 2608 2104 2BL1O.exe 97 PID 2104 wrote to memory of 2608 2104 2BL1O.exe 97 PID 2608 wrote to memory of 3996 2608 184K3.exe 98 PID 2608 wrote to memory of 3996 2608 184K3.exe 98 PID 2608 wrote to memory of 3996 2608 184K3.exe 98 PID 3996 wrote to memory of 2380 3996 920T2.exe 99 PID 3996 wrote to memory of 2380 3996 920T2.exe 99 PID 3996 wrote to memory of 2380 3996 920T2.exe 99 PID 2380 wrote to memory of 1384 2380 LAV1M.exe 100 PID 2380 wrote to memory of 1384 2380 LAV1M.exe 100 PID 2380 wrote to memory of 1384 2380 LAV1M.exe 100 PID 1384 wrote to memory of 208 1384 ZK932.exe 101 PID 1384 wrote to memory of 208 1384 ZK932.exe 101 PID 1384 wrote to memory of 208 1384 ZK932.exe 101 PID 208 wrote to memory of 224 208 K17X5.exe 102 PID 208 wrote to memory of 224 208 K17X5.exe 102 PID 208 wrote to memory of 224 208 K17X5.exe 102 PID 224 wrote to memory of 2028 224 21VCQ.exe 103 PID 224 wrote to memory of 2028 224 21VCQ.exe 103 PID 224 wrote to memory of 2028 224 21VCQ.exe 103 PID 2028 wrote to memory of 4004 2028 33OQ3.exe 104 PID 2028 wrote to memory of 4004 2028 33OQ3.exe 104 PID 2028 wrote to memory of 4004 2028 33OQ3.exe 104 PID 4004 wrote to memory of 4484 4004 46273.exe 105 PID 4004 wrote to memory of 4484 4004 46273.exe 105 PID 4004 wrote to memory of 4484 4004 46273.exe 105 PID 4484 wrote to memory of 4728 4484 P3P3G.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b102e6a145bbf2ec1d025f9394b5670_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7b102e6a145bbf2ec1d025f9394b5670_NeikiAnalytics.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\D83E2.exe"C:\Users\Admin\AppData\Local\Temp\D83E2.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\5485Z.exe"C:\Users\Admin\AppData\Local\Temp\5485Z.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\T0G67.exe"C:\Users\Admin\AppData\Local\Temp\T0G67.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\I1302.exe"C:\Users\Admin\AppData\Local\Temp\I1302.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\048K7.exe"C:\Users\Admin\AppData\Local\Temp\048K7.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\NMJ88.exe"C:\Users\Admin\AppData\Local\Temp\NMJ88.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\67U56.exe"C:\Users\Admin\AppData\Local\Temp\67U56.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\UWAZ6.exe"C:\Users\Admin\AppData\Local\Temp\UWAZ6.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\0M8SV.exe"C:\Users\Admin\AppData\Local\Temp\0M8SV.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\C7B60.exe"C:\Users\Admin\AppData\Local\Temp\C7B60.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\W5VU7.exe"C:\Users\Admin\AppData\Local\Temp\W5VU7.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\2BL1O.exe"C:\Users\Admin\AppData\Local\Temp\2BL1O.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\184K3.exe"C:\Users\Admin\AppData\Local\Temp\184K3.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\920T2.exe"C:\Users\Admin\AppData\Local\Temp\920T2.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\LAV1M.exe"C:\Users\Admin\AppData\Local\Temp\LAV1M.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\ZK932.exe"C:\Users\Admin\AppData\Local\Temp\ZK932.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\K17X5.exe"C:\Users\Admin\AppData\Local\Temp\K17X5.exe"18⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\21VCQ.exe"C:\Users\Admin\AppData\Local\Temp\21VCQ.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\33OQ3.exe"C:\Users\Admin\AppData\Local\Temp\33OQ3.exe"20⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\46273.exe"C:\Users\Admin\AppData\Local\Temp\46273.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\P3P3G.exe"C:\Users\Admin\AppData\Local\Temp\P3P3G.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\5Z2L3.exe"C:\Users\Admin\AppData\Local\Temp\5Z2L3.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\0SM2Y.exe"C:\Users\Admin\AppData\Local\Temp\0SM2Y.exe"24⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\6CU9E.exe"C:\Users\Admin\AppData\Local\Temp\6CU9E.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\3RVYW.exe"C:\Users\Admin\AppData\Local\Temp\3RVYW.exe"26⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\5Z2WE.exe"C:\Users\Admin\AppData\Local\Temp\5Z2WE.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\H589J.exe"C:\Users\Admin\AppData\Local\Temp\H589J.exe"28⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\JA7IN.exe"C:\Users\Admin\AppData\Local\Temp\JA7IN.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\Z35PX.exe"C:\Users\Admin\AppData\Local\Temp\Z35PX.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\F4MZM.exe"C:\Users\Admin\AppData\Local\Temp\F4MZM.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\S46KM.exe"C:\Users\Admin\AppData\Local\Temp\S46KM.exe"32⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\5T7F0.exe"C:\Users\Admin\AppData\Local\Temp\5T7F0.