Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 00:26
Behavioral task
behavioral1
Sample
2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe
-
Size
140KB
-
MD5
2cb051f81a9bc15b04f62586dfc80fa0
-
SHA1
b52f28cea253d72875161739f237a6f330d3a4f9
-
SHA256
d3b3cb4313a39c34e7ee7ec73681322bd82f18cab50a171adee5ee3f9afe48c0
-
SHA512
d82d8b5749c3c5e22db76ff74fac55c1fbf4d4bd7fed09f3b6d3c7e05f357e25fe93b868dd2918cfcd6d1b9c865949a49d40b1f8df90b2492eefc0d3a50317b5
-
SSDEEP
1536:AYjIyeC1eUfKjkhBYJ7mTCbqODiC1ZsyHZK0FjlqsS5eHyG9LU3YG8nk8QHNugp5:ZdEUfKj8BYbDiC1ZTK7sxtLUIGukugyM
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemmrkxk.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemkbuws.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemwbtac.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemenaaw.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemnizdy.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemycizy.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemklicl.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemxjjcx.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemguitu.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemsgkql.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemqvyyc.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemiactl.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemkolww.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemiyfue.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemncqby.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemdvzyh.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemgdhzn.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemmxtuq.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemydlcx.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemqznqr.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemdxtxt.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemtxzie.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemuukll.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemgcyew.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemywdyd.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemjfzma.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemohhhr.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemgefho.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemjtyhb.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemhiycg.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemfgyvc.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemvahyw.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemxkkzg.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemsefla.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemsxrht.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemzcyyo.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemahzvh.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemvsxsa.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemfoaiw.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqembqcgu.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemmbpls.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemrpkjo.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemsspok.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemwnvwc.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemnedmc.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemsujnk.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemahemq.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemqmnpk.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemssgpk.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemnrkyv.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemmnhev.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemaynze.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqempkvxf.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemraenv.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemtaapb.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemfevvo.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemphdtx.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemtxqzu.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemdqqwd.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemvrnmq.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemsvbbn.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemqwthc.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemgcnyb.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqembmldg.exe -
Executes dropped EXE 64 IoCs
pid Process 1020 Sysqembptas.exe 3900 Sysqemzydif.exe 1932 Sysqembhvyx.exe 2652 Sysqemgfanl.exe 812 Sysqemqfdlk.exe 1236 Sysqemzcyyo.exe 4316 Sysqemyjoef.exe 752 Sysqembqcgu.exe 2604 Sysqemgzljl.exe 3988 Sysqemjfzma.exe 3632 Sysqemohhhr.exe 4004 Sysqemycizy.exe 4620 Sysqemgdhzn.exe 2636 Sysqemmxtuq.exe 4728 Sysqemydlcx.exe 1608 Sysqemmbpls.exe 2792 Sysqemqvyyc.exe 4328 Sysqemtnzbg.exe 4280 Sysqemzlfof.exe 4592 Sysqemgefho.exe 2180 Sysqemyeqef.exe 2908 Sysqemeboae.exe 1516 Sysqemmrkxk.exe 1764 Sysqemdkuvp.exe 2936 Sysqemgcnyb.exe 2636 Sysqemiactl.exe 836 Sysqemwnvwc.exe 2272 Sysqemieyjf.exe 3944 Sysqemqmnpk.exe 2240 Sysqemjtyhb.exe 3044 Sysqemibxxm.exe 868 Sysqembmldg.exe 3764 Sysqemyjtik.exe 2604 Sysqemfctbt.exe 1392 Sysqemqyvzu.exe 1152 Sysqemggqwg.exe 3760 Sysqemvplxh.exe 1984 Sysqemqvsni.exe 4916 Sysqemqznqr.exe 1892 Sysqemnizdy.exe 840 Sysqemfxago.exe 2624 Sysqemfxkeu.exe 4176 Sysqemnfgjz.exe 408 Sysqemyxxuy.exe 4220 Sysqemxevkj.exe 2232 Sysqemahzvh.exe 3988 Sysqemncqby.exe 3524 Sysqemkolww.exe 4832 Sysqemvrnmq.exe 4380 Sysqemiyfue.exe 1516 Sysqemklicl.exe 1592 Sysqemaqspj.exe 1648 Sysqemvsxsa.exe 3756 Sysqemfgyvc.exe 3552 Sysqemfoaiw.exe 2148 Sysqemkbuws.exe 3892 Sysqemvahyw.exe 4716 Sysqemaynze.exe 2016 Sysqemxkkzg.exe 3860 Sysqempkvxf.exe 1284 Sysqempdxvs.exe 3620 Sysqemfevvo.exe 2524 Sysqemsgkql.exe 1368 Sysqemsvbbn.exe -
resource yara_rule behavioral2/memory/4176-0-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0007000000023406-6.dat upx behavioral2/memory/1020-42-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0008000000023405-41.dat upx behavioral2/files/0x0007000000023407-72.dat upx behavioral2/files/0x0007000000023408-107.dat upx behavioral2/files/0x00090000000233ff-142.dat upx behavioral2/files/0x0008000000023409-177.dat upx behavioral2/files/0x000300000001e323-212.dat upx behavioral2/memory/4176-219-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0009000000023379-249.dat upx behavioral2/memory/1020-252-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0009000000023382-286.dat upx behavioral2/memory/752-288-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/3900-294-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0008000000023395-324.dat upx behavioral2/memory/1932-355-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x000b000000023377-361.dat upx behavioral2/memory/2652-391-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0006000000022ac0-397.dat upx