Analysis
- user interaction
yes - max time kernel
150s - max time network
152s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
27/07/2026, 20:04
Behavioral task
behavioral1
Sample
FueagoNeuxs.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
FueagoNeuxs.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Windows Portable 64-bit.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
18 signatures
150 seconds
General
- Target FueagoNeuxs.exe
- Size 6.7MB
- Sample260727-ytmlqa1vgw
- SHA256 c49d948fa9a51832f65a144d0eda71de414bfe299a0c5d4d3b262bc34a8694ce
- MD5 83c9cd57e918fdc9b8f9b7181aafd789
- SHA1 0af5c158fdc4b39fd8b37e8281b96346e6bb6458
- SHA512 3df17a5d5c3f76efe8a99ada434f38c05bf6ff6149fb41264da0c587f137dcd8ee0f6c4a672572838f3536ad79d410beab6c2b33a70878e67f0f428fc1c4588b
- SSDEEP 196608:zrou2nZ+8lcEybVV3zymx3BYVoaXzLCk6rkMktY8mRooFk:zrkZ+L3DzN3BYVnzWkd2ooFk
- TLSH T1C566333200B0E563DEA1237AE4C6E49BCD20385D56D01F47E7D92271B7B2B4693EA7E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions Windows Portable 64-bit.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions Windows Portable 64-bit.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions Windows Portable 64-bit.exe - Looks for VMWare Tools registry key 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools Windows Portable 64-bit.exe Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools Windows Portable 64-bit.exe Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools Windows Portable 64-bit.exe - Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Windows Portable 64-bit.exe - Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\Control Panel\International\Geo\Nation FueagoNeuxs.exe Key value queried \REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\Control Panel\International\Geo\Nation FueagoNeuxs.exe Key value queried \REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\Control Panel\International\Geo\Nation FueagoNeuxs.exe Key value queried \REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\Control Panel\International\Geo\Nation FueagoNeuxs.exe Key value queried \REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\Control Panel\International\Geo\Nation FueagoNeuxs.exe Key value queried \REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\Control Panel\International\Geo\Nation FueagoNeuxs.exe Key value queried \REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\Control Panel\International\Geo\Nation FueagoNeuxs.exe - Creates a file in the Startup directory 1 TTPs 3 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Portable 64-bit.lnk Windows Portable 64-bit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Portable 64-bit.lnk Windows Portable 64-bit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Portable 64-bit.lnk Windows Portable 64-bit.exe - Executes dropped EXE 6 IoCs
pid Process 4208 Windows Portable 64-bit.exe 5092 Windows Portable 64-bit.exe 2680 Windows Portable 64-bit.exe 1624 Windows Portable 64-bit.exe 2320 Windows Portable 64-bit.exe 2980 Windows Portable 64-bit.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Portable 64-bit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows Portable 64-bit.exe" Windows Portable 64-bit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Portable 64-bit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows Portable 64-bit.exe" Windows Portable 64-bit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Portable 64-bit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows Portable 64-bit.exe" Windows Portable 64-bit.exe - Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 194 pastebin.com 318 pastebin.com 427 discord.com 623 pastebin.com 27 pastebin.com 203 pastebin.com 666 pastebin.com 691 pastebin.com 63 pastebin.com 266 pastebin.com 333 discord.com 717 pastebin.com 277 pastebin.com 287 discord.com 315 discord.com 399 discord.com 745 pastebin.com 129 pastebin.com 363 pastebin.com 404 pastebin.com 669 pastebin.com 764 pastebin.com 880 pastebin.com 36 pastebin.com 784 pastebin.com 848 discord.com 913 pastebin.com 309 discord.com 807 discord.com 481 pastebin.com 909 discord.com 154 pastebin.com 543 pastebin.com 840 discord.com 433 discord.com 628 pastebin.com 932 discord.com 133 pastebin.com 335 discord.com 439 discord.com 774 pastebin.com 123 discord.com 685 pastebin.com 705 discord.com 239 pastebin.com 263 pastebin.com 505 pastebin.com 601 discord.com 690 discord.com 583 discord.com 28 discord.com 162 discord.com 286 discord.com 418 discord.com 672 pastebin.com 749 pastebin.com 821 discord.com 269 pastebin.com 306 pastebin.com 617 pastebin.com 729 pastebin.com 814 discord.com 884 pastebin.com 362 pastebin.com - Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Windows Portable 64-bit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Windows Portable 64-bit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Windows Portable 64-bit.