Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 12:04
Static task
static1
Behavioral task
behavioral1
Sample
daa0dcfa7fd4104a26897fef6ca0bf90_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
daa0dcfa7fd4104a26897fef6ca0bf90_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
daa0dcfa7fd4104a26897fef6ca0bf90_NeikiAnalytics.exe
-
Size
289KB
-
MD5
daa0dcfa7fd4104a26897fef6ca0bf90
-
SHA1
bb8177e1de4cf85bc8827547d8e5ac6f41e271b2
-
SHA256
8e8bb101a5d4fa20b6c48d965827ff065125639ce6433105b81402cdf8e872a4
-
SHA512
b084c031d032f1d547f7783f8bd4553a7bb44e89029a6e8419160b1bd9e04f5e06bfbc2640b545a1766c3ba925916b06498d5676d6f770f59ac043670e2225f8
-
SSDEEP
6144:gblyesukYZdvrniRfBgM1HSk03Ck4YukECzJLaQVbU5:gJ7Z5rnIHSk03Ck7uklJLJbU5
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation CDDKHC.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation WRBLZAK.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation BAX.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation GMJC.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation KKYXFEC.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation FYLOUSO.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation OYVTUN.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation DHRMYY.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation KJFFYVW.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation PICGJ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation IEPB.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation HMXNDP.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation UHTSO.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation NIHC.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation UPJPMR.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation LQKYUP.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation OUEPYE.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation WHXIW.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation HBFCM.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation IOKHGMK.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation BPVMZ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation STOTAA.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation USVWP.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation VTIIPK.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SLBZYSF.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation VKONKE.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation XFYLJMV.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation CVHEWXY.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation PIO.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation MKG.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation LGFS.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation XWMSNF.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ICIOKKI.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ZFRYAJU.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation CPHI.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation IQGFBAO.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ADQXTZ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation PFB.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation AHBFXFG.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation PZWTAXJ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation VFITAQ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation VWACA.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation LXSG.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation EFLD.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation PACED.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation YUQ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation OMUFRMJ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation PCVCEI.