behavioral2/files/0x000a000000023378-432.dat upx behavioral2/memory/812-439-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x000a000000023391-469.dat upx behavioral2/memory/1236-472-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/4316-502-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0009000000023392-508.dat upx behavioral2/memory/2636-510-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/752-540-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/2604-542-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0009000000023394-549.dat upx behavioral2/memory/3988-555-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/3632-582-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0008000000023397-588.dat upx behavioral2/memory/4004-591-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/4620-621-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x0008000000023398-628.dat upx behavioral2/memory/2636-658-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/files/0x000900000002340b-664.dat upx behavioral2/memory/4728-694-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/4280-700-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/1608-734-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/2792-767-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/4328-798-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/4280-830-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/4592-864-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/2180-898-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/2908-932-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/1516-971-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/1764-1005-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/2936-1042-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/2636-1069-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/836-1110-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/2272-1136-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/3944-1170-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/2240-1203-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/3044-1237-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/868-1271-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/3764-1305-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/2604-1339-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/1392-1373-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/1152-1407-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/1892-1413-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/3760-1419-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/840-1448-0x0000000000400000-0x000000000049C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyxxuy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvahyw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjsdop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxjjcx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmnrvw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdqqwd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemydlcx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqmnpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsgkql.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjecip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrxvxk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtxzie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgfanl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmbpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgcnyb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemkhixl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsefla.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuuyhb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemylerp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembptas.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsjvgs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuukll.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdvzyh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembpdqr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzcyyo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemycizy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemieyjf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemkolww.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsvbbn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtxqzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqfdlk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyjoef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemfrktd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemfasuz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemfctbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqznqr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembecsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvrnmq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjelme.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemibnmf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvldqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtnzbg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyjtik.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemklicl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhiycg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuaegq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwbtac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemkxmyo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdtbte.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmxtuq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgefho.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemnfgjz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqempafmg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmnhev.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqlxve.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtaapb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemnedmc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemnizdy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemffdwf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmrkxk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemiyfue.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsxrht.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlauuq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemggqwg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4176 wrote to memory of 1020 4176 2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe 83 PID 4176 wrote to memory of 1020 4176 2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe 83 PID 4176 wrote to memory of 1020 4176 2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe 83 PID 1020 wrote to memory of 3900 1020 Sysqembptas.exe 86 PID 1020 wrote to memory of 3900 1020 Sysqembptas.exe 86 PID 1020 wrote to memory of 3900 1020 Sysqembptas.exe 86 PID 3900 wrote to memory of 1932 3900 Sysqemzydif.exe 87 PID 3900 wrote to memory of 1932 3900 Sysqemzydif.exe 87 PID 3900 wrote to memory of 1932 3900 Sysqemzydif.exe 87 PID 1932 wrote to memory of 2652 1932 Sysqembhvyx.exe 88 PID 1932 wrote to memory of 2652 1932 Sysqembhvyx.exe 88 PID 1932 wrote to memory of 2652 1932 Sysqembhvyx.exe 88 PID 2652 wrote to memory of 812 2652 Sysqemgfanl.exe 89 PID 2652 wrote to memory of 812 2652 Sysqemgfanl.exe 89 PID 2652 wrote to memory of 812 2652 Sysqemgfanl.exe 89 PID 812 wrote to memory of 1236 812 Sysqemqfdlk.exe 91 PID 812 wrote to memory of 1236 812 Sysqemqfdlk.exe 91 PID 812 wrote to memory of 1236 812 Sysqemqfdlk.exe 91 PID 1236 wrote to memory of 4316 1236 Sysqemzcyyo.exe 93 PID 1236 wrote to memory of 4316 1236 Sysqemzcyyo.exe 93 PID 1236 wrote to memory of 4316 1236 Sysqemzcyyo.exe 93 PID 4316 wrote to memory of 752 4316 Sysqemyjoef.exe 94 PID 4316 wrote to memory of 752 4316 Sysqemyjoef.exe 94 PID 4316 wrote to memory of 752 4316 Sysqemyjoef.exe 94 PID 752 wrote to memory of 2604 752 Sysqembqcgu.exe 96 PID 752 wrote to memory of 2604 752 Sysqembqcgu.exe 96 PID 752 wrote to memory of 2604 752 Sysqembqcgu.exe 96 PID 2604 wrote to memory of 3988 2604 Sysqemgzljl.exe 97 PID 2604 wrote to memory of 3988 2604 Sysqemgzljl.exe 97 PID 2604 wrote to memory of 3988 2604 Sysqemgzljl.exe 97 PID 3988 wrote to memory of 3632 3988 Sysqemjfzma.exe 98 PID 3988 wrote to memory of 3632 3988 Sysqemjfzma.exe 98 PID 3988 wrote to memory of 3632 3988 Sysqemjfzma.exe 98 PID 3632 wrote to memory of 4004 3632 Sysqemohhhr.exe 99 PID 3632 wrote to memory of 4004 3632 Sysqemohhhr.exe 99 PID 3632 wrote to memory of 4004 3632 Sysqemohhhr.exe 99 PID 4004 wrote to memory of 4620 4004 Sysqemycizy.exe 100 PID 4004 wrote to memory of 4620 4004 Sysqemycizy.exe 100 PID 4004 wrote to memory of 4620 4004 Sysqemycizy.exe 100 PID 4620 wrote to memory of 2636 4620 Sysqemgdhzn.exe 113 PID 4620 wrote to memory of 2636 4620 Sysqemgdhzn.exe 113 PID 4620 wrote to memory of 2636 4620 Sysqemgdhzn.exe 113 PID 2636 wrote to memory of 4728 2636 Sysqemmxtuq.exe 102 PID 2636 wrote to memory of 4728 2636 Sysqemmxtuq.exe 102 PID 2636 wrote to memory of 4728 2636 Sysqemmxtuq.exe 102 PID 4728 wrote to memory of 1608 4728 Sysqemydlcx.exe 103 PID 4728 wrote to memory of 1608 4728 Sysqemydlcx.exe 103 PID 4728 wrote to memory of 1608 4728 Sysqemydlcx.exe 103 PID 1608 wrote to memory of 2792 1608 Sysqemmbpls.exe 104 PID 1608 wrote to memory of 2792 1608 Sysqemmbpls.exe 104 PID 1608 wrote to memory of 2792 1608 Sysqemmbpls.exe 104 PID 2792 wrote to memory of 4328 2792 Sysqemqvyyc.exe 105 PID 2792 wrote to memory of 4328 2792 Sysqemqvyyc.exe 105 PID 2792 wrote to memory of 4328 2792 Sysqemqvyyc.exe 105 PID 4328 wrote to memory of 4280 4328 Sysqemtnzbg.exe 106 PID 4328 wrote to memory of 4280 4328 Sysqemtnzbg.exe 106 PID 4328 wrote to memory of 4280 4328 Sysqemtnzbg.exe 106 PID 4280 wrote to memory of 4592 4280 Sysqemzlfof.exe 107 PID 4280 wrote to memory of 4592 4280 Sysqemzlfof.exe 107 PID 4280 wrote to memory of 4592 4280 Sysqemzlfof.exe 107 PID 4592 wrote to memory of 2180 4592 Sysqemgefho.exe 108 PID 4592 wrote to memory of 2180 4592 Sysqemgefho.exe 108 PID 4592 wrote to memory of 2180 4592 Sysqemgefho.exe 108 PID 2180 wrote to memory of 2908 2180 Sysqemyeqef.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2cb051f81a9bc15b04f62586dfc80fa0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\Sysqembptas.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembptas.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzydif.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzydif.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\Sysqembhvyx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembhvyx.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgfanl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgfanl.exe"5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqfdlk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqfdlk.exe"6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzcyyo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzcyyo.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyjoef.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyjoef.exe"8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\Sysqembqcgu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembqcgu.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgzljl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgzljl.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjfzma.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjfzma.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\Sysqemohhhr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemohhhr.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\Sysqemycizy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemycizy.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgdhzn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgdhzn.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmxtuq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmxtuq.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\Sysqemydlcx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemydlcx.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmbpls.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmbpls.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqvyyc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqvyyc.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtnzbg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtnzbg.exe"19⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzlfof.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzlfof.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgefho.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgefho.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyeqef.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyeqef.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeboae.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeboae.exe"23⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmrkxk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmrkxk.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdkuvp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdkuvp.exe"25⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgcnyb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgcnyb.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\Sysqemiactl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiactl.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwnvwc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwnvwc.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\Sysqemieyjf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemieyjf.exe"29⤵
- Executes dropped EXE
- Modifies registry class
