Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
55s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 00:26
Behavioral task
behavioral1
Sample
2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe
-
Size
140KB
-
MD5
2cb051f81a9bc15b04f62586dfc80fa0
-
SHA1
b52f28cea253d72875161739f237a6f330d3a4f9
-
SHA256
d3b3cb4313a39c34e7ee7ec73681322bd82f18cab50a171adee5ee3f9afe48c0
-
SHA512
d82d8b5749c3c5e22db76ff74fac55c1fbf4d4bd7fed09f3b6d3c7e05f357e25fe93b868dd2918cfcd6d1b9c865949a49d40b1f8df90b2492eefc0d3a50317b5
-
SSDEEP
1536:AYjIyeC1eUfKjkhBYJ7mTCbqODiC1ZsyHZK0FjlqsS5eHyG9LU3YG8nk8QHNugp5:ZdEUfKj8BYbDiC1ZTK7sxtLUIGukugyM
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3036 Sysqemfisqv.exe 2704 Sysqemhditk.exe 1372 Sysqemuqaiq.exe 2840 Sysqemghdds.exe 280 Sysqemtbjlm.exe 1224 Sysqemqcuyi.exe 1464 Sysqemdbobq.exe 2572 Sysqemcxjyn.exe 1432 Sysqempvdbe.exe 1016 Sysqemmlkbx.exe 772 Sysqembehwg.exe 1780 Sysqemtlhll.exe 1948 Sysqemjbsts.exe 3004 Sysqemynqzv.exe 380 Sysqemkhwoh.exe 2772 Sysqempxbbd.exe 2612 Sysqemcwvel.exe 1616 Sysqemrpszv.exe 2492 Sysqemmrwwt.exe 2980 Sysqemzlcee.exe 1736 Sysqemribjp.exe 1416 Sysqemgebrb.exe 1496 Sysqembducx.exe 2860 Sysqemqenpm.exe 1324 Sysqemiothu.exe 1052 Sysqemazgzc.exe 2920 Sysqemqwozg.exe 2004 Sysqemlvhrj.exe 340 Sysqemasprw.exe 752 Sysqempppri.exe 1432 Sysqemknicd.exe 2908 Sysqemxtzer.exe 3008 Sysqemmmwrb.exe 1256 Sysqemftyxg.exe 3052 Sysqemwlipt.exe 2024 Sysqemoazuw.exe 1224 Sysqemhkmme.exe 2240 Sysqemzhlro.exe 1624 Sysqemtjhpm.exe 2672 Sysqemollmk.exe 2292 Sysqemgzksv.exe 2716 Sysqemyoaxg.exe 784 Sysqemtyeue.exe 2036 Sysqemlmdao.exe 1376 Sysqemgskkp.exe 2980 Sysqemygjpa.exe 1752 Sysqemtqfny.exe 2188 Sysqemirzan.exe 2596 Sysqemdtdxt.exe 2620 Sysqemyvzvr.exe 2856 Sysqempvjfe.exe 2368 Sysqemfofao.exe 2928 Sysqemarcxm.exe 1780 Sysqemsfacx.exe 996 Sysqemnheau.exe 1632 Sysqemfvvff.exe 1836 Sysqemuadfs.exe 380 Sysqemmoukc.exe 1988 Sysqemhryia.exe 1628 Sysqemzfxnl.exe 2680 Sysqemrtnsn.exe 1216 Sysqemmdrqt.exe 2028 Sysqemyjhsu.exe 2640 Sysqemtldqa.exe -
Loads dropped DLL 64 IoCs
pid Process 2292 2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe 2292 2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe 3036 Sysqemfisqv.exe 3036 Sysqemfisqv.exe 2704 Sysqemhditk.exe 2704 Sysqemhditk.exe 1372 Sysqemuqaiq.exe 1372 Sysqemuqaiq.exe 2840 Sysqemghdds.exe 2840 Sysqemghdds.exe 280 Sysqemtbjlm.exe 280 Sysqemtbjlm.exe 1224 Sysqemqcuyi.exe 1224 Sysqemqcuyi.exe 1464 Sysqemdbobq.exe 1464 Sysqemdbobq.exe 2572 Sysqemcxjyn.exe 2572 Sysqemcxjyn.exe 1432 Sysqempvdbe.exe 1432 Sysqempvdbe.exe 1016 Sysqemmlkbx.exe 1016 Sysqemmlkbx.exe 772 Sysqembehwg.exe 772 Sysqembehwg.exe 1780 Sysqemtlhll.exe 1780 Sysqemtlhll.exe 1948 Sysqemjbsts.exe 1948 Sysqemjbsts.exe 3004 Sysqemynqzv.exe 3004 Sysqemynqzv.exe 380 Sysqemkhwoh.exe 380 Sysqemkhwoh.exe 2772 Sysqempxbbd.exe 2772 Sysqempxbbd.exe 2612 Sysqemcwvel.exe 2612 Sysqemcwvel.exe 1616 Sysqemrpszv.exe 1616 Sysqemrpszv.exe 2492 Sysqemmrwwt.exe 2492 Sysqemmrwwt.exe 2980 Sysqemzlcee.exe 2980 Sysqemzlcee.exe 1736 Sysqemribjp.exe 1736 Sysqemribjp.exe 1416 Sysqemgebrb.exe 1416 Sysqemgebrb.exe 1496 Sysqembducx.exe 1496 Sysqembducx.exe 2860 Sysqemqenpm.exe 2860 Sysqemqenpm.exe 1324 Sysqemiothu.exe 1324 Sysqemiothu.exe 1052 Sysqemazgzc.exe 1052 Sysqemazgzc.exe 2920 Sysqemqwozg.exe 2920 Sysqemqwozg.exe 2004 Sysqemlvhrj.exe 2004 Sysqemlvhrj.exe 340 Sysqemasprw.exe 340 Sysqemasprw.exe 752 Sysqempppri.exe 752 Sysqempppri.exe 1432 Sysqemknicd.exe 1432 Sysqemknicd.exe -
resource yara_rule behavioral1/memory/2292-0-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/files/0x00070000000153cf-6.dat upx behavioral1/memory/3036-21-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/files/0x0032000000014e5a-19.dat upx behavioral1/files/0x00070000000155e3-23.dat upx behavioral1/memory/2704-30-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/files/0x0007000000015642-37.dat upx behavioral1/memory/1372-45-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/files/0x0032000000015023-52.dat upx behavioral1/memory/2840-59-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/files/0x0007000000015b13-66.dat upx behavioral1/memory/2292-72-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/280-74-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/files/0x0009000000015bb9-81.dat upx behavioral1/memory/1224-89-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/files/0x0007000000015cf7-96.dat upx behavioral1/memory/2704-104-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/1372-111-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/files/0x0006000000015d06-115.dat upx behavioral1/memory/2572-122-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/2840-126-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/files/0x0006000000015d5d-130.dat upx behavioral1/memory/2572-136-0x0000000003490000-0x000000000352C000-memory.dmp upx behavioral1/files/0x0006000000015d6e-145.dat upx behavioral1/memory/280-159-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/1016-158-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/files/0x0006000000015f1b-162.dat upx behavioral1/memory/1224-175-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/files/0x0006000000015f9e-185.dat upx