Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19/05/2024, 21:06
Behavioral task
behavioral1
Sample
3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe
-
Size
1.3MB
-
MD5
3999d7909fdbe99cb2508c5f442f8090
-
SHA1
9a025a65b2a961654ded728a3a3e74c53221663e
-
SHA256
a5f372ee74836d2cd2637c1eb475fc47503a61cd03ac75c7ddd3404295b10e9a
-
SHA512
cc76c156fbd2e702f93244a69a8f118fbd8ccf3e153f2094162457529e2ef075e527791128e2b14f5e900d4780e90ba0e841c4eda01e3e707926661999673b4d
-
SSDEEP
24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKensYKkTT7UudBWk2c:GezaTF8FcNkNdfE0pZ9oztFwI6KE
Malware Config
Signatures
-
XMRig Miner payload 32 IoCs
resource yara_rule behavioral1/files/0x000a0000000122ec-2.dat xmrig behavioral1/files/0x0037000000016c7a-6.dat xmrig behavioral1/files/0x0008000000016d2c-10.dat xmrig behavioral1/files/0x0007000000016d3d-16.dat xmrig behavioral1/files/0x0007000000016d45-22.dat xmrig behavioral1/files/0x0007000000016d4e-27.dat xmrig behavioral1/files/0x0008000000016d65-34.dat xmrig behavioral1/files/0x0007000000016d69-36.dat xmrig behavioral1/files/0x00070000000186e6-42.dat xmrig behavioral1/files/0x0037000000016cc3-47.dat xmrig behavioral1/files/0x00050000000186f1-53.dat xmrig behavioral1/files/0x00050000000186ff-57.dat xmrig behavioral1/files/0x0005000000018739-62.dat xmrig behavioral1/files/0x000500000001873f-67.dat xmrig behavioral1/files/0x000500000001878d-77.dat xmrig behavioral1/files/0x0006000000018bf0-82.dat xmrig behavioral1/files/0x000500000001925d-95.dat xmrig behavioral1/files/0x0005000000019275-108.dat xmrig behavioral1/files/0x00050000000193a5-137.dat xmrig behavioral1/files/0x0005000000019457-157.dat xmrig behavioral1/files/0x000500000001943e-152.dat xmrig behavioral1/files/0x0005000000019433-147.dat xmrig behavioral1/files/0x00050000000193b1-142.dat xmrig behavioral1/files/0x000500000001939f-132.dat xmrig behavioral1/files/0x0005000000019381-127.dat xmrig behavioral1/files/0x000500000001933a-122.dat xmrig behavioral1/files/0x0005000000019283-117.dat xmrig behavioral1/files/0x0005000000019277-112.dat xmrig behavioral1/files/0x0005000000019260-102.dat xmrig behavioral1/files/0x000500000001923b-92.dat xmrig behavioral1/files/0x0005000000019228-87.dat xmrig behavioral1/files/0x0005000000018787-72.dat xmrig -
Executes dropped EXE 64 IoCs
pid Process 1952 Gjchisu.exe 1272 WelbRCU.exe 2360 lpbWMRX.exe 2848 nHtBIBv.exe 2272 YrtMckf.exe 2680 YViIATX.exe 2788 ilsylNN.exe 2684 dcrsbKH.exe 2808 sVEnTnF.exe 2276 nRobUlo.exe 2584 YBJaEzn.exe 2544 gYfBozP.exe 2608 JJJCxIB.exe 2996 pShiaxb.exe 1948 cruHrXI.exe 2852 HkxMZgC.exe 2984 oQFeEYz.exe 3004 AkQLkFH.exe 2140 XJKeKGG.exe 1520 zBBMpss.exe 1684 oxUhbXb.exe 1548 tSEmcLJ.exe 1552 yYaoVKE.exe 1108 UOInvCQ.exe 1500 skUYEbe.exe 2772 zYXCAGe.exe 1916 ggtVoLf.exe 1428 HeYNmQR.exe 852 ZHnIkGd.exe 776 KMGFHDZ.exe 1220 pqBXdZZ.exe 2304 nlGbnmU.exe 2780 XaCIHmN.exe 1776 SYtNHrK.exe 2480 UOJfStD.exe 2916 woUGqfa.exe 2244 FBOTcCG.exe 1256 CMYFpoy.exe 1472 uARMMdR.exe 2372 bSNVdyU.exe 2628 hxaYKzq.exe 2488 ITqwrpy.exe 872 RmcegjZ.exe 2348 UUrCPBG.exe 2072 sWLPrUi.exe 2108 EWQhKlu.exe 1664 FBgMVQc.exe 1344 nPcaOIC.exe 1760 KuyDBsL.exe 1584 kpUUOIc.exe 1804 zGqwyRJ.exe 2708 hUnHcKo.exe 892 yufzRLW.exe 956 jscWSbg.exe 2392 VCAcPSK.exe 1020 KHOISDX.exe 1444 WHQefso.exe 2932 tnmCkeT.exe 2436 lmgvFXT.exe 2432 UEKsXvA.exe 1744 JSBUbpZ.exe 1532 oQlGzaD.exe 1788 bHpTgiN.exe 1572 hmCYigz.exe -
Loads dropped DLL 64 IoCs
pid Process 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\System\pqBXdZZ.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\rEPVhrp.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\cgmBTCH.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\spusTBj.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\VARQkdw.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\qaPhsZh.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\oDnnGfO.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\aTHXumo.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\oxUhbXb.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\tSEmcLJ.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\ycjwUjC.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\cclKLZw.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\Gjchisu.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\WHQefso.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\EyffZiN.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\woUGqfa.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\oQlGzaD.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\qcBfgaK.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\AFxFkAJ.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\vQclMrS.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\ogxTCBe.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\HeYNmQR.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\mpmsyVq.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\ojtjaHt.