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\LDOO6.exe"C:\Users\Admin\AppData\Local\Temp\LDOO6.exe"34⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\BOQOC.exe"C:\Users\Admin\AppData\Local\Temp\BOQOC.exe"35⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\T2QN2.exe"C:\Users\Admin\AppData\Local\Temp\T2QN2.exe"36⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\YBMO5.exe"C:\Users\Admin\AppData\Local\Temp\YBMO5.exe"37⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\PFJOA.exe"C:\Users\Admin\AppData\Local\Temp\PFJOA.exe"38⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\R5F50.exe"C:\Users\Admin\AppData\Local\Temp\R5F50.exe"39⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\MSBP6.exe"C:\Users\Admin\AppData\Local\Temp\MSBP6.exe"40⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\RF1J4.exe"C:\Users\Admin\AppData\Local\Temp\RF1J4.exe"41⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\76K08.exe"C:\Users\Admin\AppData\Local\Temp\76K08.exe"42⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\T74EW.exe"C:\Users\Admin\AppData\Local\Temp\T74EW.exe"43⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\68560.exe"C:\Users\Admin\AppData\Local\Temp\68560.exe"44⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\ZE9F1.exe"C:\Users\Admin\AppData\Local\Temp\ZE9F1.exe"45⤵
- Checks computer location settings
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\CA875.exe"C:\Users\Admin\AppData\Local\Temp\CA875.exe"46⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\CFD44.exe"C:\Users\Admin\AppData\Local\Temp\CFD44.exe"47⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\ZPF0I.exe"C:\Users\Admin\AppData\Local\Temp\ZPF0I.exe"48⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\013O2.exe"C:\Users\Admin\AppData\Local\Temp\013O2.exe"49⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\5KJGA.exe"C:\Users\Admin\AppData\Local\Temp\5KJGA.exe"50⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\14WJN.exe"C:\Users\Admin\AppData\Local\Temp\14WJN.exe"51⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\C42Q3.exe"C:\Users\Admin\AppData\Local\Temp\C42Q3.exe"52⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\NA9YQ.exe"C:\Users\Admin\AppData\Local\Temp\NA9YQ.exe"53⤵
- Checks computer location settings
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\0QRRN.exe"C:\Users\Admin\AppData\Local\Temp\0QRRN.exe"54⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\4634B.exe"C:\Users\Admin\AppData\Local\Temp\4634B.exe"55⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\KBFL5.exe"C:\Users\Admin\AppData\Local\Temp\KBFL5.exe"56⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\5D328.exe"C:\Users\Admin\AppData\Local\Temp\5D328.exe"57⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\0HN71.exe"C:\Users\Admin\AppData\Local\Temp\0HN71.exe"58⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\06901.exe"C:\Users\Admin\AppData\Local\Temp\06901.exe"59⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\4485W.exe"C:\Users\Admin\AppData\Local\Temp\4485W.exe"60⤵
- Checks computer location settings
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\0LBIM.exe"C:\Users\Admin\AppData\Local\Temp\0LBIM.exe"61⤵
- Checks computer location settings
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\BJ573.exe"C:\Users\Admin\AppData\Local\Temp\BJ573.exe"62⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\Z7T8A.exe"C:\Users\Admin\AppData\Local\Temp\Z7T8A.exe"63⤵
- Checks computer location settings
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\64B6I.exe"C:\Users\Admin\AppData\Local\Temp\64B6I.exe"64⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\B3MS5.exe"C:\Users\Admin\AppData\Local\Temp\B3MS5.exe"65⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\SEGB4.exe"C:\Users\Admin\AppData\Local\Temp\SEGB4.exe"66⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\EBH9T.exe"C:\Users\Admin\AppData\Local\Temp\EBH9T.exe"67⤵
- Checks computer location settings
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\7G606.exe"C:\Users\Admin\AppData\Local\Temp\7G606.exe"68⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\7BO34.exe"C:\Users\Admin\AppData\Local\Temp\7BO34.exe"69⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\9E2XX.exe"C:\Users\Admin\AppData\Local\Temp\9E2XX.exe"70⤵
- Checks computer location settings
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\VPX0L.exe"C:\Users\Admin\AppData\Local\Temp\VPX0L.exe"71⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\8WIFU.exe"C:\Users\Admin\AppData\Local\Temp\8WIFU.exe"72⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\8RIN3.exe"C:\Users\Admin\AppData\Local\Temp\8RIN3.exe"73⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\8H3OB.exe"C:\Users\Admin\AppData\Local\Temp\8H3OB.exe"74⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\00VEN.exe"C:\Users\Admin\AppData\Local\Temp\00VEN.exe"75⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\K3STA.exe"C:\Users\Admin\AppData\Local\Temp\K3STA.exe"76⤵
- Checks computer location settings
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\T30F8.exe"C:\Users\Admin\AppData\Local\Temp\T30F8.exe"77⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\V6447.exe"C:\Users\Admin\AppData\Local\Temp\V6447.exe"78⤵
- Checks computer location settings