behavioral1/memory/1948-201-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/1464-207-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/3004-211-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/2572-220-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/2772-234-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/1432-233-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/1016-249-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/2612-251-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/772-257-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/1780-273-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/2492-275-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/3004-288-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/2980-285-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/380-307-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/1496-323-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/1616-332-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/1324-347-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/1052-360-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/2920-371-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/1416-381-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/2004-382-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/340-395-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/752-408-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/1432-423-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/2860-411-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/996-935-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/1632-946-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/1836-953-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/380-962-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/1988-971-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/1628-980-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/2680-989-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/1216-998-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/2028-1001-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral1/memory/2772-317-0x0000000000400000-0x000000000049C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2292 wrote to memory of 3036 2292 2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe 28 PID 2292 wrote to memory of 3036 2292 2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe 28 PID 2292 wrote to memory of 3036 2292 2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe 28 PID 2292 wrote to memory of 3036 2292 2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe 28 PID 3036 wrote to memory of 2704 3036 Sysqemfisqv.exe 29 PID 3036 wrote to memory of 2704 3036 Sysqemfisqv.exe 29 PID 3036 wrote to memory of 2704 3036 Sysqemfisqv.exe 29 PID 3036 wrote to memory of 2704 3036 Sysqemfisqv.exe 29 PID 2704 wrote to memory of 1372 2704 Sysqemhditk.exe 30 PID 2704 wrote to memory of 1372 2704 Sysqemhditk.exe 30 PID 2704 wrote to memory of 1372 2704 Sysqemhditk.exe 30 PID 2704 wrote to memory of 1372 2704 Sysqemhditk.exe 30 PID 1372 wrote to memory of 2840 1372 Sysqemuqaiq.exe 31 PID 1372 wrote to memory of 2840 1372 Sysqemuqaiq.exe 31 PID 1372 wrote to memory of 2840 1372 Sysqemuqaiq.exe 31 PID 1372 wrote to memory of 2840 1372 Sysqemuqaiq.exe 31 PID 2840 wrote to memory of 280 2840 Sysqemghdds.exe 32 PID 2840 wrote to memory of 280 2840 Sysqemghdds.exe 32 PID 2840 wrote to memory of 280 2840 Sysqemghdds.exe 32 PID 2840 wrote to memory of 280 2840 Sysqemghdds.exe 32 PID 280 wrote to memory of 1224 280 Sysqemtbjlm.exe 33 PID 280 wrote to memory of 1224 280 Sysqemtbjlm.exe 33 PID 280 wrote to memory of 1224 280 Sysqemtbjlm.exe 33 PID 280 wrote to memory of 1224 280 Sysqemtbjlm.exe 33 PID 1224 wrote to memory of 1464 1224 Sysqemqcuyi.exe 34 PID 1224 wrote to memory of 1464 1224 Sysqemqcuyi.exe 34 PID 1224 wrote to memory of 1464 1224 Sysqemqcuyi.exe 34 PID 1224 wrote to memory of 1464 1224 Sysqemqcuyi.exe 34 PID 1464 wrote to memory of 2572 1464 Sysqemdbobq.exe 35 PID 1464 wrote to memory of 2572 1464 Sysqemdbobq.exe 35 PID 1464 wrote to memory of 2572 1464 Sysqemdbobq.exe 35 PID 1464 wrote to memory of 2572 1464 Sysqemdbobq.exe 35 PID 2572 wrote to memory of 1432 2572 Sysqemcxjyn.exe 58 PID 2572 wrote to memory of 1432 2572 Sysqemcxjyn.exe 58 PID 2572 wrote to memory of 1432 2572 Sysqemcxjyn.exe 58 PID 2572 wrote to memory of 1432 2572 Sysqemcxjyn.exe 58 PID 1432 wrote to memory of 1016 1432 Sysqempvdbe.exe 37 PID 1432 wrote to memory of 1016 1432 Sysqempvdbe.exe 37 PID 1432 wrote to memory of 1016 1432 Sysqempvdbe.exe 37 PID 1432 wrote to memory of 1016 1432 Sysqempvdbe.exe 37 PID 1016 wrote to memory of 772 1016 Sysqemmlkbx.exe 38 PID 1016 wrote to memory of 772 1016 Sysqemmlkbx.exe 38 PID 1016 wrote to memory of 772 1016 Sysqemmlkbx.exe 38 PID 1016 wrote to memory of 772 1016 Sysqemmlkbx.exe 38 PID 772 wrote to memory of 1780 772 Sysqembehwg.exe 81 PID 772 wrote to memory of 1780 772 Sysqembehwg.exe 81 PID 772 wrote to memory of 1780 772 Sysqembehwg.exe 81 PID 772 wrote to memory of 1780 772 Sysqembehwg.exe 81 PID 1780 wrote to memory of 1948 1780 Sysqemtlhll.exe 40 PID 1780 wrote to memory of 1948 1780 Sysqemtlhll.exe 40 PID 1780 wrote to memory of 1948 1780 Sysqemtlhll.exe 40 PID 1780 wrote to memory of 1948 1780 Sysqemtlhll.exe 40 PID 1948 wrote to memory of 3004 1948 Sysqemjbsts.exe 124 PID 1948 wrote to memory of 3004 1948 Sysqemjbsts.exe 124 PID 1948 wrote to memory of 3004 1948 Sysqemjbsts.exe 124 PID 1948 wrote to memory of 3004 1948 Sysqemjbsts.exe 124 PID 3004 wrote to memory of 380 3004 Sysqemynqzv.exe 167 PID 3004 wrote to memory of 380 3004 Sysqemynqzv.exe 167 PID 3004 wrote to memory of 380 3004 Sysqemynqzv.exe 167 PID 3004 wrote to memory of 380 3004 Sysqemynqzv.exe 167 PID 380 wrote to memory of 2772 380 Sysqemkhwoh.exe 43 PID 380 wrote to memory of 2772 380 Sysqemkhwoh.exe 43 PID 380 wrote to memory of 2772 380 Sysqemkhwoh.exe 43 PID 380 wrote to memory of 2772 380 Sysqemkhwoh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfisqv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfisqv.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhditk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhditk.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuqaiq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuqaiq.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\Sysqemghdds.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemghdds.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtbjlm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtbjlm.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:280 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqcuyi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqcuyi.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdbobq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdbobq.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcxjyn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcxjyn.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\Sysqempvdbe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempvdbe.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmlkbx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmlkbx.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\Sysqembehwg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembehwg.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtlhll.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtlhll.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjbsts.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjbsts.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\Sysqemynqzv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemynqzv.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkhwoh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkhwoh.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\Sysqempxbbd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempxbbd.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcwvel.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcwvel.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrpszv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrpszv.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmrwwt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmrwwt.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzlcee.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzlcee.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\Sysqemribjp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemribjp.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgebrb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgebrb.exe"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\Sysqembducx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembducx.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqenpm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqenpm.exe"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\Sysqemiothu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiothu.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\Sysqemazgzc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemazgzc.exe"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqwozg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqwozg.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlvhrj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlvhrj.exe"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\Sysqemasprw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemasprw.exe"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\Sysqempppri.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempppri.exe"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:752 -
C:\Users\Admin\AppData\Local\Temp\Sysqemknicd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemknicd.exe"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxtzer.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxtzer.exe"33⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmmwrb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmmwrb.exe"34⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\Sysqemftyxg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemftyxg.exe"35⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwlipt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwlipt.exe"36⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\Sysqemoazuw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoazuw.exe"37⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhkmme.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhkmme.exe"38⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzhlro.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzhlro.exe"39⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtjhpm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtjhpm.exe"40⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\Sysqemollmk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemollmk.exe"41⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgzksv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgzksv.exe"42⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyoaxg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyoaxg.exe"43⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtyeue.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtyeue.exe"44⤵