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\cdWeHKt.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\bCHLyIk.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\bVpzqEv.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\uGkyCeD.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\nRobUlo.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\hUnHcKo.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\AMFpIPc.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\sdLxtnQ.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\KzJPlhs.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\EkqgOLj.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\WKImsqt.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\jGGLlDH.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\BYYBsmG.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\iHdFNUC.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\zBBMpss.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\LupYDst.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\jbpjuvH.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\fMLfjbp.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\YBJaEzn.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\vUejbyc.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\HVLDTSq.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\vfdrftG.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\keghLYG.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\oxoEIHi.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\ZHnIkGd.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\zsHcxIo.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\fPpxPcV.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\qJepdgC.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\WFqnzjp.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\cjKJidL.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\rCiTEAF.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\JYbhZsi.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\yLJbuYp.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\YbXXFmY.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\kpUUOIc.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\bHpTgiN.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\lDZUMKv.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\XHmxhKo.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\HkxMZgC.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe File created C:\Windows\System\CMYFpoy.exe 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe Token: SeLockMemoryPrivilege 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3056 wrote to memory of 1952 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 29 PID 3056 wrote to memory of 1952 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 29 PID 3056 wrote to memory of 1952 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 29 PID 3056 wrote to memory of 1272 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 30 PID 3056 wrote to memory of 1272 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 30 PID 3056 wrote to memory of 1272 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 30 PID 3056 wrote to memory of 2360 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 31 PID 3056 wrote to memory of 2360 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 31 PID 3056 wrote to memory of 2360 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 31 PID 3056 wrote to memory of 2848 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 32 PID 3056 wrote to memory of 2848 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 32 PID 3056 wrote to memory of 2848 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 32 PID 3056 wrote to memory of 2272 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 33 PID 3056 wrote to memory of 2272 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 33 PID 3056 wrote to memory of 2272 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 33 PID 3056 wrote to memory of 2680 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 34 PID 3056 wrote to memory of 2680 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 34 PID 3056 wrote to memory of 2680 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 34 PID 3056 wrote to memory of 2788 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 35 PID 3056 wrote to memory of 2788 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 35 PID 3056 wrote to memory of 2788 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 35 PID 3056 wrote to memory of 2684 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 36 PID 3056 wrote to memory of 2684 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 36 PID 3056 wrote to memory of 2684 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 36 PID 3056 wrote to memory of 2808 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 