Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
72s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 21:19
Static task
static1
Behavioral task
behavioral1
Sample
3875b051a933ba13b19ca8883cd1c790_NEIKI.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3875b051a933ba13b19ca8883cd1c790_NEIKI.exe
Resource
win10v2004-20240419-en
General
-
Target
3875b051a933ba13b19ca8883cd1c790_NEIKI.exe
-
Size
81KB
-
MD5
3875b051a933ba13b19ca8883cd1c790
-
SHA1
600458f80cd2ae81fda99f1b2596bb913e0cf5ec
-
SHA256
5bb60b580dc898f4017a155bece93db3ed6a2ec68461ff2fb6a0c313e2c32630
-
SHA512
436684adfca8f0f51ebd6205bba077a22ff3218ffa9bbdfa91395f93b5560c1c7fdbbd047b5524ad82dd4776b5a8082ab5323feae4c3d986a21679cc39427467
-
SSDEEP
1536:GzfMMkPZE1J7S6/PMj42VJEY4ujMepJtANuOAl0QQsIEySYndfcot:EfMNE1JG6XMk27EbpOthl0ZUed0ot
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemmismh.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemifuzv.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemodxhy.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemuzgqp.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemmpblh.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemtqqpt.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemhdchy.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemucumw.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation 3875b051a933ba13b19ca8883cd1c790_NEIKI.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemvgwow.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemfljzu.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemhnuqk.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemtbrlm.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemayrzk.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemkjodz.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqempnjsl.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemacfqm.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemfmmfv.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemjeuzp.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemwditq.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemoziem.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemscfkm.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemtxorf.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemitjoa.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemrdxfi.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemggjov.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemvufac.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemddney.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemfopxw.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemuhmeg.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemtunfn.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemdtrdf.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemqlyae.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemjwbtt.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemmxjwj.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemyymje.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemssccq.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemswaqx.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemezoat.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemviwvx.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemsnnra.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemhunqp.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemoumnd.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemgvjxs.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemxeait.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemjbjox.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemnmral.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemgtdrr.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemlohly.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemgrilt.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemjmoeb.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemixahs.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemcdrjs.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemdiawl.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemiwamx.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemaycvf.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemhsckv.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqembptas.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemrswyl.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemmnmjc.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemusyvk.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemjiipr.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemthbvt.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Sysqemroqex.exe -
Executes dropped EXE 64 IoCs
pid Process 5088 Sysqemztepm.exe 1572 Sysqemuhmeg.exe 4060 Sysqemcwisk.exe 3616 Sysqemgmffg.exe 1948 Sysqemokaas.exe 2504 Sysqemuljva.exe 4568 Sysqembptas.exe 4732 Sysqemjegvw.exe 60 Sysqemoumnd.exe 1156 Sysqemrnctq.exe 1124 Sysqemryole.exe 4516 Sysqemwditq.exe 3112 Sysqemjmoeb.exe 1012 Sysqemoziem.exe 4496 Sysqemyymje.exe 3540 Sysqemmismh.exe 2692 Sysqemosjbz.exe 4948 Sysqemtxorf.exe 2824 Sysqemwevuu.exe 1588 Sysqemtqqpt.exe 852 Sysqembubuc.exe 4716 Sysqemgvjxs.exe 2636 Sysqemjcxai.exe 4368 Sysqemtunfn.exe 2712 Sysqemdtrdf.exe 2112 Sysqemrdxfi.exe 1208 Sysqembyyyq.exe 2212 Sysqemrswyl.exe 3260 Sysqemmjqti.exe 3084 Sysqemwxrwk.exe 4616 Sysqemmnmjc.exe 3540 Sysqemwxbup.exe 1312 Sysqemgtdrr.exe 2036 Sysqemdqksk.exe 5048 Sysqemtgxfc.exe 2872 Sysqemdgidb.exe 3184 Sysqembpslw.exe 3216 Sysqemlktve.exe 4252 Sysqemtshvq.exe 1056 Sysqemojiyn.exe 5096 Sysqemlohly.exe 1588 Sysqemggjov.exe 2212 Sysqemvgwow.exe 4208 Sysqemocvzs.exe 3176 Sysqemixahs.exe 1872 Sysqemqyivk.exe 1612 Sysqemtwqqu.exe 3440 Sysqemgrilt.exe 3720 Sysqemjbjox.exe 4696 Sysqemdiawl.exe 3188 Sysqembficq.exe 1544 Sysqemlqzrx.exe 4116 Sysqemayrzk.exe 4812 Sysqemscfkm.exe 4412 Sysqemacfqm.exe 2472 Sysqemniyym.exe 5060 Sysqemvmjqp.exe 3540 Sysqembvtrj.exe 1768 Sysqemnblzr.exe 4632 Sysqemdjfrs.exe 2228 Sysqemiwamx.exe 3888 Sysqemssccq.exe 4316 Sysqemvufac.exe 4376 Sysqemthbvt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtqqpt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvufac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsnnra.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemkmrul.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxeait.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemroqex.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlktve.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtwqqu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemayrzk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuyboa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmpblh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemggjov.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemniyym.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqempvcia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsffov.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemitjoa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwplqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqyivk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemztlpu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwevuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrdxfi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemaycvf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrlemj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemokaas.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjegvw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdqksk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemviwvx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemcsvyt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemeobdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemezoat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemosjbz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgvjxs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtunfn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemixahs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemusyvk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemcdrjs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemojgee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjeuzp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembubuc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemojiyn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembvtrj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemthbvt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhsckv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemoenyc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemodxhy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemddney.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsxrht.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwditq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembpslw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemswaqx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlqzrx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmvqph.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemryole.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuzgqp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjwbtt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhnuqk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemfpqrr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembptas.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwxbup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgtdrr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdgidb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemocvzs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemacfqm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjiipr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4216 wrote to memory of 5088 4216 3875b051a933ba13b19ca8883cd1c790_NEIKI.exe 83 PID 4216 wrote to memory of 5088 4216 3875b051a933ba13b19ca8883cd1c790_NEIKI.exe 83 PID 4216 wrote to memory of 5088 4216 3875b051a933ba13b19ca8883cd1c790_NEIKI.exe 83 PID 5088 wrote to memory of 1572 5088 Sysqemztepm.exe 85 PID 5088 wrote to memory of 1572 5088 Sysqemztepm.exe 85 PID 5088 wrote to memory of 1572 5088 Sysqemztepm.exe 85 PID 1572 wrote to memory of 4060 1572 Sysqemuhmeg.exe 86 PID 1572 wrote to memory of 4060 1572 Sysqemuhmeg.exe 86 PID 1572 wrote to memory of 4060 1572 Sysqemuhmeg.exe 86 PID 4060 wrote to memory of 3616 4060 Sysqemcwisk.exe 88 PID 4060 wrote to memory of 3616 4060 Sysqemcwisk.exe 88 PID 4060 wrote to memory of 3616 4060 Sysqemcwisk.exe 88 PID 3616 wrote to memory of 1948 3616 Sysqemgmffg.exe 89 PID 3616 wrote to memory of 1948 3616 Sysqemgmffg.exe 89 PID 3616 wrote to memory of 1948 3616 Sysqemgmffg.exe 89 PID 1948 wrote to memory of 2504 1948 Sysqemokaas.exe 91 PID 1948 wrote to memory of 2504 1948 Sysqemokaas.exe 91 PID 1948 wrote to memory of 2504 1948 Sysqemokaas.exe 91 PID 2504 wrote to memory of 4568 2504 Sysqemuljva.exe 92 PID 2504 wrote to memory of 4568 2504 Sysqemuljva.exe 92 PID 2504 wrote to memory of 4568 2504 Sysqemuljva.exe 92 PID 4568 wrote to memory of 4732 4568 Sysqembptas.exe 93 PID 4568 wrote to memory of 4732 4568 Sysqembptas.exe 93 PID 4568 wrote to memory of 4732 4568 Sysqembptas.exe 93 PID 4732 wrote to memory of 60 4732 Sysqemjegvw.exe 94 PID 4732 wrote to memory of 60 4732 Sysqemjegvw.exe 94 PID 4732 wrote to memory of 60 4732 Sysqemjegvw.exe 94 PID 60 wrote to memory of 1156 60 Sysqemoumnd.exe 95 PID 60 wrote to memory of 1156 60 Sysqemoumnd.exe 95 PID 60 wrote to memory of 1156 60 Sysqemoumnd.exe 95 PID 1156 wrote to memory of 1124 1156 Sysqemrnctq.exe 98 PID 1156 wrote to memory of 1124 1156 Sysqemrnctq.exe 98 PID 1156 wrote to memory of 1124 1156 Sysqemrnctq.exe 98 PID 1124 wrote to memory of 4516 1124 Sysqemryole.exe 99 PID 1124 wrote to memory of 4516 1124 Sysqemryole.exe 99 PID 1124 wrote to memory of 4516 1124 Sysqemryole.exe 99 PID 4516 wrote to memory of 3112 4516 Sysqemwditq.exe 100 PID 4516 wrote to memory of 3112 4516 Sysqemwditq.exe 100 PID 4516 wrote to memory of 3112 4516 Sysqemwditq.exe 100 PID 3112 wrote to memory of 1012 3112 Sysqemjmoeb.exe 102 PID 3112 wrote to memory of 1012 3112 Sysqemjmoeb.exe 102 PID 3112 wrote to memory of 1012 3112 Sysqemjmoeb.exe 102 PID 1012 wrote to memory of 4496 1012 Sysqemoziem.exe 104 PID 1012 wrote to memory of 4496 1012 Sysqemoziem.exe 104 PID 1012 wrote to memory of 4496 1012 Sysqemoziem.exe 104 PID 4496 wrote to memory of 3540 4496 Sysqemyymje.exe 127 PID 4496 wrote to memory of 3540 4496 