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqmnpk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqmnpk.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjtyhb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjtyhb.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\Sysqemibxxm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemibxxm.exe"32⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\Sysqembmldg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembmldg.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyjtik.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyjtik.exe"34⤵
- Executes dropped EXE
- Modifies registry class
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfctbt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfctbt.exe"35⤵
- Executes dropped EXE
- Modifies registry class
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqyvzu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqyvzu.exe"36⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\Sysqemggqwg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemggqwg.exe"37⤵
- Executes dropped EXE
- Modifies registry class
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvplxh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvplxh.exe"38⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqvsni.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqvsni.exe"39⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqznqr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqznqr.exe"40⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnizdy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnizdy.exe"41⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfxago.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfxago.exe"42⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfxkeu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfxkeu.exe"43⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnfgjz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnfgjz.exe"44⤵
- Executes dropped EXE
- Modifies registry class
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyxxuy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyxxuy.exe"45⤵
- Executes dropped EXE
- Modifies registry class
PID:408 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxevkj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxevkj.exe"46⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\Sysqemahzvh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemahzvh.exe"47⤵
- Checks computer location settings
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\Sysqemncqby.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemncqby.exe"48⤵
- Checks computer location settings
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkolww.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkolww.exe"49⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvrnmq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvrnmq.exe"50⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\Sysqemiyfue.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiyfue.exe"51⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\Sysqemklicl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemklicl.exe"52⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaqspj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaqspj.exe"53⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvsxsa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvsxsa.exe"54⤵
- Checks computer location settings
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfgyvc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfgyvc.exe"55⤵
- Checks computer location settings
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfoaiw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfoaiw.exe"56⤵
- Checks computer location settings
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkbuws.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkbuws.exe"57⤵
- Checks computer location settings
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvahyw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvahyw.exe"58⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaynze.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaynze.exe"59⤵
- Checks computer location settings
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxkkzg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxkkzg.exe"60⤵
- Checks computer location settings
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\Sysqempkvxf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempkvxf.exe"61⤵
- Checks computer location settings
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\Sysqempdxvs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempdxvs.exe"62⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfevvo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfevvo.exe"63⤵
- Checks computer location settings
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsgkql.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsgkql.exe"64⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsvbbn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsvbbn.exe"65⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\Sysqemffdwf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemffdwf.exe"66⤵
- Modifies registry class
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\Sysqempafmg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempafmg.exe"67⤵
- Modifies registry class
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\Sysqemssgpk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemssgpk.exe"68⤵
- Checks computer location settings
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\Sysqemraenv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemraenv.exe"69⤵
- Checks computer location settings
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkhixl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkhixl.exe"70⤵
- Modifies registry class
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfrktd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfrktd.exe"71⤵
- Modifies registry class
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnrkyv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnrkyv.exe"72⤵
- Checks computer location settings
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsefla.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsefla.exe"73⤵
- Checks computer location settings
- Modifies registry class
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsxpjn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsxpjn.exe"74⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\Sysqemsxrht.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsxrht.exe"75⤵
- Checks computer location settings
- Modifies registry class
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkxdse.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkxdse.exe"76⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjecip.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjecip.exe"77⤵
- Modifies registry class
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuaegq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuaegq.exe"78⤵