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation MYMNF.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation NMJIWYM.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation OIM.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation FLYPCKI.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SVLAW.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation MLQK.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation QBNRBUD.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation QWRNHK.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation IZC.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation IPJDF.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation CDJMK.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation EHEKC.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ONCFFTD.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation JZMR.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation LRDPBN.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation DFGZ.exe -
Executes dropped EXE 64 IoCs
pid Process 5064 TYZQJJY.exe 3012 WMWZ.exe 4952 KKYXFEC.exe 4500 DFPBJIL.exe 2452 MDH.exe 3028 NIHC.exe 1432 BETDPM.exe 3952 ZBEY.exe 2440 UPJPMR.exe 2056 OCO.exe 4060 ESPQ.exe 1268 NARVZJI.exe 2024 LQKYUP.exe 1004 SLBZYSF.exe 880 JZMR.exe 2596 BUPVUE.exe 3208 LRDPBN.exe 4904 PDBC.exe 3104 FYLOUSO.exe 3512 SVLAW.exe 1056 UTY.exe 4968 ATGAU.exe 552 TMNLE.exe 1084 VKONKE.exe 1176 UVRDLKM.exe 1540 WSXYATV.exe 4496 IILY.exe 4748 CWQHOL.exe 5108 XJN.exe 3472 WUYGHZR.exe 2588 KZWE.exe 4904 WKG.exe 1700 EFLD.exe 4540 MLQK.exe 2900 OYVTUN.exe 4688 ZRKE.exe 2400 DHRMYY.exe 4332 ZFRYAJU.exe 1464 XFYLJMV.exe 4904 DFGZ.exe 4276 BYR.exe 3820 WLOZL.exe 4672 NMQEOR.exe 4732 CPHI.exe 4376 GSFDHFM.exe 5048 WNPHS.exe 4400 MXSX.exe 2336 EGUDE.exe 4116 TWH.exe 4628 QBNRBUD.exe 4660 QWRNHK.exe 3920 SUWH.exe 3768 PACED.exe 2388 CCYDI.exe 2708 CVHEWXY.exe 2736 IQGFBAO.exe 4592 MYMNF.exe 3056 OUEPYE.exe 748 YUGU.exe 3272 BCO.exe 2624 VYTAT.exe 3752 IACYH.exe 3380 HLFGQMV.exe 2584 IOVCE.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\IACYH.exe.bat VYTAT.exe File opened for modification C:\windows\SysWOW64\IOKHGMK.exe AEJFSIV.exe File created C:\windows\SysWOW64\ZWADP.exe EJV.exe File created C:\windows\SysWOW64\QGCIPB.exe.bat XDYMJLB.exe File created C:\windows\SysWOW64\FYLOUSO.exe.bat PDBC.exe File opened for modification C:\windows\SysWOW64\CGDFXPE.exe JCZ.exe File opened for modification C:\windows\SysWOW64\XWMSNF.exe LGFS.exe File created C:\windows\SysWOW64\YETXJ.exe XBPBVQ.exe File opened for modification C:\windows\SysWOW64\PXIWB.exe WUE.exe File opened for modification C:\windows\SysWOW64\WRBLZAK.exe LZGSQS.exe File created C:\windows\SysWOW64\WRBLZAK.exe LZGSQS.exe File created C:\windows\SysWOW64\CGDFXPE.exe JCZ.exe File created C:\windows\SysWOW64\OCPC.exe.bat ICIOKKI.exe File created C:\windows\SysWOW64\KAPHXHO.exe.bat TCR.exe File created C:\windows\SysWOW64\DYF.exe UXDCEQW.exe File opened for modification C:\windows\SysWOW64\USVWP.exe BXJTKQ.exe File created C:\windows\SysWOW64\FQOU.exe OIM.exe File created C:\windows\SysWOW64\JNRMHG.exe IPJDF.exe File created C:\windows\SysWOW64\BVFGEI.exe.bat RYZUWA.exe File created C:\windows\SysWOW64\YUTBGH.exe.bat OMRWU.exe File created C:\windows\SysWOW64\XWMSNF.exe LGFS.exe File created C:\windows\SysWOW64\XWMSNF.exe.bat LGFS.exe File created C:\windows\SysWOW64\ZWADP.exe.bat EJV.exe File created C:\windows\SysWOW64\CWQHOL.exe.bat IILY.exe File created C:\windows\SysWOW64\XVIFH.exe.bat ZCFPYR.exe File opened for modification C:\windows\SysWOW64\OKOIT.exe XVIFH.exe File opened for modification C:\windows\SysWOW64\WMWZ.exe TYZQJJY.exe File created