- Executes dropped EXE
PID:784 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlmdao.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlmdao.exe"45⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgskkp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgskkp.exe"46⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\Sysqemygjpa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemygjpa.exe"47⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtqfny.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtqfny.exe"48⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\Sysqemirzan.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemirzan.exe"49⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdtdxt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdtdxt.exe"50⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyvzvr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyvzvr.exe"51⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\Sysqempvjfe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempvjfe.exe"52⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfofao.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfofao.exe"53⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\Sysqemarcxm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemarcxm.exe"54⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsfacx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsfacx.exe"55⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnheau.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnheau.exe"56⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfvvff.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfvvff.exe"57⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuadfs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuadfs.exe"58⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmoukc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmoukc.exe"59⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhryia.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhryia.exe"60⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzfxnl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzfxnl.exe"61⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrtnsn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrtnsn.exe"62⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmdrqt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmdrqt.exe"63⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyjhsu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyjhsu.exe"64⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtldqa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtldqa.exe"65⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlacvd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlacvd.exe"66⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\Sysqemdzenq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdzenq.exe"67⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\Sysqemyywxl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyywxl.exe"68⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\Sysqemtemiu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtemiu.exe"69⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\Sysqemlscnf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlscnf.exe"70⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\Sysqemdsmfk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdsmfk.exe"71⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\Sysqemyrfqn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyrfqn.exe"72⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\Sysqemswnso.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemswnso.exe"73⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\Sysqemktlxz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemktlxz.exe"74⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\Sysqemcknqm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcknqm.exe"75⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\Sysqemxqvan.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxqvan.exe"76⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\Sysqemsazyl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsazyl.exe"77⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnddvr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnddvr.exe"78⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\Sysqemeuffe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeuffe.exe"79⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\Sysqemwrekh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwrekh.exe"80⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\Sysqempqgym.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempqgym.exe"81⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\Sysqemkenin.