Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
65s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 04:54
Behavioral task
behavioral1
Sample
NEAS.afc59c367f4135de994f9e22a143d370.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.afc59c367f4135de994f9e22a143d370.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.afc59c367f4135de994f9e22a143d370.exe
-
Size
136KB
-
MD5
afc59c367f4135de994f9e22a143d370
-
SHA1
a2ee61913494b927674ab9eb3b435ffeb3ce2da8
-
SHA256
13c83a6da067f114db7d712d789d3959fe08887e9d3b832abc9e7bc12caec274
-
SHA512
5a3d19fe7707297706822aa989963ea1414824e34f26e1286018908e736a7d065dfed0acee9e8ed025555399ef0638c215faf24d59dce87d04f74993bbdea4e1
-
SSDEEP
1536:AYjIyeC1eUfKjkhBYJ7mTCbqODiC1ZsyHZK0FjlqsS5eHyG9LU3YG8nk8QHNugpV:ZdEUfKj8BYbDiC1ZTK7sxtLUIGukugyw
Malware Config
Signatures
-
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/4452-0-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/files/0x0007000000022de0-6.dat family_berbew behavioral2/files/0x0007000000022de0-35.dat family_berbew behavioral2/files/0x0007000000022de0-36.dat family_berbew behavioral2/files/0x0007000000022ddf-41.dat family_berbew behavioral2/files/0x0007000000022de9-71.dat family_berbew behavioral2/files/0x0007000000022de9-72.dat family_berbew behavioral2/files/0x0007000000022ded-106.dat family_berbew behavioral2/files/0x0007000000022ded-107.dat family_berbew behavioral2/memory/4452-140-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/files/0x0006000000022df5-142.dat family_berbew behavioral2/files/0x0006000000022df5-143.dat family_berbew behavioral2/files/0x0009000000022df6-178.dat family_berbew behavioral2/memory/5088-179-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/files/0x0009000000022df6-177.dat family_berbew behavioral2/files/0x000a000000022df9-213.dat family_berbew behavioral2/files/0x000a000000022df9-214.dat family_berbew behavioral2/memory/564-243-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/files/0x000a000000022dfc-249.dat family_berbew behavioral2/files/0x000a000000022dfc-250.dat family_berbew behavioral2/memory/3528-283-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/files/0x0008000000022dfd-285.dat family_berbew behavioral2/files/0x0008000000022dfd-286.dat family_berbew behavioral2/memory/3396-319-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/files/0x0008000000022d14-321.dat family_berbew behavioral2/files/0x0008000000022d14-322.dat family_berbew behavioral2/files/0x0007000000022dff-356.dat family_berbew behavioral2/files/0x0007000000022dff-357.dat family_berbew behavioral2/memory/3412-383-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/files/0x000c000000022d11-393.dat family_berbew behavioral2/files/0x000c000000022d11-392.dat family_berbew behavioral2/memory/4972-423-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/files/0x0009000000022e02-429.dat family_berbew behavioral2/files/0x0009000000022e02-430.dat family_berbew behavioral2/memory/636-456-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/files/0x0006000000022e03-466.dat family_berbew behavioral2/files/0x0006000000022e03-465.dat family_berbew behavioral2/memory/3516-500-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/files/0x0006000000022e04-502.dat family_berbew behavioral2/files/0x0006000000022e04-503.dat family_berbew behavioral2/memory/3404-532-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/files/0x0006000000022e05-538.dat family_berbew behavioral2/files/0x0006000000022e05-539.dat family_berbew behavioral2/memory/2028-544-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/memory/764-569-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/files/0x0006000000022e06-575.dat family_berbew behavioral2/files/0x0006000000022e06-576.dat family_berbew behavioral2/memory/3648-581-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/memory/3352-606-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/files/0x0006000000022e08-612.dat family_berbew behavioral2/files/0x0006000000022e08-613.dat family_berbew behavioral2/memory/3628-618-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/files/0x0006000000022e09-648.dat family_berbew behavioral2/files/0x0006000000022e09-649.dat family_berbew behavioral2/memory/4048-675-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/memory/2936-690-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/memory/4284-720-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/memory/2624-750-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/memory/4404-842-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/memory/4044-875-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/memory/3064-908-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/memory/5000-909-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/memory/4972-915-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew behavioral2/memory/2856-943-0x0000000000400000-0x000000000049C000-memory.dmp family_berbew -
Checks computer location settings 2 TTPs 62 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemtdode.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemncros.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemnzoug.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemczvtq.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemeksyj.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemprawa.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemjihcg.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemhegmj.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemwemjz.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemnuplb.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemyrjlf.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemgvfbn.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemvbnxi.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemsnscb.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemekwoo.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqembvnti.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemqvkmr.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemvqhep.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemxydau.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemgyrny.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemyvfdr.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemeujxa.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemikcvk.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemuxwbe.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemglypo.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemotlwm.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemyeave.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemqcbjv.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemyvrym.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation NEAS.afc59c367f4135de994f9e22a143d370.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemlafsq.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemtdefz.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemytutj.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemnnlfc.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemltehz.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemlhrjm.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemgvocy.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemwpoyw.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemgpufi.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemyjzej.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemtplbx.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemuxagt.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemmquhi.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemlduny.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemgrvko.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemtejbj.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemhbihh.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqembfdep.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemeigdt.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemgjhex.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemptxal.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemndqdu.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemjghcf.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemnmvts.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemofnuj.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemhlplz.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemjockw.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemdqoyy.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemqnjdb.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemijhli.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemsdnpt.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation Sysqemtmjiv.exe -
Executes dropped EXE 63 IoCs
pid Process 5088 Sysqemlduny.exe 564 Sysqemlhrjm.exe 3528 Sysqemyjzej.exe 3396 Sysqemgrvko.exe 3412 Sysqemlafsq.exe 4972 Sysqemptxal.exe 636 Sysqemyrjlf.exe 3516 Sysqemqnjdb.exe 3404 Sysqemndqdu.exe 2028 Sysqemgvfbn.exe 764 Sysqemijhli.exe 3648 Sysqemqvkmr.exe 3352 Sysqemtejbj.exe 3628 Sysqemjghcf.exe 4048 Sysqemgvocy.exe 2936 Sysqemvbnxi.exe 4284 Sysqemsnscb.exe 2624 Sysqemikcvk.exe 4404 Sysqemotlwm.exe 4044 Sysqemnmvts.exe 3064 Sysqemvqhep.exe 5000 Sysqemtdefz.exe 2856 Sysqemsdnpt.exe 468 Sysqemtdode.exe 4028 Sysqemytutj.exe 4972 Sysqemptxal.exe 2704 Sysqemncros.exe 4352 Sysqemtplbx.exe 2100 Sysqemhbihh.exe 2912 Sysqemnzoug.exe 3612 Sysqemprawa.exe 2160 Sysqemofnuj.exe 4996 Sysqemyeave.exe 3796 Sysqemnnlfc.exe 1560 Sysqemxydau.exe 336 Sysqemczvtq.exe 564 Sysqemekwoo.exe 3624 Sysqemeksyj.exe 880 Sysqemuxagt.exe 4760 Sysqemhlplz.exe 2888 Sysqemjockw.exe 3088 Sysqemqcbjv.exe 1688 Sysqemgjhex.exe 1612 Sysqemjihcg.exe 3528 Sysqemgyrny.exe 4036 Sysqemyvrym.exe 3212 Sysqemuxwbe.exe 3172 Sysqemwpoyw.exe 4456 Sysqemhegmj.exe 2700 Sysqemwemjz.exe 1048 Sysqembfdep.exe 836 Sysqemtmjiv.exe 4768 Sysqemltehz.exe 2008 Sysqemmquhi.exe 1724 Sysqemnuplb.exe 2412 Sysqemglypo.exe 3868 Sysqemyvfdr.exe 3908 Sysqemeigdt.exe 2592 Sysqemgpufi.exe 4300 Sysqemeujxa.exe 4436 Sysqemdqoyy.exe 3048 Sysqembvnti.exe 4028 Sysqemytutj.exe -
resource yara_rule behavioral2/memory/4452-0-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0007000000022de0-6.dat upx behavioral2/files/0x0007000000022de0-35.dat upx behavioral2/files/0x0007000000022de0-36.dat upx behavioral2/files/0x0007000000022ddf-41.dat upx behavioral2/files/0x0007000000022de9-71.dat upx behavioral2/files/0x0007000000022de9-72.dat upx behavioral2/files/0x0007000000022ded-106.dat upx behavioral2/files/0x0007000000022ded-107.dat upx behavioral2/memory/4452-140-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0006000000022df5-142.dat upx behavioral2/files/0x0006000000022df5-143.dat upx behavioral2/files/0x0009000000022df6-178.dat upx behavioral2/memory/5088-179-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0009000000022df6-177.dat upx behavioral2/files/0x000a000000022df9-213.dat upx behavioral2/files/0x000a000000022df9-214.dat upx behavioral2/memory/564-243-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x000a000000022dfc-249.dat upx behavioral2/files/0x000a000000022dfc-250.dat upx behavioral2/memory/3528-283-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0008000000022dfd-285.dat upx behavioral2/files/0x0008000000022dfd-286.dat upx behavioral2/memory/3396-319-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0008000000022d14-321.dat upx behavioral2/files/0x0008000000022d14-322.dat upx behavioral2/files/0x0007000000022dff-356.dat upx behavioral2/files/0x0007000000022dff-357.dat upx behavioral2/memory/3412-383-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x000c000000022d11-393.dat upx behavioral2/files/0x000c000000022d11-392.dat upx behavioral2/memory/4972-423-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0009000000022e02-429.dat upx behavioral2/files/0x0009000000022e02-430.dat upx behavioral2/memory/636-456-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0006000000022e03-466.dat upx behavioral2/files/0x0006000000022e03-465.dat upx behavioral2/memory/3516-500-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0006000000022e04-502.dat upx behavioral2/files/0x0006000000022e04-503.dat upx behavioral2/memory/3404-532-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0006000000022e05-538.dat