Sysqemyymje.exe 127 PID 4496 wrote to memory of 3540 4496 Sysqemyymje.exe 127 PID 3540 wrote to memory of 2692 3540 Sysqemmismh.exe 106 PID 3540 wrote to memory of 2692 3540 Sysqemmismh.exe 106 PID 3540 wrote to memory of 2692 3540 Sysqemmismh.exe 106 PID 2692 wrote to memory of 4948 2692 Sysqemosjbz.exe 107 PID 2692 wrote to memory of 4948 2692 Sysqemosjbz.exe 107 PID 2692 wrote to memory of 4948 2692 Sysqemosjbz.exe 107 PID 4948 wrote to memory of 2824 4948 Sysqemtxorf.exe 108 PID 4948 wrote to memory of 2824 4948 Sysqemtxorf.exe 108 PID 4948 wrote to memory of 2824 4948 Sysqemtxorf.exe 108 PID 2824 wrote to memory of 1588 2824 Sysqemwevuu.exe 137 PID 2824 wrote to memory of 1588 2824 Sysqemwevuu.exe 137 PID 2824 wrote to memory of 1588 2824 Sysqemwevuu.exe 137 PID 1588 wrote to memory of 852 1588 Sysqemtqqpt.exe 112 PID 1588 wrote to memory of 852 1588 Sysqemtqqpt.exe 112 PID 1588 wrote to memory of 852 1588 Sysqemtqqpt.exe 112 PID 852 wrote to memory of 4716 852 Sysqembubuc.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\3875b051a933ba13b19ca8883cd1c790_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\3875b051a933ba13b19ca8883cd1c790_NEIKI.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\Sysqemztepm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemztepm.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuhmeg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuhmeg.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcwisk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcwisk.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgmffg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgmffg.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\Sysqemokaas.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemokaas.exe"6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuljva.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuljva.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\Sysqembptas.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembptas.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjegvw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjegvw.exe"9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\Sysqemoumnd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoumnd.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrnctq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrnctq.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\Sysqemryole.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemryole.exe"12⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwditq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwditq.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjmoeb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjmoeb.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\Sysqemoziem.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoziem.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyymje.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyymje.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmismh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmismh.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\Sysqemosjbz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemosjbz.exe"18⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtxorf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtxorf.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwevuu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwevuu.exe"20⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtqqpt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtqqpt.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\Sysqembubuc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembubuc.exe"22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgvjxs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgvjxs.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjcxai.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjcxai.exe"24⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtunfn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtunfn.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdtrdf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdtrdf.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrdxfi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrdxfi.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\Sysqembyyyq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembyyyq.exe"28⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrswyl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrswyl.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmjqti.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmjqti.exe"30⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwxrwk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwxrwk.exe"31⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmnmjc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmnmjc.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwxbup.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwxbup.exe"33⤵
- Executes dropped EXE
- Modifies registry class
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgtdrr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgtdrr.exe"34⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdqksk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdqksk.exe"35⤵
- Executes dropped EXE
- Modifies registry class
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtgxfc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtgxfc.exe"36⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdgidb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdgidb.exe"37⤵
- Executes dropped EXE
- Modifies registry class
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\Sysqembpslw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembpslw.exe"38⤵
- Executes dropped EXE
- Modifies registry class
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlktve.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlktve.exe"39⤵
- Executes dropped EXE
- Modifies registry class
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtshvq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtshvq.exe"40⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\Sysqemojiyn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemojiyn.exe"41⤵
- Executes dropped EXE