C:\windows\SysWOW64\IOKHGMK.exe.bat AEJFSIV.exe File created C:\windows\SysWOW64\GMJC.exe RWI.exe File opened for modification C:\windows\SysWOW64\INUQ.exe IZC.exe File created C:\windows\SysWOW64\BVFGEI.exe RYZUWA.exe File created C:\windows\SysWOW64\ATGAU.exe UTY.exe File opened for modification C:\windows\SysWOW64\DYF.exe UXDCEQW.exe File created C:\windows\SysWOW64\PIO.exe ANJW.exe File created C:\windows\SysWOW64\NWEETU.exe CDJMK.exe File created C:\windows\SysWOW64\SYM.exe.bat DDDEL.exe File created C:\windows\SysWOW64\FQOU.exe.bat OIM.exe File created C:\windows\SysWOW64\GMJC.exe.bat RWI.exe File opened for modification C:\windows\SysWOW64\CWQHOL.exe IILY.exe File opened for modification C:\windows\SysWOW64\VWACA.exe EYBZO.exe File created C:\windows\SysWOW64\YETXJ.exe.bat XBPBVQ.exe File created C:\windows\SysWOW64\PXIWB.exe.bat WUE.exe File created C:\windows\SysWOW64\INUQ.exe.bat IZC.exe File opened for modification C:\windows\SysWOW64\CGHOM.exe CDDKHC.exe File created C:\windows\SysWOW64\ZMHDIK.exe.bat WQQBO.exe File opened for modification C:\windows\SysWOW64\YETXJ.exe XBPBVQ.exe File created C:\windows\SysWOW64\CGHOM.exe CDDKHC.exe File opened for modification C:\windows\SysWOW64\GMJC.exe RWI.exe File opened for modification C:\windows\SysWOW64\PIO.exe ANJW.exe File created C:\windows\SysWOW64\PFB.exe.bat PKXC.exe File created C:\windows\SysWOW64\NWEETU.exe.bat CDJMK.exe File opened for modification C:\windows\SysWOW64\XWIQ.exe IBZEFQ.exe File opened for modification C:\windows\SysWOW64\PFB.exe PKXC.exe File created C:\windows\SysWOW64\TXZA.exe.bat GMJC.exe File created C:\windows\SysWOW64\VYTAT.exe BCO.exe File opened for modification C:\windows\SysWOW64\YUTBGH.exe OMRWU.exe File opened for modification C:\windows\SysWOW64\OCPC.exe ICIOKKI.exe File created C:\windows\SysWOW64\INUQ.exe IZC.exe File created C:\windows\SysWOW64\XDYMJLB.exe HMXNDP.exe File created C:\windows\SysWOW64\PICGJ.exe JIV.exe File created C:\windows\SysWOW64\KZWE.exe WUYGHZR.exe File opened for modification C:\windows\SysWOW64\FTOR.exe ZTGE.exe File created C:\windows\SysWOW64\VTYCIP.exe SGUT.exe File created C:\windows\SysWOW64\LZGSQS.exe.bat VJFSK.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\LQKYUP.exe.bat NARVZJI.exe File created C:\windows\IILY.exe.bat WSXYATV.exe File created C:\windows\EGUDE.exe.bat MXSX.exe File created C:\windows\PZCQ.exe STXT.exe File created C:\windows\RWI.exe.bat PZCQ.exe File created C:\windows\system\LXSG.exe.bat PXIWB.exe File created C:\windows\LRDPBN.exe BUPVUE.exe File created C:\windows\LRDPBN.exe.bat BUPVUE.exe File opened for modification C:\windows\system\ZFRYAJU.exe DHRMYY.exe File created C:\windows\system\ARZ.exe.bat PZWTAXJ.exe File opened for modification C:\windows\JCZ.exe YUTBGH.exe File created C:\windows\ZBEY.exe.bat BETDPM.exe File created C:\windows\EGUDE.exe MXSX.exe File created C:\windows\system\MYMNF.exe IQGFBAO.exe File created C:\windows\system\LGFS.exe CGDFXPE.exe File created C:\windows\YHBTTTW.exe.bat DLWCIT.exe File opened for modification C:\windows\system\WQQBO.exe FQOO.exe File created C:\windows\system\WHXIW.exe XWMSNF.exe File created C:\windows\system\KJFFYVW.exe PWBOO.exe File created C:\windows\HLOC.exe.bat PICGJ.exe File opened for modification C:\windows\system\KKYXFEC.exe WMWZ.exe File opened for modification C:\windows\OCO.exe UPJPMR.exe File opened for modification C:\windows\system\XJN.exe CWQHOL.exe File created C:\windows\YUQ.exe IEPB.exe File created C:\windows\system\EDUACAS.exe.bat CGHOM.exe File created C:\windows\system\STOTAA.exe.bat DYF.exe File opened for modification C:\windows\HLFGQMV.exe IACYH.exe File created C:\windows\VJFSK.exe EDUACAS.exe File opened for modification C:\windows\BXJTKQ.exe HBMJA.exe File opened for modification