37 PID 3056 wrote to memory of 2808 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 37 PID 3056 wrote to memory of 2808 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 37 PID 3056 wrote to memory of 2276 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 38 PID 3056 wrote to memory of 2276 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 38 PID 3056 wrote to memory of 2276 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 38 PID 3056 wrote to memory of 2584 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 39 PID 3056 wrote to memory of 2584 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 39 PID 3056 wrote to memory of 2584 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 39 PID 3056 wrote to memory of 2544 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 40 PID 3056 wrote to memory of 2544 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 40 PID 3056 wrote to memory of 2544 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 40 PID 3056 wrote to memory of 2608 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 41 PID 3056 wrote to memory of 2608 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 41 PID 3056 wrote to memory of 2608 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 41 PID 3056 wrote to memory of 2996 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 42 PID 3056 wrote to memory of 2996 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 42 PID 3056 wrote to memory of 2996 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 42 PID 3056 wrote to memory of 1948 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 43 PID 3056 wrote to memory of 1948 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 43 PID 3056 wrote to memory of 1948 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 43 PID 3056 wrote to memory of 2852 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 44 PID 3056 wrote to memory of 2852 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 44 PID 3056 wrote to memory of 2852 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 44 PID 3056 wrote to memory of 2984 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 45 PID 3056 wrote to memory of 2984 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 45 PID 3056 wrote to memory of 2984 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 45 PID 3056 wrote to memory of 3004 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 46 PID 3056 wrote to memory of 3004 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 46 PID 3056 wrote to memory of 3004 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 46 PID 3056 wrote to memory of 2140 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 47 PID 3056 wrote to memory of 2140 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 47 PID 3056 wrote to memory of 2140 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 47 PID 3056 wrote to memory of 1520 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 48 PID 3056 wrote to memory of 1520 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 48 PID 3056 wrote to memory of 1520 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 48 PID 3056 wrote to memory of 1684 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 49 PID 3056 wrote to memory of 1684 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 49 PID 3056 wrote to memory of 1684 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 49 PID 3056 wrote to memory of 1548 3056 3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe 50
Processes
-
C:\Users\Admin\AppData\Local\Temp\3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3999d7909fdbe99cb2508c5f442f8090_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\System\Gjchisu.exeC:\Windows\System\Gjchisu.exe2⤵
- Executes dropped EXE
PID:1952
-
-
C:\Windows\System\WelbRCU.exeC:\Windows\System\WelbRCU.exe2⤵
- Executes dropped EXE
PID:1272
-
-
C:\Windows\System\lpbWMRX.exeC:\Windows\System\lpbWMRX.exe2⤵
- Executes dropped EXE
PID:2360
-
-
C:\Windows\System\nHtBIBv.exeC:\Windows\System\nHtBIBv.exe2⤵
- Executes dropped EXE
PID:2848
-
-
C:\Windows\System\YrtMckf.exeC:\Windows\System\YrtMckf.exe2⤵
- Executes dropped EXE
PID:2272
-
-
C:\Windows\System\YViIATX.exeC:\Windows\System\YViIATX.exe2⤵
- Executes dropped EXE
PID:2680
-
-
C:\Windows\System\ilsylNN.exeC:\Windows\System\ilsylNN.exe2⤵
- Executes dropped EXE
PID:2788
-
-
C:\Windows\System\dcrsbKH.exeC:\Windows\System\dcrsbKH.exe2⤵
- Executes dropped EXE
PID:2684
-
-
C:\Windows\System\sVEnTnF.exeC:\Windows\System\sVEnTnF.exe2⤵
- Executes dropped EXE
PID:2808
-
-
C:\Windows\System\nRobUlo.exeC:\Windows\System\nRobUlo.exe2⤵
- Executes dropped EXE
PID:2276
-
-
C:\Windows\System\YBJaEzn.exeC:\Windows\System\YBJaEzn.exe2⤵
- Executes dropped EXE
PID:2584
-
-
C:\Windows\System\gYfBozP.exeC:\Windows\System\gYfBozP.exe2⤵
- Executes dropped EXE
PID:2544
-
-
C:\Windows\System\JJJCxIB.exeC:\Windows\System\JJJCxIB.exe2⤵