- Modifies registry class
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlohly.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlohly.exe"42⤵
- Checks computer location settings
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\Sysqemggjov.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemggjov.exe"43⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvgwow.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvgwow.exe"44⤵
- Checks computer location settings
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\Sysqemocvzs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemocvzs.exe"45⤵
- Executes dropped EXE
- Modifies registry class
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\Sysqemixahs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemixahs.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqyivk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqyivk.exe"47⤵
- Executes dropped EXE
- Modifies registry class
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtwqqu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtwqqu.exe"48⤵
- Executes dropped EXE
- Modifies registry class
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgrilt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgrilt.exe"49⤵
- Checks computer location settings
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjbjox.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjbjox.exe"50⤵
- Checks computer location settings
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdiawl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdiawl.exe"51⤵
- Checks computer location settings
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\Sysqembficq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembficq.exe"52⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlqzrx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlqzrx.exe"53⤵
- Executes dropped EXE
- Modifies registry class
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\Sysqemayrzk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemayrzk.exe"54⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\Sysqemscfkm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemscfkm.exe"55⤵
- Checks computer location settings
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\Sysqemacfqm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemacfqm.exe"56⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\Sysqemniyym.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemniyym.exe"57⤵
- Executes dropped EXE
- Modifies registry class
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvmjqp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvmjqp.exe"58⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\Sysqembvtrj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembvtrj.exe"59⤵
- Executes dropped EXE
- Modifies registry class
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnblzr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnblzr.exe"60⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdjfrs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdjfrs.exe"61⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\Sysqemiwamx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiwamx.exe"62⤵
- Checks computer location settings
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\Sysqemssccq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemssccq.exe"63⤵
- Checks computer location settings
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvufac.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvufac.exe"64⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\Sysqemthbvt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemthbvt.exe"65⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\Sysqemipvnb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemipvnb.exe"66⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\Sysqemswaqx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemswaqx.exe"67⤵
- Checks computer location settings
- Modifies registry class
PID:964 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqiwlo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqiwlo.exe"68⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\Sysqemvvqys.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvvqys.exe"69⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\Sysqemddney.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemddney.exe"70⤵
- Checks computer location settings
- Modifies registry class
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\Sysqemifuzv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemifuzv.exe"71⤵
- Checks computer location settings
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcwwct.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcwwct.exe"72⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\Sysqemfopxw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfopxw.exe"73⤵
- Checks computer location settings
PID:756 -
C:\Users\Admin\AppData\Local\Temp\Sysqempvcia.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempvcia.exe"74⤵
- Modifies registry class
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\Sysqemviwvx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemviwvx.exe"75⤵
- Checks computer location settings
- Modifies registry class
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaycvf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaycvf.exe"76⤵
- Checks computer location settings
- Modifies registry class
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsffov.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsffov.exe"77⤵
- Modifies registry class
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvbrwc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvbrwc.exe"78⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\Sysqemsnnra.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsnnra.exe"79⤵
- Checks computer location settings
- Modifies registry class
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxwvmj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxwvmj.exe"80⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\Sysqemfljzu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfljzu.exe"81⤵
- Checks computer location settings
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkmrul.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkmrul.exe"82⤵