upx behavioral2/files/0x0006000000022e05-539.dat upx behavioral2/memory/2028-544-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/764-569-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0006000000022e06-575.dat upx behavioral2/files/0x0006000000022e06-576.dat upx behavioral2/memory/3648-581-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/3352-606-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0006000000022e08-612.dat upx behavioral2/files/0x0006000000022e08-613.dat upx behavioral2/memory/3628-618-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0006000000022e09-648.dat upx behavioral2/files/0x0006000000022e09-649.dat upx behavioral2/memory/4048-675-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/2936-690-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/4284-720-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/2624-750-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/4404-842-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/4044-875-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/3064-908-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/5000-909-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/4972-915-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/2856-943-0x0000000000400000-0x000000000049C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 62 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlafsq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyrjlf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgrvko.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqvkmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemglypo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemikcvk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhbihh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemnuplb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemeujxa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemijhli.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxydau.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemeksyj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembfdep.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtmjiv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemltehz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtejbj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhlplz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyvrym.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjockw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvbnxi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtplbx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemnzoug.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemprawa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyeave.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ NEAS.afc59c367f4135de994f9e22a143d370.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlduny.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgvocy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembvnti.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsdnpt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemczvtq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgjhex.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuxwbe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemeigdt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhegmj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgvfbn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuxagt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwpoyw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemptxal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemekwoo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmquhi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyvfdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsnscb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemofnuj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgyrny.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtdode.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemytutj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemncros.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemnnlfc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqcbjv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyjzej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemndqdu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemnmvts.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgpufi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtdefz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwemjz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdqoyy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvqhep.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjihcg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlhrjm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqnjdb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjghcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemotlwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4452 wrote to memory of 5088 4452 NEAS.afc59c367f4135de994f9e22a143d370.exe 91 PID 4452 wrote to memory of 5088 4452 NEAS.afc59c367f4135de994f9e22a143d370.exe 91 PID 4452 wrote to memory of 5088 4452 NEAS.afc59c367f4135de994f9e22a143d370.exe 91 PID 5088 wrote to memory of 564 5088 Sysqemlduny.exe 92 PID 5088 wrote to memory of 564 5088 Sysqemlduny.exe 92 PID 5088 wrote to memory of 564 5088 Sysqemlduny.exe 92 PID 564 wrote to memory of 3528 564 Sysqemlhrjm.exe 94 PID 564 wrote to memory of 3528 564 Sysqemlhrjm.exe 94 PID 564 wrote to memory of 3528 564 Sysqemlhrjm.exe 94 PID 3528 wrote to memory of 3396 3528 Sysqemyjzej.exe 96 PID 3528 wrote to memory of 3396 3528 Sysqemyjzej.exe 96 PID 3528 wrote to memory of 3396 3528 Sysqemyjzej.exe 96 PID 3396 wrote to memory of 3412 3396 Sysqemgrvko.exe 97 PID 3396 wrote to memory of 3412 3396 Sysqemgrvko.exe 97 PID 3396 wrote to memory of 3412 3396 Sysqemgrvko.exe 97 PID 3412 wrote to memory of 4972 3412 Sysqemlafsq.exe 125 PID 3412 wrote to memory of 4972 3412 Sysqemlafsq.exe 125 PID 3412 wrote