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkenin.exe"82⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\Sysqemcobav.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcobav.exe"83⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\Sysqemudzgf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemudzgf.exe"84⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\Sysqemlvbql.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlvbql.exe"85⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\Sysqemecddq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemecddq.exe"86⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\Sysqemzqtnq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzqtnq.exe"87⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqhvye.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqhvye.exe"88⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\Sysqemlkzvk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlkzvk.exe"89⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\Sysqemgmdti.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgmdti.exe"90⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\Sysqembzkdj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembzkdj.exe"91⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\Sysqemtrmvw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtrmvw.exe"92⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\Sysqemlolah.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlolah.exe"93⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\Sysqemgqpyf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgqpyf.exe"94⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\Sysqembslvl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembslvl.exe"95⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\Sysqemskvgq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemskvgq.exe"96⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\Sysqemkgmlb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkgmlb.exe"97⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\Sysqemfiqih.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfiqih.exe"98⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\Sysqemaofti.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaofti.exe"99⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\Sysqemscwys.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemscwys.exe"100⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnmavq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnmavq.exe"101⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\Sysqemeecoe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeecoe.exe"102⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\Sysqemzsrqe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzsrqe.exe"103⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\Sysqemuunok.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuunok.exe"104⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\Sysqempwsli.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempwsli.exe"105⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\Sysqemhlqqt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhlqqt.exe"106⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\Sysqemzzhvw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzzhvw.exe"107⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\Sysqemunwge.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemunwge.exe"108⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\Sysqemppadc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemppadc.exe"109⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\Sysqemhdrjn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhdrjn.exe"110⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\Sysqemydtba.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemydtba.exe"111⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\Sysqemucmlw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemucmlw.exe"112⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\Sysqemlqlrg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlqlrg.exe"113⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\Sysqemdejwj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdejwj.exe"114⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\Sysqemygftp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemygftp.exe"115⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqdeyz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqdeyz.exe"116⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\Sysqemiugjf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiugjf.exe"117⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\Sysqemdtzbi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdtzbi.exe"118⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\Sysqemvhyyl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvhyyl.exe"119⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnhaqy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnhaqy.exe"120⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\Sysqemijeow.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemijeow.exe"121⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\Sysqemayuth.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemayuth.exe"122⤵PID:2524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-