- Executes dropped EXE
PID:2608
-
-
C:\Windows\System\pShiaxb.exeC:\Windows\System\pShiaxb.exe2⤵
- Executes dropped EXE
PID:2996
-
-
C:\Windows\System\cruHrXI.exeC:\Windows\System\cruHrXI.exe2⤵
- Executes dropped EXE
PID:1948
-
-
C:\Windows\System\HkxMZgC.exeC:\Windows\System\HkxMZgC.exe2⤵
- Executes dropped EXE
PID:2852
-
-
C:\Windows\System\oQFeEYz.exeC:\Windows\System\oQFeEYz.exe2⤵
- Executes dropped EXE
PID:2984
-
-
C:\Windows\System\AkQLkFH.exeC:\Windows\System\AkQLkFH.exe2⤵
- Executes dropped EXE
PID:3004
-
-
C:\Windows\System\XJKeKGG.exeC:\Windows\System\XJKeKGG.exe2⤵
- Executes dropped EXE
PID:2140
-
-
C:\Windows\System\zBBMpss.exeC:\Windows\System\zBBMpss.exe2⤵
- Executes dropped EXE
PID:1520
-
-
C:\Windows\System\oxUhbXb.exeC:\Windows\System\oxUhbXb.exe2⤵
- Executes dropped EXE
PID:1684
-
-
C:\Windows\System\tSEmcLJ.exeC:\Windows\System\tSEmcLJ.exe2⤵
- Executes dropped EXE
PID:1548
-
-
C:\Windows\System\yYaoVKE.exeC:\Windows\System\yYaoVKE.exe2⤵
- Executes dropped EXE
PID:1552
-
-
C:\Windows\System\UOInvCQ.exeC:\Windows\System\UOInvCQ.exe2⤵
- Executes dropped EXE
PID:1108
-
-
C:\Windows\System\skUYEbe.exeC:\Windows\System\skUYEbe.exe2⤵
- Executes dropped EXE
PID:1500
-
-
C:\Windows\System\zYXCAGe.exeC:\Windows\System\zYXCAGe.exe2⤵
- Executes dropped EXE
PID:2772
-
-
C:\Windows\System\ggtVoLf.exeC:\Windows\System\ggtVoLf.exe2⤵
- Executes dropped EXE
PID:1916
-
-
C:\Windows\System\HeYNmQR.exeC:\Windows\System\HeYNmQR.exe2⤵
- Executes dropped EXE
PID:1428
-
-
C:\Windows\System\ZHnIkGd.exeC:\Windows\System\ZHnIkGd.exe2⤵
- Executes dropped EXE
PID:852
-
-
C:\Windows\System\KMGFHDZ.exeC:\Windows\System\KMGFHDZ.exe2⤵
- Executes dropped EXE
PID:776
-
-
C:\Windows\System\pqBXdZZ.exeC:\Windows\System\pqBXdZZ.exe2⤵
- Executes dropped EXE
PID:1220
-
-
C:\Windows\System\nlGbnmU.exeC:\Windows\System\nlGbnmU.exe2⤵
- Executes dropped EXE
PID:2304
-
-
C:\Windows\System\XaCIHmN.exeC:\Windows\System\XaCIHmN.exe2⤵
- Executes dropped EXE
PID:2780
-
-
C:\Windows\System\SYtNHrK.exeC:\Windows\System\SYtNHrK.exe2⤵
- Executes dropped EXE
PID:1776
-
-
C:\Windows\System\UOJfStD.exeC:\Windows\System\UOJfStD.exe2⤵
- Executes dropped EXE
PID:2480
-
-
C:\Windows\System\woUGqfa.exeC:\Windows\System\woUGqfa.exe2⤵
- Executes dropped EXE
PID:2916
-
-
C:\Windows\System\FBOTcCG.exeC:\Windows\System\FBOTcCG.exe2⤵
- Executes dropped EXE
PID:2244
-
-
C:\Windows\System\CMYFpoy.exeC:\Windows\System\CMYFpoy.exe2⤵
- Executes dropped EXE
PID:1256
-
-
C:\Windows\System\uARMMdR.exeC:\Windows\System\uARMMdR.exe2⤵
- Executes dropped EXE
PID:1472
-
-
C:\Windows\System\bSNVdyU.exeC:\Windows\System\bSNVdyU.exe2⤵
- Executes dropped EXE
PID:2372
-
-
C:\Windows\System\hxaYKzq.exeC:\Windows\System\hxaYKzq.exe2⤵
- Executes dropped EXE
PID:2628
-
-
C:\Windows\System\ITqwrpy.exeC:\Windows\System\ITqwrpy.exe2⤵
- Executes dropped EXE
PID:2488
-
-
C:\Windows\System\RmcegjZ.exeC:\Windows\System\RmcegjZ.exe2⤵
- Executes dropped EXE
PID:872
-
-
C:\Windows\System\UUrCPBG.exeC:\Windows\System\UUrCPBG.exe2⤵
- Executes dropped EXE
PID:2348
-
-
C:\Windows\System\sWLPrUi.exeC:\Windows\System\sWLPrUi.exe2⤵
- Executes dropped EXE
PID:2072
-
-
C:\Windows\System\EWQhKlu.exeC:\Windows\System\EWQhKlu.exe2⤵
- Executes dropped EXE
PID:2108
-
-
C:\Windows\System\FBgMVQc.exeC:\Windows\System\FBgMVQc.exe2⤵
- Executes dropped EXE
PID:1664
-
-
C:\Windows\System\nPcaOIC.exeC:\Windows\System\nPcaOIC.exe2⤵
- Executes dropped EXE
PID:1344
-
-
C:\Windows\System\KuyDBsL.exeC:\Windows\System\KuyDBsL.exe2⤵
- Executes dropped EXE
PID:1760
-
-
C:\Windows\System\kpUUOIc.exeC:\Windows\System\kpUUOIc.exe2⤵
- Executes dropped EXE
PID:1584
-
-
C:\Windows\System\zGqwyRJ.exeC:\Windows\System\zGqwyRJ.exe2⤵
- Executes dropped EXE
PID:1804
-
-
C:\Windows\System\hUnHcKo.exeC:\Windows\System\hUnHcKo.exe2⤵
- Executes dropped EXE
PID:2708
-
-
C:\Windows\System\yufzRLW.exeC:\Windows\System\yufzRLW.exe2⤵
- Executes dropped EXE
PID:892
-
-
C:\Windows\System\jscWSbg.exeC:\Windows\System\jscWSbg.exe2⤵
- Executes dropped EXE
PID:956
-
-
C:\Windows\System\VCAcPSK.exeC:\Windows\System\VCAcPSK.exe2⤵
- Executes dropped EXE
PID:2392
-
-
C:\Windows\System\KHOISDX.exeC:\Windows\System\KHOISDX.exe2⤵
- Executes dropped EXE
PID:1020
-
-
C:\Windows\System\WHQefso.exeC:\Windows\System\WHQefso.exe2⤵
- Executes dropped EXE
PID:1444
-
-
C:\Windows\System\tnmCkeT.exeC:\Windows\System\tnmCkeT.exe2⤵
- Executes dropped EXE
PID:2932
-
-
C:\Windows\System\lmgvFXT.exeC:\Windows\System\lmgvFXT.exe2⤵
- Executes dropped EXE
PID:2436
-
-
C:\Windows\System\UEKsXvA.exeC:\Windows\System\UEKsXvA.exe2⤵
- Executes dropped EXE
PID:2432
-
-
C:\Windows\System\JSBUbpZ.exeC:\Windows\System\JSBUbpZ.exe2⤵
- Executes dropped EXE
PID:1744
-
-
C:\Windows\System\oQlGzaD.exeC:\Windows\System\oQlGzaD.exe2⤵
- Executes dropped EXE
PID:1532
-
-
C:\Windows\System\bHpTgiN.exeC:\Windows\System\bHpTgiN.exe2⤵
- Executes dropped EXE
PID:1788