- Modifies registry class
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvisns.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvisns.exe"83⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\Sysqemcqofn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcqofn.exe"84⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqlyae.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqlyae.exe"85⤵
- Checks computer location settings
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkjodz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkjodz.exe"86⤵
- Checks computer location settings
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnmral.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnmral.exe"87⤵
- Checks computer location settings
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfmcyk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfmcyk.exe"88⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\Sysqemazlof.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemazlof.exe"89⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\Sysqemitjoa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemitjoa.exe"90⤵
- Checks computer location settings
- Modifies registry class
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuyboa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuyboa.exe"91⤵
- Modifies registry class
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnubhw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnubhw.exe"92⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\Sysqemfmmfv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfmmfv.exe"93⤵
- Checks computer location settings
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\Sysqemslinp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemslinp.exe"94⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\Sysqemcsvyt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcsvyt.exe"95⤵
- Modifies registry class
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\Sysqemusyvk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemusyvk.exe"96⤵
- Checks computer location settings
- Modifies registry class
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhunqp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhunqp.exe"97⤵
- Checks computer location settings
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuzgqp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuzgqp.exe"98⤵
- Checks computer location settings
- Modifies registry class
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcdrjs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcdrjs.exe"99⤵
- Checks computer location settings
- Modifies registry class
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\Sysqemezvzz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemezvzz.exe"100⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\Sysqemsxrht.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsxrht.exe"101⤵
- Modifies registry class
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmvqph.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmvqph.exe"102⤵
- Modifies registry class
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\Sysqempnjsl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempnjsl.exe"103⤵
- Checks computer location settings
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhnuqk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhnuqk.exe"104⤵
- Checks computer location settings
- Modifies registry class
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmpblh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmpblh.exe"105⤵
- Checks computer location settings
- Modifies registry class
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrqklj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrqklj.exe"106⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\Sysqemphdtx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemphdtx.exe"107⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\Sysqemkcibx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkcibx.exe"108⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\Sysqemfpqrr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfpqrr.exe"109⤵
- Modifies registry class
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhdchy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhdchy.exe"110⤵
- Checks computer location settings
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxeait.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxeait.exe"111⤵
- Checks computer location settings
- Modifies registry class
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhsckv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhsckv.exe"112⤵
- Checks computer location settings
- Modifies registry class
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwplqt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwplqt.exe"113⤵
- Modifies registry class
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcvjls.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcvjls.exe"114⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\Sysqemoenyc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoenyc.exe"115⤵
- Modifies registry class
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\Sysqembgutz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembgutz.exe"116⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\Sysqemucumw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemucumw.exe"117⤵
- Checks computer location settings
PID:864 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrlemj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrlemj.exe"118⤵
- Modifies registry class
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\Sysqemroqex.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemroqex.exe"119⤵
- Checks computer location settings
- Modifies registry class
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjsnpz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjsnpz.exe"120⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\Sysqemztlpu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemztlpu.exe"121⤵
- Modifies registry class
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzmlvv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzmlvv.exe"122⤵PID:5004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-