C:\windows\system\GWS.exe FTOR.exe File opened for modification C:\windows\system\IPJDF.exe GCE.exe File created C:\windows\system\EHEKC.exe.bat OMUFRMJ.exe File opened for modification C:\windows\HYWFJ.exe NKFV.exe File opened for modification C:\windows\UPJPMR.exe ZBEY.exe File created C:\windows\system\XFYLJMV.exe ZFRYAJU.exe File created C:\windows\WNPHS.exe GSFDHFM.exe File created C:\windows\YUQ.exe.bat IEPB.exe File opened for modification C:\windows\CSE.exe BPVMZ.exe File opened for modification C:\windows\system\LGFS.exe CGDFXPE.exe File created C:\windows\EOWEZHE.exe.bat PTFS.exe File opened for modification C:\windows\system\MYMNF.exe IQGFBAO.exe File created C:\windows\system\UPGD.exe MKG.exe File opened for modification C:\windows\OMRWU.exe ZRHRJPE.exe File created C:\windows\system\ZCFPYR.exe YHBTTTW.exe File created C:\windows\HBFCM.exe BAX.exe File created C:\windows\system\FQUTPU.exe TXZA.exe File created C:\windows\OCO.exe.bat UPJPMR.exe File created C:\windows\UXDCEQW.exe KAPHXHO.exe File created C:\windows\system\PTFS.exe BVFGEI.exe File created C:\windows\NMQEOR.exe WLOZL.exe File opened for modification C:\windows\PZWTAXJ.exe SYM.exe File created C:\windows\PKXC.exe.bat NMJIWYM.exe File opened for modification C:\windows\system\KJFFYVW.exe PWBOO.exe File created C:\windows\system\VKONKE.exe.bat TMNLE.exe File created C:\windows\NMQEOR.exe.bat WLOZL.exe File created C:\windows\system\HBMJA.exe ZWADP.exe File created C:\windows\system\OIM.exe.bat VFITAQ.exe File opened for modification C:\windows\YHBTTTW.exe DLWCIT.exe File opened for modification C:\windows\DFPBJIL.exe KKYXFEC.exe File opened for modification C:\windows\system\NIHC.exe MDH.exe File created C:\windows\system\XJN.exe.bat CWQHOL.exe File created C:\windows\system\MLQK.exe EFLD.exe File created C:\windows\TCTO.exe.bat PUNGEQ.exe File created C:\windows\system\WSXYATV.exe.bat UVRDLKM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
pid pid_target Process procid_target 4920 1228 WerFault.exe 81 1168 5064 WerFault.exe 89 2300 3012 WerFault.exe 95 2736 4952 WerFault.exe 100 2588 4500 WerFault.exe 105 3348 2452 WerFault.exe 112 2432 3028 WerFault.exe 117 4084 1432 WerFault.exe 124 1292 3952 WerFault.exe 130 5108 2440 WerFault.exe 135 4732 2056 WerFault.exe 141 624 4060 WerFault.exe 147 1176 1268 WerFault.exe 152 532 2024 WerFault.exe 157 5036 1004 WerFault.exe 162 4628 880 WerFault.exe 168 2028 2596 WerFault.exe 173 2368 3208 WerFault.exe 178 1168 4904 WerFault.exe 183 3504 3104 WerFault.exe 189 2336 3512 WerFault.exe 194 4152 1056 WerFault.exe 199 3804 4968 WerFault.exe 204 3488 552 WerFault.exe 209 3924 1084 WerFault.exe 214 4064 1176 WerFault.exe 219 3652 1540 WerFault.exe 224 1752 4496 WerFault.exe 229 4508 4748 WerFault.exe 234 4652 5108 WerFault.exe 239 1948 3472 WerFault.exe 244 1168 2588 WerFault.exe 249 4940 4904 WerFault.exe 254 1364 1700 WerFault.exe 259 3156 4540 WerFault.exe 264 3060 2900 WerFault.exe 269 3604 4688 WerFault.exe 274 3164 2400 WerFault.exe 280 1656 4332 WerFault.exe 285 3028 1464 WerFault.exe 290 3012 4904 WerFault.exe 295 1256 4276 WerFault.exe 300 3060 3820 WerFault.exe 305 4936 4672 WerFault.exe 310 2016 4732 WerFault.exe 315 4980 4376 WerFault.exe 320 4064 5048 WerFault.exe 325 880 4400 WerFault.exe 330 3184 2336 WerFault.exe 335 408 4116 WerFault.exe 341 2716 4628 WerFault.exe 346 2016 4660 WerFault.exe 351 4900 3920 WerFault.exe 356 4416 3768 WerFault.exe 361 2120 2388 WerFault.exe 366 2020 2708 WerFault.exe 371 3168 2736 WerFault.exe 376 1168 4592 WerFault.exe 381 2636 3056 WerFault.exe 386 4376 748 WerFault.exe 391 5048 3272 WerFault.exe 396 820 2624 WerFault.exe 401 3112 3752 WerFault.exe 406 4344 3380 WerFault.exe 411 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1228 