-
-
C:\Windows\System\hmCYigz.exeC:\Windows\System\hmCYigz.exe2⤵
- Executes dropped EXE
PID:1572
-
-
C:\Windows\System\mpmsyVq.exeC:\Windows\System\mpmsyVq.exe2⤵PID:1836
-
-
C:\Windows\System\UddKOxq.exeC:\Windows\System\UddKOxq.exe2⤵PID:2452
-
-
C:\Windows\System\JdtYmWV.exeC:\Windows\System\JdtYmWV.exe2⤵PID:2888
-
-
C:\Windows\System\SqMgCTu.exeC:\Windows\System\SqMgCTu.exe2⤵PID:2040
-
-
C:\Windows\System\OBLBCNl.exeC:\Windows\System\OBLBCNl.exe2⤵PID:2624
-
-
C:\Windows\System\WyPggcG.exeC:\Windows\System\WyPggcG.exe2⤵PID:2672
-
-
C:\Windows\System\qZOSobl.exeC:\Windows\System\qZOSobl.exe2⤵PID:2724
-
-
C:\Windows\System\AFxFkAJ.exeC:\Windows\System\AFxFkAJ.exe2⤵PID:2796
-
-
C:\Windows\System\lqhwjzW.exeC:\Windows\System\lqhwjzW.exe2⤵PID:2124
-
-
C:\Windows\System\EkqgOLj.exeC:\Windows\System\EkqgOLj.exe2⤵PID:2552
-
-
C:\Windows\System\SADJozf.exeC:\Windows\System\SADJozf.exe2⤵PID:2748
-
-
C:\Windows\System\IrbdDoJ.exeC:\Windows\System\IrbdDoJ.exe2⤵PID:2540
-
-
C:\Windows\System\MduRECN.exeC:\Windows\System\MduRECN.exe2⤵PID:2580
-
-
C:\Windows\System\eHVzmwv.exeC:\Windows\System\eHVzmwv.exe2⤵PID:2236
-
-
C:\Windows\System\CpFisyz.exeC:\Windows\System\CpFisyz.exe2⤵PID:2976
-
-
C:\Windows\System\aKItHuQ.exeC:\Windows\System\aKItHuQ.exe2⤵PID:2972
-
-
C:\Windows\System\LupYDst.exeC:\Windows\System\LupYDst.exe2⤵PID:1496
-
-
C:\Windows\System\kjLfxGg.exeC:\Windows\System\kjLfxGg.exe2⤵PID:1504
-
-
C:\Windows\System\ojtjaHt.exeC:\Windows\System\ojtjaHt.exe2⤵PID:1600
-
-
C:\Windows\System\ugwrUsX.exeC:\Windows\System\ugwrUsX.exe2⤵PID:2632
-
-
C:\Windows\System\IhoDQhg.exeC:\Windows\System\IhoDQhg.exe2⤵PID:536
-
-
C:\Windows\System\FceuUXG.exeC:\Windows\System\FceuUXG.exe2⤵PID:824
-
-
C:\Windows\System\yqTzUdr.exeC:\Windows\System\yqTzUdr.exe2⤵PID:684
-
-
C:\Windows\System\WKImsqt.exeC:\Windows\System\WKImsqt.exe2⤵PID:2092
-
-
C:\Windows\System\MgENIjr.exeC:\Windows\System\MgENIjr.exe2⤵PID:468
-
-
C:\Windows\System\YndaCTM.exeC:\Windows\System\YndaCTM.exe2⤵PID:2056
-
-
C:\Windows\System\ZYVLJNq.exeC:\Windows\System\ZYVLJNq.exe2⤵PID:2560
-
-
C:\Windows\System\XLOReiW.exeC:\Windows\System\XLOReiW.exe2⤵PID:1312
-
-
C:\Windows\System\rFarvGH.exeC:\Windows\System\rFarvGH.exe2⤵PID:920
-
-
C:\Windows\System\KWgpLCQ.exeC:\Windows\System\KWgpLCQ.exe2⤵PID:2472
-
-
C:\Windows\System\qJepdgC.exeC:\Windows\System\qJepdgC.exe2⤵PID:1104
-
-
C:\Windows\System\spusTBj.exeC:\Windows\System\spusTBj.exe2⤵PID:448
-
-
C:\Windows\System\jbpjuvH.exeC:\Windows\System\jbpjuvH.exe2⤵PID:1704
-
-
C:\Windows\System\zsHcxIo.exeC:\Windows\System\zsHcxIo.exe2⤵PID:1964
-
-
C:\Windows\System\AeKxtgJ.exeC:\Windows\System\AeKxtgJ.exe2⤵PID:1512
-
-
C:\Windows\System\lDZUMKv.exeC:\Windows\System\lDZUMKv.exe2⤵PID:2344
-
-
C:\Windows\System\ZdRLyDO.exeC:\Windows\System\ZdRLyDO.exe2⤵PID:1340
-
-
C:\Windows\System\LRONSNX.exeC:\Windows\System\LRONSNX.exe2⤵PID:1820
-
-
C:\Windows\System\bCOOtSt.exeC:\Windows\System\bCOOtSt.exe2⤵PID:604
-
-
C:\Windows\System\qcBfgaK.exeC:\Windows\System\qcBfgaK.exe2⤵PID:1644
-
-
C:\Windows\System\vUejbyc.exeC:\Windows\System\vUejbyc.exe2⤵PID:2424
-
-
C:\Windows\System\vQclMrS.exeC:\Windows\System\vQclMrS.exe2⤵PID:316
-
-
C:\Windows\System\oUiATWm.exeC:\Windows\System\oUiATWm.exe2⤵PID:2948
-
-
C:\Windows\System\VdOQAEc.exeC:\Windows\System\VdOQAEc.exe2⤵PID:1592
-
-
C:\Windows\System\rCiTEAF.exeC:\Windows\System\rCiTEAF.exe2⤵PID:1944
-
-
C:\Windows\System\ycjwUjC.exeC:\Windows\System\ycjwUjC.exe2⤵PID:2380
-
-
C:\Windows\System\eHpnzpC.exeC:\Windows\System\eHpnzpC.exe2⤵PID:1544
-
-
C:\Windows\System\oUPOnGp.exeC:\Windows\System\oUPOnGp.exe2⤵PID:1276
-
-
C:\Windows\System\ooOCwxj.exeC:\Windows\System\ooOCwxj.exe2⤵PID:2176
-
-
C:\Windows\System\AMFpIPc.exeC:\Windows\System\AMFpIPc.exe2⤵PID:2148
-
-
C:\Windows\System\Mcvuuwk.exeC:\Windows\System\Mcvuuwk.exe2⤵PID:2732
-
-
C:\Windows\System\HVLDTSq.exeC:\Windows\System\HVLDTSq.exe2⤵PID:2816
-
-
C:\Windows\System\VQTAdZE.exeC:\Windows\System\VQTAdZE.exe2⤵PID:2532
-
-
C:\Windows\System\SaYtqwr.exeC:\Windows\System\SaYtqwr.exe2⤵PID:2768
-
-
C:\Windows\System\JWjuwfl.exeC:\Windows\System\JWjuwfl.exe2⤵PID:3016
-
-
C:\Windows\System\EUoQgln.exeC:\Windows\System\EUoQgln.exe2⤵PID:2968
-
-
C:\Windows\System\rEPVhrp.exeC:\Windows\System\rEPVhrp.exe2⤵PID:2260
-
-
C:\Windows\System\kkQVpDq.exeC:\Windows\System\kkQVpDq.exe2⤵PID:1440
-
-
C:\Windows\System\VARQkdw.exeC:\Windows\System\VARQkdw.exe2⤵PID:1976
-
-
C:\Windows\System\ArQpwzK.exeC:\Windows\System\ArQpwzK.exe2⤵PID:2764
-
-
C:\Windows\System\uxeNLjK.exeC:\Windows\System\uxeNLjK.exe2⤵PID:1260
-
-
C:\Windows\System\JYbhZsi.exeC:\Windows\System\JYbhZsi.exe2⤵PID:1752
-
-
C:\Windows\System\qaPhsZh.exeC:\Windows\System\qaPhsZh.exe2⤵PID:3012
-
-
C:\Windows\System\sdLxtnQ.exeC:\Windows\System\sdLxtnQ.exe2⤵PID:1808
-
-
C:\Windows\System\lxKUZXW.exeC:\Windows\System\lxKUZXW.exe2⤵PID:1604
-
-
C:\Windows\System\JZuDNor.exeC:\Windows\System\JZuDNor.exe2⤵PID:1844