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4316 cmd.exe 4796 cmd.exe 8764 cmd.exe 1780 cmd.exe 3240 cmd.exe 9984 cmd.exe 6596 cmd.exe 9816 cmd.exe 8268 cmd.exe 5612 cmd.exe 9116 cmd.exe 2316 cmd.exe 4356 cmd.exe 6088 cmd.exe 10116 cmd.exe 7904 cmd.exe 7932 cmd.exe 8368 cmd.exe 7364 cmd.exe 7480 cmd.exe 9684 cmd.exe 6056 cmd.exe 7532 cmd.exe 1020 cmd.exe 6704 cmd.exe 5236 cmd.exe 8704 cmd.exe 5648 cmd.exe 6740 cmd.exe 6816 cmd.exe 8632 cmd.exe 8724 cmd.exe 2840 cmd.exe 6796 cmd.exe 5684 cmd.exe 7420 cmd.exe 9396 cmd.exe 5564 cmd.exe 7732 cmd.exe 6076 cmd.exe 7856 cmd.exe 8700 cmd.exe 8052 cmd.exe 2732 cmd.exe 7468 cmd.exe 2904 cmd.exe 7000 cmd.exe 9008 cmd.exe 9800 cmd.exe 5260 cmd.exe 8360 cmd.exe 9832 cmd.exe 8880 cmd.exe 5852 cmd.exe 3016 cmd.exe 3884 cmd.exe 8512 cmd.exe 7540 cmd.exe 9740 cmd.exe 5368 cmd.exe 7800 cmd.exe 1252 cmd.exe 8528 cmd.exe 7924 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FueagoNeuxs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FueagoNeuxs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FueagoNeuxs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FueagoNeuxs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FueagoNeuxs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FueagoNeuxs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FueagoNeuxs.exe - System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 64 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 8136 netsh.exe 1492 netsh.exe 10016 netsh.exe 1072 netsh.exe 9768 netsh.exe 2620 netsh.exe 7480 netsh.exe 9568 netsh.exe 1628 netsh.exe 1200 netsh.exe 2412 netsh.exe 5672 netsh.exe 6640 netsh.exe 1820 netsh.exe 8124 netsh.exe 8720 netsh.exe 5652 netsh.exe 6356 netsh.exe 6124 netsh.exe 1804 netsh.exe 10056 netsh.exe 4572 netsh.exe 4104 netsh.exe 6344 netsh.exe 9636 netsh.exe 2584 netsh.exe 2428 netsh.exe 5720 netsh.exe 5748 netsh.exe 9004 netsh.exe 9036 netsh.exe 9268 netsh.exe 7416 netsh.exe 8840 netsh.exe 9452 netsh.exe 10208 netsh.exe 5104 netsh.exe 9932 netsh.exe 5948 netsh.exe 5888 netsh.exe 4372 netsh.exe 8352 netsh.exe 5784 netsh.exe 10152 netsh.exe 8128 netsh.exe 5868 netsh.exe 4892 netsh.exe 8424 netsh.exe 9928 netsh.exe 3384 netsh.exe 5876 netsh.exe 4720 netsh.exe 9532 netsh.exe 8384 netsh.exe 3112 netsh.exe 4968 netsh.exe 9636 netsh.exe 5932 netsh.exe 6328 netsh.exe 7436 netsh.exe 8488 netsh.exe 1232 netsh.exe 7532 netsh.exe 9292 netsh.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S Windows Portable 64-bit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S Windows Portable 64-bit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S Windows Portable 64-bit.exe - Delays execution with timeout.exe 64 IoCs
pid Process 2008 timeout.exe 6028 timeout.exe 9244 timeout.exe 4764 timeout.exe 5368 timeout.exe 5644 timeout.exe 10004 timeout.exe 8640 timeout.exe 9272 timeout.exe 4656 timeout.exe 9520 timeout.exe 8588 timeout.exe 8064 timeout.exe 320 timeout.exe 8516 timeout.exe 8828 timeout.exe 2808 timeout.exe 9632 timeout.exe 7672 timeout.exe 9228 timeout.exe 9956 timeout.exe 3900 timeout.exe 2580 timeout.exe 1856 timeout.exe 3312 timeout.exe 8612 timeout.exe 2412 timeout.exe 8696 timeout.exe 3448 timeout.exe 9720 timeout.exe 9408 timeout.exe 9648 timeout.exe 7960 timeout.exe 7896 timeout.exe 10004 timeout.exe 6728 timeout.exe 8308 timeout.exe 8660 timeout.exe 5012 timeout.exe 8408 timeout.exe 7880 timeout.exe 7804 timeout.exe 2008 timeout.exe 2412 timeout.exe 7352 timeout.exe 6760 timeout.exe 8868 timeout.exe 6096 timeout.exe 5920 timeout.exe 9572 timeout.exe 3896 timeout.exe 9440 timeout.exe 5676 timeout.exe 5152 timeout.exe 6932 timeout.exe 10100 timeout.exe 6128 timeout.exe 10060 timeout.exe 8196 timeout.exe 6748 timeout.exe 6748 timeout.exe 7560 timeout.exe 7040 timeout.exe 5724 timeout.exe - Enumerates system info in registry 2 TTPs 9 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer Windows Portable 64-bit.exe - Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 4460 wmic.exe 4460 wmic.exe 4460 wmic.exe 4460 wmic.exe 3632 wmic.exe 3632 wmic.exe 3632 wmic.exe 3632 wmic.exe 2908 wmic.exe 2908 wmic.exe 2908 wmic.exe 2908 wmic.exe 2476 wmic.exe 2476 wmic.exe 2476 wmic.exe 2476 wmic.exe 3052 wmic.exe 3052 wmic.exe 3052 wmic.exe 3052 wmic.exe 5092 Windows Portable 64-bit.exe 4228 wmic.exe 4228 wmic.exe 4228 wmic.exe 4228 wmic.exe 4208 Windows Portable 64-bit.exe 2680 Windows Portable 64-bit.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4460 wmic.exe Token: SeSecurityPrivilege 4460 wmic.exe Token: SeTakeOwnershipPrivilege 4460 wmic.exe Token: SeLoadDriverPrivilege 4460 wmic.exe Token: SeSystemProfilePrivilege 4460 wmic.exe Token: SeSystemtimePrivilege 4460 wmic.exe Token: SeProfSingleProcessPrivilege 4460 wmic.exe Token: SeIncBasePriorityPrivilege 4460 wmic.exe Token: SeCreatePagefilePrivilege 4460 wmic.exe Token: SeBackupPrivilege 4460 wmic.exe Token: SeRestorePrivilege 4460 wmic.exe Token: SeShutdownPrivilege 4460 wmic.exe Token: SeDebugPrivilege 4460 wmic.exe Token: SeSystemEnvironmentPrivilege 4460 wmic.exe Token: SeRemoteShutdownPrivilege 4460 wmic.exe Token: SeUndockPrivilege 4460 wmic.exe Token: SeManageVolumePrivilege 4460 wmic.exe Token: 33 4460 wmic.exe Token: 34 4460 wmic.exe Token: 35 4460 wmic.exe Token: 36 4460 wmic.exe