daa0dcfa7fd4104a26897fef6ca0bf90_NeikiAnalytics.exe 1228 daa0dcfa7fd4104a26897fef6ca0bf90_NeikiAnalytics.exe 5064 TYZQJJY.exe 5064 TYZQJJY.exe 3012 WMWZ.exe 3012 WMWZ.exe 4952 KKYXFEC.exe 4952 KKYXFEC.exe 4500 DFPBJIL.exe 4500 DFPBJIL.exe 2452 MDH.exe 2452 MDH.exe 3028 NIHC.exe 3028 NIHC.exe 1432 BETDPM.exe 1432 BETDPM.exe 3952 ZBEY.exe 3952 ZBEY.exe 2440 UPJPMR.exe 2440 UPJPMR.exe 2056 OCO.exe 2056 OCO.exe 4060 ESPQ.exe 4060 ESPQ.exe 1268 NARVZJI.exe 1268 NARVZJI.exe 2024 LQKYUP.exe 2024 LQKYUP.exe 1004 SLBZYSF.exe 1004 SLBZYSF.exe 880 JZMR.exe 880 JZMR.exe 2596 BUPVUE.exe 2596 BUPVUE.exe 3208 LRDPBN.exe 3208 LRDPBN.exe 4904 PDBC.exe 4904 PDBC.exe 3104 FYLOUSO.exe 3104 FYLOUSO.exe 3512 SVLAW.exe 3512 SVLAW.exe 1056 UTY.exe 1056 UTY.exe 4968 ATGAU.exe 4968 ATGAU.exe 552 TMNLE.exe 552 TMNLE.exe 1084 VKONKE.exe 1084 VKONKE.exe 1176 UVRDLKM.exe 1176 UVRDLKM.exe 1540 WSXYATV.exe 1540 WSXYATV.exe 4496 IILY.exe 4496 IILY.exe 4748 CWQHOL.exe 4748 CWQHOL.exe 5108 XJN.exe 5108 XJN.exe 3472 WUYGHZR.exe 3472 WUYGHZR.exe 2588 KZWE.exe 2588 KZWE.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1228 daa0dcfa7fd4104a26897fef6ca0bf90_NeikiAnalytics.exe 1228 daa0dcfa7fd4104a26897fef6ca0bf90_NeikiAnalytics.exe 5064 TYZQJJY.exe 5064 TYZQJJY.exe 3012 WMWZ.exe 3012 WMWZ.exe 4952 KKYXFEC.exe 4952 KKYXFEC.exe 4500 DFPBJIL.exe 4500 DFPBJIL.exe 2452 MDH.exe 2452 MDH.exe 3028 NIHC.exe 3028 NIHC.exe 1432 BETDPM.exe 1432 BETDPM.exe 3952 ZBEY.exe 3952 ZBEY.exe 2440 UPJPMR.exe 2440 UPJPMR.exe 2056 OCO.exe 2056 OCO.exe 4060 ESPQ.exe 4060 ESPQ.exe 1268 NARVZJI.exe 1268 NARVZJI.exe 2024 LQKYUP.exe 2024 LQKYUP.exe 1004 SLBZYSF.exe 1004 SLBZYSF.exe 880 JZMR.exe 880 JZMR.exe 2596 BUPVUE.exe 2596 BUPVUE.exe 3208 LRDPBN.exe 3208 LRDPBN.exe 4904 PDBC.exe 4904 PDBC.exe 3104 FYLOUSO.exe 3104 FYLOUSO.exe 3512 SVLAW.exe 3512 SVLAW.exe 1056 UTY.exe 1056 UTY.exe 4968 ATGAU.exe 4968 ATGAU.exe 552 TMNLE.exe 552 TMNLE.exe 1084 VKONKE.exe 1084 VKONKE.exe 1176 UVRDLKM.exe 1176 UVRDLKM.exe 1540 WSXYATV.exe 1540 WSXYATV.exe 4496 IILY.exe 4496 IILY.exe 4748 CWQHOL.exe 4748 CWQHOL.exe 5108 XJN.exe 5108 XJN.exe 3472 WUYGHZR.exe 3472 WUYGHZR.exe 2588 KZWE.exe 2588 KZWE.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1228 wrote to memory of 3524 1228 daa0dcfa7fd4104a26897fef6ca0bf90_NeikiAnalytics.exe 85 PID 1228 wrote to memory of 3524 1228 daa0dcfa7fd4104a26897fef6ca0bf90_NeikiAnalytics.exe 85 PID 1228 wrote to memory of 3524 1228 daa0dcfa7fd4104a26897fef6ca0bf90_NeikiAnalytics.exe 85 PID 3524 wrote to memory of 5064 3524 cmd.exe 89 PID 3524 wrote to memory of 5064 3524 cmd.exe 89 PID 3524 wrote to memory of 5064 3524 cmd.exe 89 PID 5064 wrote to memory of 2636 5064 TYZQJJY.exe 91 PID 5064 wrote to memory of 2636 5064 TYZQJJY.exe 91 PID 5064 wrote to memory of 2636 5064 TYZQJJY.exe 91 PID 2636 wrote to memory of 3012 2636 cmd.exe 95 PID 2636 wrote to memory of 3012 2636 cmd.exe 95 PID 2636 wrote to memory of 3012 2636 cmd.exe 95 PID 3012 wrote to memory of 5020 3012 WMWZ.exe 96 PID 3012 wrote to memory of 5020 3012 WMWZ.exe 96 PID 3012 wrote to memory of 5020 3012 WMWZ.exe 96 PID 5020 wrote to memory of 4952 5020 cmd.exe 100 PID 5020 wrote to memory of 4952 5020 cmd.exe 100 PID 5020 wrote to memory of 4952 5020 cmd.exe 100 PID 4952 wrote to memory of 1004 4952 KKYXFEC.exe 101 PID 4952 wrote to memory of 1004 4952 KKYXFEC.exe 101 PID 4952 wrote to memory of 1004 4952 KKYXFEC.exe 101 PID 1004 wrote to memory of 4500 1004 cmd.exe 105 PID 1004 wrote to memory of 4500 1004 cmd.exe 105 PID 1004 wrote to memory of 4500 1004 cmd.exe 105 PID 4500 wrote to memory of 4876 4500 DFPBJIL.exe 108 PID 4500 wrote to memory of 4876 4500 DFPBJIL.exe 108 PID 4500 wrote to memory of 4876 4500 DFPBJIL.exe 108 PID 4876 wrote to memory of 2452 4876 cmd.exe 112 PID 4876 wrote to