-
-
C:\Windows\System\ZOIvCqi.exeC:\Windows\System\ZOIvCqi.exe2⤵PID:1728
-
-
C:\Windows\System\WFqnzjp.exeC:\Windows\System\WFqnzjp.exe2⤵PID:2388
-
-
C:\Windows\System\cjKJidL.exeC:\Windows\System\cjKJidL.exe2⤵PID:2444
-
-
C:\Windows\System\BPDEtly.exeC:\Windows\System\BPDEtly.exe2⤵PID:752
-
-
C:\Windows\System\cdWeHKt.exeC:\Windows\System\cdWeHKt.exe2⤵PID:304
-
-
C:\Windows\System\fngcoeG.exeC:\Windows\System\fngcoeG.exe2⤵PID:2408
-
-
C:\Windows\System\fPpxPcV.exeC:\Windows\System\fPpxPcV.exe2⤵PID:2044
-
-
C:\Windows\System\KzJPlhs.exeC:\Windows\System\KzJPlhs.exe2⤵PID:2776
-
-
C:\Windows\System\ogxTCBe.exeC:\Windows\System\ogxTCBe.exe2⤵PID:2136
-
-
C:\Windows\System\mlhAOSo.exeC:\Windows\System\mlhAOSo.exe2⤵PID:1648
-
-
C:\Windows\System\HZnphLf.exeC:\Windows\System\HZnphLf.exe2⤵PID:1940
-
-
C:\Windows\System\ALnPhwM.exeC:\Windows\System\ALnPhwM.exe2⤵PID:1696
-
-
C:\Windows\System\CLPxNDs.exeC:\Windows\System\CLPxNDs.exe2⤵PID:2168
-
-
C:\Windows\System\dxJRewA.exeC:\Windows\System\dxJRewA.exe2⤵PID:812
-
-
C:\Windows\System\EsjDxiA.exeC:\Windows\System\EsjDxiA.exe2⤵PID:2740
-
-
C:\Windows\System\caSWTPc.exeC:\Windows\System\caSWTPc.exe2⤵PID:2704
-
-
C:\Windows\System\pVcKPXa.exeC:\Windows\System\pVcKPXa.exe2⤵PID:292
-
-
C:\Windows\System\bVpzqEv.exeC:\Windows\System\bVpzqEv.exe2⤵PID:2284
-
-
C:\Windows\System\UmMnWmH.exeC:\Windows\System\UmMnWmH.exe2⤵PID:2104
-
-
C:\Windows\System\LiQJEdU.exeC:\Windows\System\LiQJEdU.exe2⤵PID:3020
-
-
C:\Windows\System\vfdrftG.exeC:\Windows\System\vfdrftG.exe2⤵PID:2416
-
-
C:\Windows\System\cclKLZw.exeC:\Windows\System\cclKLZw.exe2⤵PID:1628
-
-
C:\Windows\System\mnWqPts.exeC:\Windows\System\mnWqPts.exe2⤵PID:760
-
-
C:\Windows\System\xrbAWnJ.exeC:\Windows\System\xrbAWnJ.exe2⤵PID:1240
-
-
C:\Windows\System\fMLfjbp.exeC:\Windows\System\fMLfjbp.exe2⤵PID:1248
-
-
C:\Windows\System\MfsIRkQ.exeC:\Windows\System\MfsIRkQ.exe2⤵PID:2928
-
-
C:\Windows\System\VZFuXqI.exeC:\Windows\System\VZFuXqI.exe2⤵PID:1812
-
-
C:\Windows\System\sMdSznc.exeC:\Windows\System\sMdSznc.exe2⤵PID:2020
-
-
C:\Windows\System\ozVnVcN.exeC:\Windows\System\ozVnVcN.exe2⤵PID:1028
-
-
C:\Windows\System\RKUAVgZ.exeC:\Windows\System\RKUAVgZ.exe2⤵PID:2428
-
-
C:\Windows\System\UTDDCqK.exeC:\Windows\System\UTDDCqK.exe2⤵PID:1032
-
-
C:\Windows\System\YMOKwBI.exeC:\Windows\System\YMOKwBI.exe2⤵PID:1900
-
-
C:\Windows\System\cUHuiKd.exeC:\Windows\System\cUHuiKd.exe2⤵PID:2256
-
-
C:\Windows\System\EyffZiN.exeC:\Windows\System\EyffZiN.exe2⤵PID:1412
-
-
C:\Windows\System\lSAiFbo.exeC:\Windows\System\lSAiFbo.exe2⤵PID:584
-
-
C:\Windows\System\BtruukK.exeC:\Windows\System\BtruukK.exe2⤵PID:2120
-
-
C:\Windows\System\yLJbuYp.exeC:\Windows\System\yLJbuYp.exe2⤵PID:1692
-
-
C:\Windows\System\BLeEcBp.exeC:\Windows\System\BLeEcBp.exe2⤵PID:2712
-
-
C:\Windows\System\KjdCJiT.exeC:\Windows\System\KjdCJiT.exe2⤵PID:2676
-
-
C:\Windows\System\bCHLyIk.exeC:\Windows\System\bCHLyIk.exe2⤵PID:2440
-
-
C:\Windows\System\keghLYG.exeC:\Windows\System\keghLYG.exe2⤵PID:3032
-
-
C:\Windows\System\sccllhL.exeC:\Windows\System\sccllhL.exe2⤵PID:2920
-
-
C:\Windows\System\VzVMJja.exeC:\Windows\System\VzVMJja.exe2⤵PID:1316
-
-
C:\Windows\System\xmxuOtf.exeC:\Windows\System\xmxuOtf.exe2⤵PID:1012
-
-
C:\Windows\System\IEwiIqU.exeC:\Windows\System\IEwiIqU.exe2⤵PID:2112
-
-
C:\Windows\System\NiApZIK.exeC:\Windows\System\NiApZIK.exe2⤵PID:692
-
-
C:\Windows\System\YdyIOvY.exeC:\Windows\System\YdyIOvY.exe2⤵PID:2076
-
-
C:\Windows\System\cgmBTCH.exeC:\Windows\System\cgmBTCH.exe2⤵PID:800
-
-
C:\Windows\System\VLwWNax.exeC:\Windows\System\VLwWNax.exe2⤵PID:1612
-
-
C:\Windows\System\jGGLlDH.exeC:\Windows\System\jGGLlDH.exe2⤵PID:1860
-
-
C:\Windows\System\aTHXumo.exeC:\Windows\System\aTHXumo.exe2⤵PID:1660
-
-
C:\Windows\System\XHmxhKo.exeC:\Windows\System\XHmxhKo.exe2⤵PID:1996
-
-
C:\Windows\System\jlhQZZp.exeC:\Windows\System\jlhQZZp.exe2⤵PID:2924
-
-
C:\Windows\System\GCzKIaS.exeC:\Windows\System\GCzKIaS.exe2⤵PID:1968
-
-
C:\Windows\System\mslsisb.exeC:\Windows\System\mslsisb.exe2⤵PID:2940
-
-
C:\Windows\System\HbKGQbY.exeC:\Windows\System\HbKGQbY.exe2⤵PID:2464
-
-
C:\Windows\System\YbXXFmY.exeC:\Windows\System\YbXXFmY.exe2⤵PID:3084
-
-
C:\Windows\System\SIdHZEY.exeC:\Windows\System\SIdHZEY.exe2⤵PID:3100
-
-
C:\Windows\System\oxoEIHi.exeC:\Windows\System\oxoEIHi.exe2⤵PID:3116
-
-
C:\Windows\System\oDnnGfO.exeC:\Windows\System\oDnnGfO.exe2⤵PID:3132
-
-
C:\Windows\System\LcYzIKq.exeC:\Windows\System\LcYzIKq.exe2⤵PID:3148
-
-
C:\Windows\System\jxAEmtz.exeC:\Windows\System\jxAEmtz.exe2⤵PID:3164
-
-
C:\Windows\System\FFhckmf.exeC:\Windows\System\FFhckmf.exe2⤵PID:3180
-
-
C:\Windows\System\uGkyCeD.exeC:\Windows\System\uGkyCeD.exe2⤵PID:3196
-
-
C:\Windows\System\BYYBsmG.exeC:\Windows\System\BYYBsmG.exe2⤵PID:3212
-
-
C:\Windows\System\EKqWsjl.exeC:\Windows\System\EKqWsjl.exe2⤵PID:3228
-
-
C:\Windows\System\ajSqQdH.exeC:\Windows\System\ajSqQdH.exe2⤵PID:3244
-
-