Token: SeIncreaseQuotaPrivilege 4460 wmic.exe Token: SeSecurityPrivilege 4460 wmic.exe Token: SeTakeOwnershipPrivilege 4460 wmic.exe Token: SeLoadDriverPrivilege 4460 wmic.exe Token: SeSystemProfilePrivilege 4460 wmic.exe Token: SeSystemtimePrivilege 4460 wmic.exe Token: SeProfSingleProcessPrivilege 4460 wmic.exe Token: SeIncBasePriorityPrivilege 4460 wmic.exe Token: SeCreatePagefilePrivilege 4460 wmic.exe Token: SeBackupPrivilege 4460 wmic.exe Token: SeRestorePrivilege 4460 wmic.exe Token: SeShutdownPrivilege 4460 wmic.exe Token: SeDebugPrivilege 4460 wmic.exe Token: SeSystemEnvironmentPrivilege 4460 wmic.exe Token: SeRemoteShutdownPrivilege 4460 wmic.exe Token: SeUndockPrivilege 4460 wmic.exe Token: SeManageVolumePrivilege 4460 wmic.exe Token: 33 4460 wmic.exe Token: 34 4460 wmic.exe Token: 35 4460 wmic.exe Token: 36 4460 wmic.exe Token: SeIncreaseQuotaPrivilege 3632 wmic.exe Token: SeSecurityPrivilege 3632 wmic.exe Token: SeTakeOwnershipPrivilege 3632 wmic.exe Token: SeLoadDriverPrivilege 3632 wmic.exe Token: SeSystemProfilePrivilege 3632 wmic.exe Token: SeSystemtimePrivilege 3632 wmic.exe Token: SeProfSingleProcessPrivilege 3632 wmic.exe Token: SeIncBasePriorityPrivilege 3632 wmic.exe Token: SeCreatePagefilePrivilege 3632 wmic.exe Token: SeBackupPrivilege 3632 wmic.exe Token: SeRestorePrivilege 3632 wmic.exe Token: SeShutdownPrivilege 3632 wmic.exe Token: SeDebugPrivilege 3632 wmic.exe Token: SeSystemEnvironmentPrivilege 3632 wmic.exe Token: SeRemoteShutdownPrivilege 3632 wmic.exe Token: SeUndockPrivilege 3632 wmic.exe Token: SeManageVolumePrivilege 3632 wmic.exe Token: 33 3632 wmic.exe Token: 34 3632 wmic.exe Token: 35 3632 wmic.exe Token: 36 3632 wmic.exe Token: SeIncreaseQuotaPrivilege 3632 wmic.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2648 2480 FueagoNeuxs.exe 84 PID 2480 wrote to memory of 4208 2480 FueagoNeuxs.exe 85 PID 4208 wrote to memory of 4460 4208 Windows Portable 64-bit.exe 86 PID 2648 wrote to memory of 5040 2648 FueagoNeuxs.exe 88 PID 2648 wrote to memory of 5092 2648 FueagoNeuxs.exe 89 PID 5092 wrote to memory of 3632 5092 Windows Portable 64-bit.exe 142 PID 5040 wrote to memory of 3004 5040 FueagoNeuxs.exe 93 PID 5040 wrote to memory of 2680 5040 FueagoNeuxs.exe 94 PID 2680 wrote to memory of 2908 2680 Windows Portable 64-bit.exe 95 PID 3004 wrote to memory of 4232 3004 FueagoNeuxs.exe 97 PID 3004 wrote to memory of 1624 3004 FueagoNeuxs.exe 98 PID 1624 wrote to memory of 2476 1624 Windows Portable 64-bit.exe 234 PID 4232 wrote to memory of 3356 4232 FueagoNeuxs.exe 101 PID 4232 wrote to memory of 2320 4232 FueagoNeuxs.exe 102 PID 2320 wrote to memory of 3052 2320 Windows Portable 64-bit.exe 103 PID 3356 wrote to memory of 4756 3356 FueagoNeuxs.exe 105 PID 3356 wrote to memory of 2980 3356 FueagoNeuxs.exe 106 PID 2980 wrote to memory of 4228 2980 Windows Portable 64-bit.exe 952 PID 4756 wrote to memory of 1304 4756 FueagoNeuxs.exe 109 PID 4756 wrote to memory of 1292 4756 FueagoNeuxs.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"6⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"7⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"8⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"9⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"10⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"11⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"12⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"13⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"14⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"15⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"16⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"17⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"18⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"19⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"20⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"21⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"22⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"23⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"24⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"25⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"26⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"27⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"28⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"29⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"30⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"31⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"32⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"33⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"34⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"35⤵PID:6332
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"36⤵PID:6572
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"37⤵PID:6784
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"38⤵PID:7112
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"39⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"40⤵PID:6968