to memory of 4972 3412 Sysqemlafsq.exe 125 PID 4972 wrote to memory of 636 4972 Sysqemptxal.exe 101 PID 4972 wrote to memory of 636 4972 Sysqemptxal.exe 101 PID 4972 wrote to memory of 636 4972 Sysqemptxal.exe 101 PID 636 wrote to memory of 3516 636 Sysqemyrjlf.exe 102 PID 636 wrote to memory of 3516 636 Sysqemyrjlf.exe 102 PID 636 wrote to memory of 3516 636 Sysqemyrjlf.exe 102 PID 3516 wrote to memory of 3404 3516 Sysqemqnjdb.exe 104 PID 3516 wrote to memory of 3404 3516 Sysqemqnjdb.exe 104 PID 3516 wrote to memory of 3404 3516 Sysqemqnjdb.exe 104 PID 3404 wrote to memory of 2028 3404 Sysqemndqdu.exe 106 PID 3404 wrote to memory of 2028 3404 Sysqemndqdu.exe 106 PID 3404 wrote to memory of 2028 3404 Sysqemndqdu.exe 106 PID 2028 wrote to memory of 764 2028 Sysqemgvfbn.exe 107 PID 2028 wrote to memory of 764 2028 Sysqemgvfbn.exe 107 PID 2028 wrote to memory of 764 2028 Sysqemgvfbn.exe 107 PID 764 wrote to memory of 3648 764 Sysqemijhli.exe 108 PID 764 wrote to memory of 3648 764 Sysqemijhli.exe 108 PID 764 wrote to memory of 3648 764 Sysqemijhli.exe 108 PID 3648 wrote to memory of 3352 3648 Sysqemqvkmr.exe 109 PID 3648 wrote to memory of 3352 3648 Sysqemqvkmr.exe 109 PID 3648 wrote to memory of 3352 3648 Sysqemqvkmr.exe 109 PID 3352 wrote to memory of 3628 3352 Sysqemtejbj.exe 110 PID 3352 wrote to memory of 3628 3352 Sysqemtejbj.exe 110 PID 3352 wrote to memory of 3628 3352 Sysqemtejbj.exe 110 PID 3628 wrote to memory of 4048 3628 Sysqemjghcf.exe 111 PID 3628 wrote to memory of 4048 3628 Sysqemjghcf.exe 111 PID 3628 wrote to memory of 4048 3628 Sysqemjghcf.exe 111 PID 4048 wrote to memory of 2936 4048 Sysqemgvocy.exe 113 PID 4048 wrote to memory of 2936 4048 Sysqemgvocy.exe 113 PID 4048 wrote to memory of 2936 4048 Sysqemgvocy.exe 113 PID 2936 wrote to memory of 4284 2936 Sysqemvbnxi.exe 114 PID 2936 wrote to memory of 4284 2936 Sysqemvbnxi.exe 114 PID 2936 wrote to memory of 4284 2936 Sysqemvbnxi.exe 114 PID 4284 wrote to memory of 2624 4284 Sysqemsnscb.exe 115 PID 4284 wrote to memory of 2624 4284 Sysqemsnscb.exe 115 PID 4284 wrote to memory of 2624 4284 Sysqemsnscb.exe 115 PID 2624 wrote to memory of 4404 2624 Sysqemikcvk.exe 117 PID 2624 wrote to memory of 4404 2624 Sysqemikcvk.exe 117 PID 2624 wrote to memory of 4404 2624 Sysqemikcvk.exe 117 PID 4404 wrote to memory of 4044 4404 Sysqemotlwm.exe 118 PID 4404 wrote to memory of 4044 4404 Sysqemotlwm.exe 118 PID 4404 wrote to memory of 4044 4404 Sysqemotlwm.exe 118 PID 4044 wrote to memory of 3064 4044 Sysqemnmvts.exe 119 PID 4044 wrote to memory of 3064 4044 Sysqemnmvts.exe 119 PID 4044 wrote to memory of 3064 4044 Sysqemnmvts.exe 119 PID 3064 wrote to memory of 5000 3064 Sysqemvqhep.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.afc59c367f4135de994f9e22a143d370.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.afc59c367f4135de994f9e22a143d370.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlduny.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlduny.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlhrjm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlhrjm.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyjzej.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyjzej.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgrvko.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgrvko.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlafsq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlafsq.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdaqqp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdaqqp.exe"7⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\Sysqemyrjlf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyrjlf.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqnjdb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqnjdb.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\Sysqemndqdu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemndqdu.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgvfbn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgvfbn.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\Sysqemijhli.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemijhli.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqvkmr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqvkmr.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtejbj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtejbj.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjghcf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjghcf.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgvocy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgvocy.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvbnxi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvbnxi.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsnscb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsnscb.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\Sysqemikcvk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemikcvk.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\Sysqemotlwm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemotlwm.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnmvts.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnmvts.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvqhep.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvqhep.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtdefz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtdefz.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsdnpt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsdnpt.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtdode.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtdode.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:468 -