C:\Windows\System\iHdFNUC.exeC:\Windows\System\iHdFNUC.exe2⤵PID:3260
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD57be627e4902b9a1a0cbc9b2a0029ff9c
SHA17425a015b60077c4024b331968a5c48a85a4d7dc
SHA2565ab2a92da81225cfee70b333dab9508bcaa0745e4653d187d25a882b5ecec710
SHA5123a352ac7b481cd40cbcbd9ee4ef6a9b72cc93222a38700e5339dabba6717853d2f05f38a8ba2889005f1bb176498062e0fd84bf9f69443c045e3ac6a07263c73
-
Filesize
1.3MB
MD517079507f021a29900add7f025ec4046
SHA1fdfe001f02a761e48ea79ea0085e6a67f50a947a
SHA2560dd559773c6488eea07f4e273686a026d62ac03d347313484ae845fac689bac5
SHA512ec5d051a8f0f7154037f18b5ac5e72f2919efe1b73bf85f51a8d21fb13459bc7e40f6b0d681aa3c6b794850ae4ca54fc5557ca779b33a3ab7db49a8c5a275d6e
-
Filesize
1.3MB
MD58c82e372884ae8cea09db0b9aa74f9ee
SHA16bca45a5d5b4ffe453e185660f86986ceda521f5
SHA2565f8c0926dbffee09a4ce5826f90aea6646f189a738db580aa6aebedd69069ce6
SHA51275d72219855a44b554fe531aea983331c4b584c8b184031e010ddda1356c8bf1ca8e47ff6aa027c0376e32bb955cba860ee25f16bbfc3743884c8bd40041435a
-
Filesize
1.3MB
MD564da9563d016f6ddad006371ea6ac696
SHA1c0505298589767def50623c71477d55a78c65427
SHA2567147412f65ee2655a4e780fac5edf0bb8549c523f00b62fe92710ea3f54eaa04
SHA51265f93e683b2b6f655e7fc9a6e4315b0bccf647b781f957129c4bc959e7af27c1c4ec5b0794dfb73179ba663362856ace96ef47ce1721116fe43f221682fc5226
-
Filesize
1.3MB
MD5e5cc18e216fed96c55d1dd9112f39094
SHA1726585cfd171f379ffc717340235fdf2c7342a42
SHA256bb5e7b275f0bea8bfaab0d76182e42199e715379f7abed1d71f8ff34bd194e3b
SHA51266c5f0d6d4580a44294435230d4c7b58c9e33fa2f3784df4c1fdb5df6f585ce11123d21c81a98da531754d9318f3b8afdf43ffe371ff8d000212feac92e023d7
-
Filesize
1.3MB
MD538c4a170b59f2f6a6d1f1288d21dd6db
SHA17515bbd63d7df699b16eace0509c66a37cb95644
SHA256a5de2fc2f061febc08a55584775de2b41dc3e1cb55f7ccd05db9c906fd1f0941
SHA512b098093962a5e198f5459a13066b75f781c5284e694f15a452d71222a2b9e49f5486026fad6a200f603134f380984cb072df2c289ab8d80ac2a444a3eaa0cc21
-
Filesize
1.3MB
MD528cd710a50d3b21e3b4c77d4affbc097
SHA137b9e9ceb1c1354623b2d74e18c44c4c2b6008a0
SHA256d59b6837b00acda5f2702d6892d89af0d73a8fc797786e397ff3d37263075d53
SHA5125432384bdc45299d4d25b7cf5772cae9f4a549a1933658c9e9ff1a9a312a2846bd400681151015868d5a6835ba454505aacf692bb13fb57433dd73876d66cf09
-
Filesize
1.3MB
MD5aaf21d07e00df3e402cc28d7be56e7fe
SHA1bba704f8ffab338c952b133bd311ebcb8a4f2fa3
SHA2561c72d5568f586192285f6c149d12f9e0f1cec06b9d0baace5b3ad548eae65036
SHA512a259a373d675b1356bca8cb355c6f512e430c65579ed9b5216dd2c8387cd85ab9023afe507faeafbcc24c7147711abcca5f4a980955ad7c7e072887949c2ce8d
-
Filesize
1.3MB
MD5bd5d8a0fef5a42601a0ed1624a94eb18
SHA18b6e9633d7b2330050539f76b3fef066390e768d
SHA2566cc35bad8f24a4a9aece0b01ec24eb385c54c2394a7467bb5a9a32cdc0b6535f
SHA512a8a91452090b1526eef910203143a257677bf61c1ea55330716cfa06a14ac4c84edde56d97948960ff1ee14e4b63c6132316be4c54ede13beef6ab5e27f62bd1
-
Filesize
1.3MB
MD52cf36851689787deb0194603ac92c3d7
SHA1edb0c3122adcc92a6a4d2feb3f56809434bfd1c8
SHA256bca52506c9df445b7eb11fb6c1451643a9a6df85ee2140b55f15be02597bb228
SHA5121e3498a0a055a44905119edb745f531373f5671d3b56b2f39f9871de3f45cc2016d567879cb95499747df06224f66f575148d232507afa5bdfa50550c0c14768
-
Filesize
1.3MB
MD514dd22e301b179f8382911c16da5eb7d
SHA1dd20aaced92506e07ba262753c1e77dee2546455
SHA2560a26dc078ed328b746c21cd5eb4b77c6521b1fbc809fa1b7eeae9c2fdfc8fa13
SHA51290684c30f9968ccaf6812fdbc72e268f646dca0a8dc080ce407c54d466de1df3d3b6096654df30836bdca59563233287313e720c03f32ea439631dfa8ca1b11f
-
Filesize
1.3MB
MD50ac5a814518b36c4bbfd5c007f14ce2b
SHA1fc2e2e02ae770fdb805405e03a34d8f30b6095c5
SHA256a640958a3f56d355ce97b51d2eb1243485da1bd8fc4bbf05ce899d67f58f6a0b
SHA5120d82bf27aa93487e02c62dc193f1e3524ce9faf534a846b8ee399388171fa383eab82fccd4d5661e0ae4f2969438e7fc78e4e5066347e28831130ae5dbec2192
-
Filesize
1.3MB
MD530dc5d4deea1699d27320f926a64406a
SHA165ece9b84eeed997856f524483657534728f30f3
SHA256628e48ef5ad2c8649f928f92287310bd802120ab9cc49b1b30be33c23f74ee36
SHA5127d380e4b33fe1a5a47641206ac3b3fba180f54ad22427dc7220528550fb797f9ac22cb158745987c8436e0e48a78f760f3bda58cef4ae8d6b64e6ac95ddfa500
-
Filesize
1.3MB
MD54a5a6a555dcd6d95b5fd28b270c07471
SHA13424926b59906e0cbb337cdeda67bce2225f656d
SHA2564f813b6a6d286e2495a7d47ca85b6e06d6247d55b0b9aa6d6c0b54f9f5ad3574
SHA512ad55de4fe5a3495adc82be891ea0bf2237d647ae1e8fa1355b1e26de3966891a21921dc1a28ae7f6dd050d9c96fac80eddbe91cda82554b99faf2e2999ab214c
-
Filesize
1.3MB
MD5d7692716da46ba1b4ac3d7b328db53c6
SHA174cc84d2c74d2b03e6b04859a661162de155f187
SHA256446b15b8ccd819933b4c97c312035f05dd46ded052dcf583b79e13327763eeff
SHA512c0826207f894a100071162d005a08b5127abb4bf1ceb7eace68c6a638c1ac0c02b99b099ec8c26f38b3ac672bf20a5f76291f98e5aafb9d7921e83c20384d26d
-
Filesize
1.3MB
MD5e55f364e8eb87d02f96dd70e7d47831f
SHA1c938488fbd11235cbd9233d1d38ef0b9fac06796
SHA2560da10d1e43a7252c62df38436adad00fec1656006182065943671cef3b3ccce4
SHA512113dd466c008c6528fe8807f39bf81c7845a7d431cd9da1cceeaa6f61a3506225eea08aeae08b5e12d9b74a3b3204710a72d39d675a74154bcd3753fdb502456