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"41⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"42⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"43⤵PID:6268
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"44⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"45⤵PID:7108
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"46⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"47⤵PID:7212
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"48⤵PID:7632
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"49⤵PID:8040
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"50⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"51⤵PID:7180
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"52⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"53⤵PID:7520
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"54⤵PID:7344
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"55⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"56⤵PID:7292
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"57⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"58⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"59⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"60⤵PID:6992
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"61⤵PID:8380
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"62⤵PID:8668
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"63⤵PID:9048
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"64⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"65⤵PID:7680
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"66⤵PID:7876
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"67⤵PID:9196
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"68⤵PID:8024
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"69⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"70⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"71⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"72⤵PID:7400
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"73⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"74⤵PID:8520
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"75⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"76⤵PID:8132
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"77⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"78⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"79⤵PID:7956
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"80⤵PID:8876
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"81⤵PID:9372
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"82⤵PID:9916
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"83⤵PID:7916
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"84⤵PID:8204
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"85⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"86⤵PID:9980
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"87⤵PID:5376
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"88⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"89⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"90⤵PID:8532
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"91⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"92⤵PID:9644
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"93⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"94⤵PID:9512
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"95⤵PID:7788
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"96⤵PID:6592
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"97⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"98⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"99⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"100⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"101⤵PID:9692
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"102⤵PID:9468
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"103⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"104⤵PID:10104
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"105⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"106⤵PID:9668
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"107⤵PID:9840
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"108⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"109⤵PID:8984
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"110⤵PID:10108
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"111⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"112⤵PID:10164
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"113⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"114⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"115⤵PID:7224
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"116⤵PID:7700
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"117⤵PID:10024
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"118⤵PID:7772
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"119⤵PID:7972
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"120⤵PID:8812
-
C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"C:\Users\Admin\AppData\Local\Temp\FueagoNeuxs.exe"121⤵PID:6660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-