memory of 2452 4876 cmd.exe 112 PID 4876 wrote to memory of 2452 4876 cmd.exe 112 PID 2452 wrote to memory of 1844 2452 MDH.exe 113 PID 2452 wrote to memory of 1844 2452 MDH.exe 113 PID 2452 wrote to memory of 1844 2452 MDH.exe 113 PID 1844 wrote to memory of 3028 1844 cmd.exe 117 PID 1844 wrote to memory of 3028 1844 cmd.exe 117 PID 1844 wrote to memory of 3028 1844 cmd.exe 117 PID 3028 wrote to memory of 1204 3028 NIHC.exe 120 PID 3028 wrote to memory of 1204 3028 NIHC.exe 120 PID 3028 wrote to memory of 1204 3028 NIHC.exe 120 PID 1204 wrote to memory of 1432 1204 cmd.exe 124 PID 1204 wrote to memory of 1432 1204 cmd.exe 124 PID 1204 wrote to memory of 1432 1204 cmd.exe 124 PID 1432 wrote to memory of 2124 1432 BETDPM.exe 126 PID 1432 wrote to memory of 2124 1432 BETDPM.exe 126 PID 1432 wrote to memory of 2124 1432 BETDPM.exe 126 PID 2124 wrote to memory of 3952 2124 cmd.exe 130 PID 2124 wrote to memory of 3952 2124 cmd.exe 130 PID 2124 wrote to memory of 3952 2124 cmd.exe 130 PID 3952 wrote to memory of 4324 3952 ZBEY.exe 131 PID 3952 wrote to memory of 4324 3952 ZBEY.exe 131 PID 3952 wrote to memory of 4324 3952 ZBEY.exe 131 PID 4324 wrote to memory of 2440 4324 cmd.exe 135 PID 4324 wrote to memory of 2440 4324 cmd.exe 135 PID 4324 wrote to memory of 2440 4324 cmd.exe 135 PID 2440 wrote to memory of 3996 2440 UPJPMR.exe 137 PID 2440 wrote to memory of 3996 2440 UPJPMR.exe 137 PID 2440 wrote to memory of 3996 2440 UPJPMR.exe 137 PID 3996 wrote to memory of 2056 3996 cmd.exe 141 PID 3996 wrote to memory of 2056 3996 cmd.exe 141 PID 3996 wrote to memory of 2056 3996 cmd.exe 141 PID 2056 wrote to memory of 3772 2056 OCO.exe 143 PID 2056 wrote to memory of 3772 2056 OCO.exe 143 PID 2056 wrote to memory of 3772 2056 OCO.exe 143 PID 3772 wrote to memory of 4060 3772 cmd.exe 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\daa0dcfa7fd4104a26897fef6ca0bf90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\daa0dcfa7fd4104a26897fef6ca0bf90_NeikiAnalytics.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TYZQJJY.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\windows\system\TYZQJJY.exeC:\windows\system\TYZQJJY.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WMWZ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\windows\SysWOW64\WMWZ.exeC:\windows\system32\WMWZ.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KKYXFEC.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\windows\system\KKYXFEC.exeC:\windows\system\KKYXFEC.exe7⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DFPBJIL.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\windows\DFPBJIL.exeC:\windows\DFPBJIL.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MDH.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\windows\MDH.exeC:\windows\MDH.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NIHC.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\windows\system\NIHC.exeC:\windows\system\NIHC.exe13⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BETDPM.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\windows\system\BETDPM.exeC:\windows\system\BETDPM.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZBEY.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\windows\ZBEY.exeC:\windows\ZBEY.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPJPMR.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\windows\UPJPMR.exeC:\windows\UPJPMR.exe19⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OCO.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\windows\OCO.exeC:\windows\OCO.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ESPQ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\windows\ESPQ.exeC:\windows\ESPQ.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NARVZJI.exe.bat" "24⤵PID:2616