-
Filesize
1.3MB
MD5b04090f331705c7ac59fb1b4332d7859
SHA134d9020b978a679d4f5ba41697e47a6d8d90a706
SHA256fabdffcb98ba7b87bf72364f9566306fc26fb8f674365257fff8a6690402fd5b
SHA512d9a365b9da3b5158395418a997f684a78bf5b061e64334903efbb128af1e7dedfba9aa0c97a8341cea0eda65f2a33e215ba94a40daabbee7d3aa2c5d4033621b
-
Filesize
1.3MB
MD5974045e1dcfd551543e39969b64b797a
SHA14c8beb03cc7288a712b8d2c9e5943c0d7f7cf4de
SHA25629e84d10f4c1dc27319a8181b6b4babe1401ca4226390337b47fba01d3b7b02d
SHA5127c900d5857d79b41f5410508d8fb7c8bd14699ec22992b8915b3d1da43e19ce4fcfb2a2b9aea294109cae267f7f79b0782ddc99b07bfa72a9499a300f666ad7b
-
Filesize
1.3MB
MD5a395c050cb322bfcf9c0bf6ad14b5556
SHA165ed9c08b91977531ad6b1adb2384960dc65ffdb
SHA25619a3a1d517f3f07df750bdd34c25e6f9ee7fc7891dc6889d9c8b2b8dcabe3f10
SHA51288c789cfbbab33c882a9d5c10d86432e9000cff5581dcc66de202ab55268319c2f5b4fa967aabee8bfdd42296f85a75d7ca3cdceadec455ee4ddc17f945c1ee8
-
Filesize
1.3MB
MD5b8b3ca34d6b55cbd825f6a6e661029d9
SHA179a7b2e0be8e5df935103a071e0678ffe41fa08c
SHA2567d5f48ea5a205deda41bf3a1f95ec318584f98c0271435eaf83f126fc70346e3
SHA512ee3507f5334f4d453dc2197b3b37406827bf40e89145fe7caf5b70acd8436798b01813bc745779739622bb174fbf3845f9725cb6a5cbbb0fb72da0777996a172
-
Filesize
1.3MB
MD541dbcf62e5ae7bba5cbfa31eb499e841
SHA127b13d6bb1c7f351b7593662afa286ff8eefbebf
SHA2563d33e5cf18f6a7832032cd6bcf47dfdadb1461ce6438998585c38944953fee32
SHA51209de3fac08dca22e8dd749c121554b6593e1c78e76b4421dbf6b2f8746557692c78ad462f8e30e1d8c4ccdea2437c7d52a520c4839d72a1d694ba7a42716abdd
-
Filesize
1.3MB
MD52b515ab7ca734fb1e84aba7119e659f7
SHA1986d80a413c37bb0e3882c095baa07a97e50082d
SHA256ba874060b92c53197bcf67c6bd46c5971cfc38f8f8addeb0d604e1a46dbc2ec0
SHA512e14c576bd7b5f4c459fb1bf5135af6038033e4556c1857958dcde8bdaa96d3c17073106d2aed8187c892e485e5b1256b5a7345e67ebebd4b9290bff288cfc055
-
Filesize
1.3MB
MD53f659808d9d437384ad5e754910953ca
SHA1980f6ab7b9a50bf59560249e7f13b0a5ee8f7af7
SHA2563fb876798d3272446a1461e8f6e5e20c0cfdbe1d0ce9a0273e5ba394ff851663
SHA512b4a635aeaf8c4d51fa4a7f88bf1f014dbaddbe77f2f505fdcd07ad98716813aedbc6c49f0e6e2cf4a28ee64134cbcac97f7b4ceb30d11ce1e8016d90540bf072
-
Filesize
1.3MB
MD52a14fc42d8dabfc272d11032658e0afa
SHA170d03ce8444ab380f0c10af9a0f27f9e5e97f7ee
SHA256963023cd14eab70c22e5fbf5812d939247a2420a7a6e6c4a18b007436fd98461
SHA5127e550aaad2af0bb71830b804938af82b64f392c8290ae541581eded5aa6235ff4c1e9bd4733fac965e9e2117f0ee63f0b9883bdbc8bd1e8f8e267db7ec58ab50
-
Filesize
1.3MB
MD53b91ac801d5784d31ae2b1b6b52bcaf1
SHA1276a811f2352cc2094cc46a05c4eebe6cfd8a4f9
SHA256e4b5a42af1ed6e8eb7846535533ac4a4b259481a98ea2b1e05816cd1c243a4be
SHA51295c790461114d1251c9c2b2aea260d3a4925cb00f89905250a567de45508c5f424dc39217a1fb4ffb84110eaeae17bc6ac4f2bf2618dd37f63887cbe8ffa9ec9
-
Filesize
1.3MB
MD5ea8e4c1ad76f836a37dde6c0082d2a34
SHA1310be34d0a3197a34857c68d497986cf0a0febf3
SHA256874342f9a0ff6d66748896e682f5ff409413a6922e3c51a94fd55f55e670c69d
SHA5129da2466e3eb0861a08ef1ea73f1262629b019da51d524ba2aa6494d764c225c14d287adee2b6599bb3190a17143a3a93bb899d1ea296e8a133e230b5fe9eeff3
-
Filesize
1.3MB
MD5b900adcaafc0f968ef8d609df8da5961
SHA1292819b1fb68c21150108651c8e648d689384d18
SHA256df83e1794281bae5c572a62ad926e2dcbe02e514000aa0a7399134c23b3bc9e2
SHA51275a794d6a6fdc866fb208af6e302ac1006d1cf8de26992980327264ff0766d42d9d731dd7e8aef5d8cf42477a7516c8bb7894877c16582c71e2813eb746abe92
-
Filesize
1.3MB
MD5807cce2757013ebab88fc29c83a85cd5
SHA10a01dca84019fce0ea5a037c9d77a2a9b4c70a71
SHA25621bd409ab64cc07205b2d13d55754ea89fe042176753f78af11b0a3d4ce20ec3
SHA512d0095fca6960ed8374197a074e4a28f05348ddf23a8d21512bf7d369023c8b31a2561d4a3691b0185109d555038848b316a555d96505d7aa00b8f9e18739bdd0
-
Filesize
1.3MB
MD55aff11254a335b67708f2bd047760d4d
SHA123286bac43b55b83424fcfdf1f958ed69beefc7a
SHA256b91ae9292fbd3dec07abbc7595e7bb3793d85fffe1d0ba1978f4688729ab3770
SHA5129d4fc466c2f80badfb4e61f9be7f6cc81a604acbcbdffb0d7309ad372e1e9cbd4ba297e7ac8d9a75b45e8937fb5a51a03f404b35420286504af470c0250186cf
-
Filesize
1.3MB
MD5cd38a9c6667fb9bb1ab256123704c857
SHA15344381c24731d7cfc356185544a3c5040d56b67
SHA2564debe86e9ce5d16a1c280599f02693902d067d7546a24c4be0abb7852ccf7b02
SHA512ee809efd801056c91dd66d4dab32672b14a5c4f4d70c0788ff4fcd3a868f36ffce0f8b1e7cddb66e51b00f80d3ac84e1123ce30ee4405f96a312d941d1eb0506
-
Filesize
1.3MB
MD560adc55b0b770d2a8cd1b07052cc4588
SHA19c80f1c44c6849b3884d9724e2243b94c4bd0cc3
SHA2564afe4a51e3aae7f02c84750d848aae720a283011f5ec615411bc6a36b519e11f
SHA5126a57c74cc4a4ea2c0ec3afa0af4b352c38fb8b72a5151c8722f2afad6ab3f5db444d8bffa2972c22a349bd8d47f7218df1b26732dd6972e6548e8901d045c375
-
Filesize
1.3MB
MD52db8cd659eb2056bb332e4c5a07d30d0
SHA16cd67addadf5660977e25b5edc8ee27299d9d75f
SHA2561d5ef647774db97602089d3dc1d9513bfc459859ed79b5e04ac758a250fa8104
SHA5120f6b9874b7a3ba182a890a98e5ee30fdc82a104fb45decb69be81eb126e3de9ef338518ad99a9ccd0ca482f2f9eaff9d9fad0c0446e69ac080a4533f241bd300