C:\Users\Admin\AppData\Local\Temp\Sysqemthbvt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemthbvt.exe"26⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\Sysqemptxal.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemptxal.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\Sysqemncros.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemncros.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtplbx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtplbx.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhbihh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhbihh.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnzoug.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnzoug.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\Sysqemprawa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemprawa.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\Sysqemidzrh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemidzrh.exe"33⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\Sysqemkrwme.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkrwme.exe"34⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnnlfc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnnlfc.exe"35⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxydau.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxydau.exe"36⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\Sysqemczvtq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemczvtq.exe"37⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:336 -
C:\Users\Admin\AppData\Local\Temp\Sysqemekwoo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemekwoo.exe"38⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:564 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeksyj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeksyj.exe"39⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuxagt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuxagt.exe"40⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:880 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhlplz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhlplz.exe"41⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjockw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjockw.exe"42⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\Sysqembhnxq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembhnxq.exe"43⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\Sysqemgjhex.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgjhex.exe"44⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjihcg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjihcg.exe"45⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgyrny.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgyrny.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyvrym.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyvrym.exe"47⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuxwbe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuxwbe.exe"48⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwpoyw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwpoyw.exe"49⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtevyp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtevyp.exe"50⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\Sysqemwemjz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwemjz.exe"51⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\Sysqembfdep.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembfdep.exe"52⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjgbee.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjgbee.exe"53⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\Sysqemltehz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemltehz.exe"54⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmquhi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmquhi.exe"55⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdidrc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdidrc.exe"56⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\Sysqemglypo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemglypo.exe"57⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdifph.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdifph.exe"58⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\Sysqemeigdt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeigdt.exe"59⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgpufi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgpufi.exe"60⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgesli.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgesli.exe"61⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\Sysqemdqoyy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdqoyy.exe"62⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\Sysqembvnti.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembvnti.exe"63⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\Sysqemytutj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemytutj.exe"64⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\Sysqemboyjq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemboyjq.exe"65⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\Sysqemyxrxp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyxrxp.exe"66⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\Sysqemlzysu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlzysu.exe"67⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\Sysqemofnuj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemofnuj.exe"68⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlgxhf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlgxhf.exe"69⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\Sysqemojafs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemojafs.exe"70⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\Sysqemojbld.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemojbld.exe"71⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\Sysqemrppvt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrppvt.exe"72⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\Sysqemtwwgi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtwwgi.exe"73⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqxotm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqxotm.exe"74⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\Sysqemtduwc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtduwc.exe"75⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\Sysqemtpgoq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtpgoq.exe"76⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\Sysqemvvvzf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvvvzf.exe"77⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqcbjv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqcbjv.exe"78⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtttux.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtttux.exe"79⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\Sysqemvdskp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvdskp.exe"80⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\Sysqemygvhb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemygvhb.exe"81⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\Sysqemtaapb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtaapb.exe"82⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\Sysqemoojnw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoojnw.exe"83⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqyido.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqyido.exe"84⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\Sysqemwhsdq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwhsdq.exe"85⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\Sysqemyvfdr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyvfdr.exe"86⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyhsjr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyhsjr.exe"87⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\Sysqemivuma.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemivuma.exe"88⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\Sysqemdikcn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdikcn.exe"89⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\Sysqemypckb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemypckb.exe"90⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\Sysqemyeave.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyeave.exe"91⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\Sysqemazfqe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemazfqe.exe"92⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnulmq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnulmq.exe"93⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\Sysqemszpjp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemszpjp.exe"94⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\Sysqemdwddb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdwddb.exe"95⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\Sysqemxuulp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxuulp.exe"96⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\Sysqemimuga.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemimuga.exe"97⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\Sysqemdhabl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdhabl.exe"98⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\Sysqemiqjkn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiqjkn.exe"99⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\Sysqemcamxf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcamxf.exe"100⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\Sysqemctwvk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemctwvk.exe"101⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\Sysqemxhlll.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxhlll.exe"102⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\Sysqemcmiwe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcmiwe.exe"103⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\Sysqempdmws.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempdmws.exe"104⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\Sysqemphzpg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemphzpg.exe"105⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmbukf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmbukf.exe"106⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnbwpq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnbwpq.exe"107⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\Sysqemfbhnp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfbhnp.exe"108⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\Sysqemszcvj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemszcvj.exe"109⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnuplb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnuplb.exe"110⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmmrjp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmmrjp.exe"111⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\Sysqemrlxjx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrlxjx.exe"112⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmfdei.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmfdei.exe"113⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\Sysqemhegmj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhegmj.exe"114⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkpgqb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkpgqb.exe"115⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\Sysqemuhulz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuhulz.exe"116⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\Sysqemulibt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemulibt.exe"117⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\Sysqemhcnbq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhcnbq.exe"118⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\Sysqemzyory.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzyory.exe"119⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\Sysqemcipnv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcipnv.exe"120⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\Sysqempdhgg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempdhgg.exe"121⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\Sysqemhzhwg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhzhwg.exe"122⤵PID:1616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-