-
C:\windows\NARVZJI.exeC:\windows\NARVZJI.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LQKYUP.exe.bat" "26⤵PID:3892
-
C:\windows\LQKYUP.exeC:\windows\LQKYUP.exe27⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SLBZYSF.exe.bat" "28⤵PID:2460
-
C:\windows\system\SLBZYSF.exeC:\windows\system\SLBZYSF.exe29⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZMR.exe.bat" "30⤵PID:1368
-
C:\windows\JZMR.exeC:\windows\JZMR.exe31⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BUPVUE.exe.bat" "32⤵PID:4952
-
C:\windows\SysWOW64\BUPVUE.exeC:\windows\system32\BUPVUE.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LRDPBN.exe.bat" "34⤵PID:2492
-
C:\windows\LRDPBN.exeC:\windows\LRDPBN.exe35⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PDBC.exe.bat" "36⤵PID:4336
-
C:\windows\system\PDBC.exeC:\windows\system\PDBC.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYLOUSO.exe.bat" "38⤵PID:4468
-
C:\windows\SysWOW64\FYLOUSO.exeC:\windows\system32\FYLOUSO.exe39⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVLAW.exe.bat" "40⤵PID:4816
-
C:\windows\SysWOW64\SVLAW.exeC:\windows\system32\SVLAW.exe41⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UTY.exe.bat" "42⤵PID:4168
-
C:\windows\UTY.exeC:\windows\UTY.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ATGAU.exe.bat" "44⤵PID:4344
-
C:\windows\SysWOW64\ATGAU.exeC:\windows\system32\ATGAU.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TMNLE.exe.bat" "46⤵PID:3264
-
C:\windows\TMNLE.exeC:\windows\TMNLE.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VKONKE.exe.bat" "48⤵PID:224
-
C:\windows\system\VKONKE.exeC:\windows\system\VKONKE.exe49⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UVRDLKM.exe.bat" "50⤵PID:4312
-
C:\windows\UVRDLKM.exeC:\windows\UVRDLKM.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSXYATV.exe.bat" "52⤵PID:1520
-
C:\windows\system\WSXYATV.exeC:\windows\system\WSXYATV.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IILY.exe.bat" "54⤵PID:4168
-
C:\windows\IILY.exeC:\windows\IILY.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CWQHOL.exe.bat" "56⤵PID:4988
-
C:\windows\SysWOW64\CWQHOL.exeC:\windows\system32\CWQHOL.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XJN.exe.bat" "58⤵PID:5004
-
C:\windows\system\XJN.exeC:\windows\system\XJN.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUYGHZR.exe.bat" "60⤵PID:2028
-
C:\windows\WUYGHZR.exeC:\windows\WUYGHZR.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZWE.exe.bat" "62⤵PID:2492
-
C:\windows\SysWOW64\KZWE.exeC:\windows\system32\KZWE.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WKG.exe.bat" "64⤵PID:3700
-
C:\windows\system\WKG.exeC:\windows\system\WKG.exe65⤵
- Executes dropped EXE
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EFLD.exe.bat" "66⤵PID:3924
-
C:\windows\system\EFLD.exeC:\windows\system\EFLD.exe67⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:1700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLQK.exe.bat" "68⤵PID:4064
-
C:\windows\system\MLQK.exeC:\windows\system\MLQK.exe69⤵
- Checks computer location settings
- Executes dropped EXE
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OYVTUN.exe.bat" "70⤵PID:2116
-
C:\windows\system\OYVTUN.exeC:\windows\system\OYVTUN.exe71⤵
- Checks computer location settings
- Executes dropped EXE
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZRKE.exe.bat" "72⤵PID:3184
-
C:\windows\ZRKE.exeC:\windows\ZRKE.exe73⤵
- Executes dropped EXE
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DHRMYY.exe.bat" "74⤵PID:2920
-
C:\windows\DHRMYY.exeC:\windows\DHRMYY.exe75⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZFRYAJU.exe.bat" "76⤵PID:4968
-
C:\windows\system\ZFRYAJU.exeC:\windows\system\ZFRYAJU.exe77⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XFYLJMV.exe.bat" "78⤵PID:1844