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\9V8A3.exe"C:\Users\Admin\AppData\Local\Temp\9V8A3.exe"79⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\3N7V7.exe"C:\Users\Admin\AppData\Local\Temp\3N7V7.exe"80⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\ZQV30.exe"C:\Users\Admin\AppData\Local\Temp\ZQV30.exe"81⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\8S093.exe"C:\Users\Admin\AppData\Local\Temp\8S093.exe"82⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\G15WL.exe"C:\Users\Admin\AppData\Local\Temp\G15WL.exe"83⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\886ZD.exe"C:\Users\Admin\AppData\Local\Temp\886ZD.exe"84⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\2IP99.exe"C:\Users\Admin\AppData\Local\Temp\2IP99.exe"85⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\8HXTZ.exe"C:\Users\Admin\AppData\Local\Temp\8HXTZ.exe"86⤵
- Checks computer location settings
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\YQ4Z4.exe"C:\Users\Admin\AppData\Local\Temp\YQ4Z4.exe"87⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\154GL.exe"C:\Users\Admin\AppData\Local\Temp\154GL.exe"88⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\Y2X6U.exe"C:\Users\Admin\AppData\Local\Temp\Y2X6U.exe"89⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\2MIB3.exe"C:\Users\Admin\AppData\Local\Temp\2MIB3.exe"90⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\7L252.exe"C:\Users\Admin\AppData\Local\Temp\7L252.exe"91⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\BSP70.exe"C:\Users\Admin\AppData\Local\Temp\BSP70.exe"92⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\9415F.exe"C:\Users\Admin\AppData\Local\Temp\9415F.exe"93⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\3J6M0.exe"C:\Users\Admin\AppData\Local\Temp\3J6M0.exe"94⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\A4J5Y.exe"C:\Users\Admin\AppData\Local\Temp\A4J5Y.exe"95⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\SVJ33.exe"C:\Users\Admin\AppData\Local\Temp\SVJ33.exe"96⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\BSF91.exe"C:\Users\Admin\AppData\Local\Temp\BSF91.exe"97⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\4W4BN.exe"C:\Users\Admin\AppData\Local\Temp\4W4BN.exe"98⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\9A147.exe"C:\Users\Admin\AppData\Local\Temp\9A147.exe"99⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\3OLAD.exe"C:\Users\Admin\AppData\Local\Temp\3OLAD.exe"100⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\SFL41.exe"C:\Users\Admin\AppData\Local\Temp\SFL41.exe"101⤵
- Checks computer location settings
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\1GMHS.exe"C:\Users\Admin\AppData\Local\Temp\1GMHS.exe"102⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\GXM01.exe"C:\Users\Admin\AppData\Local\Temp\GXM01.exe"103⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\PCR69.exe"C:\Users\Admin\AppData\Local\Temp\PCR69.exe"104⤵
- Checks computer location settings
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\WQ8EP.exe"C:\Users\Admin\AppData\Local\Temp\WQ8EP.exe"105⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\VT7V9.exe"C:\Users\Admin\AppData\Local\Temp\VT7V9.exe"106⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\E0WVX.exe"C:\Users\Admin\AppData\Local\Temp\E0WVX.exe"107⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\2YE23.exe"C:\Users\Admin\AppData\Local\Temp\2YE23.exe"108⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\FIG4E.exe"C:\Users\Admin\AppData\Local\Temp\FIG4E.exe"109⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\49378.exe"C:\Users\Admin\AppData\Local\Temp\49378.exe"110⤵
- Checks computer location settings
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\20F46.exe"C:\Users\Admin\AppData\Local\Temp\20F46.exe"111⤵
- Checks computer location settings
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\RJ0RO.exe"C:\Users\Admin\AppData\Local\Temp\RJ0RO.exe"112⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\6CG49.exe"C:\Users\Admin\AppData\Local\Temp\6CG49.exe"113⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\8K21O.exe"C:\Users\Admin\AppData\Local\Temp\8K21O.exe"114⤵
- Checks computer location settings
PID:644 -
C:\Users\Admin\AppData\Local\Temp\0XJ40.exe"C:\Users\Admin\AppData\Local\Temp\0XJ40.exe"115⤵
- Checks computer location settings
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\DWJTG.exe"C:\Users\Admin\AppData\Local\Temp\DWJTG.exe"116⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\K7WT2.exe"C:\Users\Admin\AppData\Local\Temp\K7WT2.exe"117⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\RO3SW.exe"C:\Users\Admin\AppData\Local\Temp\RO3SW.exe"118⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\0F88V.exe"C:\Users\Admin\AppData\Local\Temp\0F88V.exe"119⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\LO226.exe"C:\Users\Admin\AppData\Local\Temp\LO226.exe"120⤵
- Checks computer location settings
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\S2EYN.exe"C:\Users\Admin\AppData\Local\Temp\S2EYN.exe"121⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\664EO.exe"C:\Users\Admin\AppData\Local\Temp\664EO.exe"122⤵PID:2084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-