- Modifies registry class
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsjvgs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsjvgs.exe"79⤵
- Modifies registry class
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\Sysqemphdtx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemphdtx.exe"80⤵
- Checks computer location settings
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuuyhb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuuyhb.exe"81⤵
- Modifies registry class
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\Sysqemewoxi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemewoxi.exe"82⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmjzpd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmjzpd.exe"83⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmemau.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmemau.exe"84⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\Sysqemuukll.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuukll.exe"85⤵
- Checks computer location settings
- Modifies registry class
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzhfyq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzhfyq.exe"86⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjsdop.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjsdop.exe"87⤵
- Modifies registry class
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmnhev.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmnhev.exe"88⤵
- Checks computer location settings
- Modifies registry class
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxjjcx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxjjcx.exe"89⤵
- Checks computer location settings
- Modifies registry class
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwbtac.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwbtac.exe"90⤵
- Checks computer location settings
- Modifies registry class
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhiycg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhiycg.exe"91⤵
- Checks computer location settings
- Modifies registry class
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\Sysqembecsn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembecsn.exe"92⤵
- Modifies registry class
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\Sysqemguitu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemguitu.exe"93⤵
- Checks computer location settings
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrpkjo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrpkjo.exe"94⤵
- Checks computer location settings
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjelme.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjelme.exe"95⤵
- Modifies registry class
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrftze.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrftze.exe"96⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\Sysqemrxvxk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrxvxk.exe"97⤵
- Modifies registry class
PID:220 -
C:\Users\Admin\AppData\Local\Temp\Sysqemezksh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemezksh.exe"98⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\Sysqembiusc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembiusc.exe"99⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjyrya.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjyrya.exe"100⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\Sysqemoralk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoralk.exe"101⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\Sysqemwsarl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwsarl.exe"102⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\Sysqemlbujl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlbujl.exe"103⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmmipt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmmipt.exe"104⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\Sysqemtxqzu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtxqzu.exe"105⤵
- Checks computer location settings
- Modifies registry class
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdxtxt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdxtxt.exe"106⤵
- Checks computer location settings
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlytct.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlytct.exe"107⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmnrvw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmnrvw.exe"108⤵
- Modifies registry class
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqlxve.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqlxve.exe"109⤵
- Modifies registry class
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdqqwd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdqqwd.exe"110⤵
- Checks computer location settings
- Modifies registry class
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\Sysqemylerp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemylerp.exe"111⤵
- Modifies registry class
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqwthc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqwthc.exe"112⤵
- Checks computer location settings
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\Sysqemojqhm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemojqhm.exe"113⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\Sysqemenaaw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemenaaw.exe"114⤵
- Checks computer location settings
PID:972 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdvzyh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdvzyh.exe"115⤵
- Checks computer location settings
- Modifies registry class
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\Sysqembpdqr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembpdqr.exe"116⤵
- Modifies registry class
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgcyew.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgcyew.exe"117⤵
- Checks computer location settings
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlauuq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlauuq.exe"118⤵
- Modifies registry class
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\Sysqemibnmf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemibnmf.exe"119⤵
- Modifies registry class
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtaapb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtaapb.exe"120⤵
- Checks computer location settings
- Modifies registry class
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtxzie.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtxzie.exe"121⤵
- Checks computer location settings
- Modifies registry class
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvldqt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvldqt.exe"122⤵
- Modifies registry class
PID:4288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-