-
C:\windows\system\XFYLJMV.exeC:\windows\system\XFYLJMV.exe79⤵
- Checks computer location settings
- Executes dropped EXE
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DFGZ.exe.bat" "80⤵PID:4416
-
C:\windows\DFGZ.exeC:\windows\DFGZ.exe81⤵
- Checks computer location settings
- Executes dropped EXE
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BYR.exe.bat" "82⤵PID:1836
-
C:\windows\BYR.exeC:\windows\BYR.exe83⤵
- Executes dropped EXE
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WLOZL.exe.bat" "84⤵PID:3188
-
C:\windows\system\WLOZL.exeC:\windows\system\WLOZL.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NMQEOR.exe.bat" "86⤵PID:4744
-
C:\windows\NMQEOR.exeC:\windows\NMQEOR.exe87⤵
- Executes dropped EXE
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CPHI.exe.bat" "88⤵PID:4500
-
C:\windows\SysWOW64\CPHI.exeC:\windows\system32\CPHI.exe89⤵
- Checks computer location settings
- Executes dropped EXE
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GSFDHFM.exe.bat" "90⤵PID:708
-
C:\windows\GSFDHFM.exeC:\windows\GSFDHFM.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WNPHS.exe.bat" "92⤵PID:1292
-
C:\windows\WNPHS.exeC:\windows\WNPHS.exe93⤵
- Executes dropped EXE
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MXSX.exe.bat" "94⤵PID:4332
-
C:\windows\MXSX.exeC:\windows\MXSX.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EGUDE.exe.bat" "96⤵PID:428
-
C:\windows\EGUDE.exeC:\windows\EGUDE.exe97⤵
- Executes dropped EXE
PID:2336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TWH.exe.bat" "98⤵PID:4016
-
C:\windows\SysWOW64\TWH.exeC:\windows\system32\TWH.exe99⤵
- Executes dropped EXE
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QBNRBUD.exe.bat" "100⤵PID:4844
-
C:\windows\QBNRBUD.exeC:\windows\QBNRBUD.exe101⤵
- Checks computer location settings
- Executes dropped EXE
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWRNHK.exe.bat" "102⤵PID:2460
-
C:\windows\system\QWRNHK.exeC:\windows\system\QWRNHK.exe103⤵
- Checks computer location settings
- Executes dropped EXE
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUWH.exe.bat" "104⤵PID:1360
-
C:\windows\SysWOW64\SUWH.exeC:\windows\system32\SUWH.exe105⤵
- Executes dropped EXE
PID:3920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PACED.exe.bat" "106⤵PID:808
-
C:\windows\SysWOW64\PACED.exeC:\windows\system32\PACED.exe107⤵
- Checks computer location settings
- Executes dropped EXE
PID:3768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CCYDI.exe.bat" "108⤵PID:1700
-
C:\windows\system\CCYDI.exeC:\windows\system\CCYDI.exe109⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CVHEWXY.exe.bat" "110⤵PID:3012
-
C:\windows\SysWOW64\CVHEWXY.exeC:\windows\system32\CVHEWXY.exe111⤵
- Checks computer location settings
- Executes dropped EXE
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQGFBAO.exe.bat" "112⤵PID:4016
-
C:\windows\IQGFBAO.exeC:\windows\IQGFBAO.exe113⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MYMNF.exe.bat" "114⤵PID:1992
-
C:\windows\system\MYMNF.exeC:\windows\system\MYMNF.exe115⤵
- Checks computer location settings
- Executes dropped EXE
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OUEPYE.exe.bat" "116⤵PID:3632
-
C:\windows\system\OUEPYE.exeC:\windows\system\OUEPYE.exe117⤵
- Checks computer location settings
- Executes dropped EXE
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUGU.exe.bat" "118⤵PID:384
-
C:\windows\YUGU.exeC:\windows\YUGU.exe119⤵
- Executes dropped EXE
PID:748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCO.exe.bat" "120⤵PID:2920
-
C:\windows\BCO.exeC:\windows\BCO.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VYTAT.exe.bat" "122⤵PID:4568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-