Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
86s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 09:51
Behavioral task
behavioral1
Sample
bc3f527fbf94f852e96037b2185eba80_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bc3f527fbf94f852e96037b2185eba80_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
bc3f527fbf94f852e96037b2185eba80_NeikiAnalytics.exe
-
Size
208KB
-
MD5
bc3f527fbf94f852e96037b2185eba80
-
SHA1
380001cf95693e5be9ee7619732b5d1d25d7c3a7
-
SHA256
ab180dcef26af7e4e2a4706d7aae506e4a15e79bc3dc59a7bd8c83d921b5d76f
-
SHA512
28a767cade8cefe5870255b23aae923720100df047e7d8199cbc8cfe53fb1571404584317f1ef15baef5eca59fd2b4a67f3e2664a947e7745b81202d130025d4
-
SSDEEP
3072:SdEUfKj8BYbDiC1ZTK7sxtLUIG5yyoDU9q3XRrMBEGltj95y6hsYDRdfA:SUSiZTK40sys
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqembhnpm.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemexzjk.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemnmxrf.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemakkfo.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemvbdwl.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemedysn.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemttidx.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemyllcb.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemidzrh.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemjpwuy.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemmcbcb.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemblkgo.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemuszxv.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemihqxr.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemvdfgd.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemaitzx.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemxmgqf.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemwgmom.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemsigqh.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemdmioa.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemumobq.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemuuzim.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemrigxo.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemguuim.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemlckfx.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqembavcb.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemyvgjh.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemizcyp.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemmzffb.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqembwxts.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemlvbog.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation bc3f527fbf94f852e96037b2185eba80_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemjkofy.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemytzrk.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemqmsbq.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemzkjsd.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemmbpls.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqembqhwe.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemajqbn.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemkhryw.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemhbnlm.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemencab.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemgrued.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemlukks.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemahoki.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemdajrk.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqempzfrk.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemjvobs.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemulzct.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemgtmvg.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemrdokp.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemzvcbm.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemuzcyk.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemrmcnq.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemteexe.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemwtndv.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqembuyhh.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemvbnxi.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqembmhdl.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemjgkfv.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqembgndu.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqempqcph.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemerluf.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemtryuz.exe -
Executes dropped EXE 64 IoCs
pid Process 6108 Sysqemeivmu.exe 2988 Sysqemzdiuu.exe 3096 Sysqemcdafe.exe 3348 Sysqemjkofy.exe 4632 Sysqemrzjsc.exe 3328 Sysqembhnpm.exe 3660 Sysqemencab.exe 5200 Sysqemrwade.exe 1472 Sysqemwbuly.exe 2636 Sysqemblkgo.exe 260 Sysqemmvzlt.exe 540 Sysqemuzcyk.exe 3332 Sysqemrtxla.exe 5948 Sysqemzitym.exe 5704 Sysqemhbszt.exe 372 Sysqembexot.exe 1752 Sysqemzqtcj.exe 2612 Sysqemhqrcy.exe 4024 Sysqemmsaxg.exe 5172 Sysqemuszxv.exe 2324 Sysqemerluf.exe 5464 Sysqemrigxo.exe 4904 Sysqembavcb.exe 1820 Sysqemedysn.exe 4448 Sysqemrmcnq.exe 6028 Sysqemjiuym.exe 4700 Sysqemttidx.exe 4108 Sysqemyjoef.exe 5180 Sysqemjqbgj.exe 3332 Sysqemjfzma.exe 3596 Sysqemteexe.exe 744 Sysqemlbehs.exe 3700 Sysqemyrzkb.exe 624 Sysqemtiany.exe 1972 Sysqemmbpls.exe 1380 Sysqemtfzyb.exe 3108 Sysqembkkqe.exe 1856 Sysqemwtndv.exe 1280 Sysqemtymzg.exe 4180 Sysqemexzjk.exe 3476 Sysqemtryuz.exe 3344 Sysqembdgni.exe 2280 Sysqembosfw.exe 2932 Sysqemihqxr.exe 5636 Sysqemwgmom.exe 5768 Sysqemdruyu.exe 5696 Sysqembaegi.exe 3944 Sysqemtapeh.exe 4860 Sysqemaezry.exe 5644 Sysqemqiaec.exe 3204 Sysqemgrued.exe 1796 Sysqemwghsv.exe 4372 Sysqemyclac.exe 4532 Sysqemjxnyv.exe 5728 Sysqemgyflz.exe 4636 Sysqemvdfgd.exe 408 Sysqemiflvo.exe 1896 Sysqemyjtik.exe 1956 Sysqemyvgjh.exe 3740 Sysqemqvjgy.exe 2832 Sysqemtqnom.exe 5032 Sysqembuyhh.exe 4036 Sysqemnlbkq.exe 3944 Sysqemdbmsx.exe -
resource yara_rule behavioral2/memory/4724-0-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/files/0x0007000000023403-6.dat upx behavioral2/memory/6108-37-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/files/0x0008000000023402-42.dat upx behavioral2/files/0x0007000000023405-72.dat upx behavioral2/memory/2988-74-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/files/0x0007000000023407-108.dat upx behavioral2/files/0x0008000000023400-143.dat upx behavioral2/files/0x0007000000023408-178.dat upx behavioral2/files/0x0007000000023409-213.dat upx behavioral2/files/0x000700000002340a-248.dat upx behavioral2/memory/3660-250-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/4724-280-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/files/0x000800000002292d-286.dat upx behavioral2/memory/6108-316-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/files/0x000800000002296e-322.dat upx behavioral2/memory/2988-353-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/files/0x000700000002340b-359.dat upx behavioral2/memory/2636-361-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/files/0x000700000002340f-395.dat upx behavioral2/memory/3096-396-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/3348-427-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/files/0x0007000000023410-433.dat upx behavioral2/memory/4632-464-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/files/0x0007000000023411-470.dat upx behavioral2/memory/3328-477-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/files/0x0007000000023412-507.dat upx behavioral2/memory/3660-514-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/5200-541-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/files/0x0007000000023413-547.dat upx behavioral2/memory/1472-578-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/2636-581-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/files/0x0007000000023414-586.dat upx behavioral2/memory/372-588-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/files/0x0008000000023415-622.dat upx behavioral2/memory/1752-624-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/260-653-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/files/0x000a000000023379-659.dat upx behavioral2/memory/540-690-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/3332-723-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/2324-764-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/5948-789-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/5704-827-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/372-857-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/1752-863-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/2612-893-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/4024-899-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/4448-904-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/5172-930-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/6028-937-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/5464-966-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/4904-976-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/1820-1010-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/6028-1101-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/744-1142-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/4700-1167-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/4108-1177-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/5180-1235-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/1972-1244-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/3332-1269-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/3596-1275-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/744-1305-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/3700-1339-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/624-1342-0x0000000000400000-0x000000000049A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmjzpd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyxfji.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemblkgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmvzlt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuzcyk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgyflz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemnlbkq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemkolzb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemoslok.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyiuks.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjqbgj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyfqpe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemaugfl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemerluf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwtndv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjxnyv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyvgjh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdbmsx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemiaxic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhbszt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuszxv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzclbn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjlade.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemobpzw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrtxla.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqiaec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmmauk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembwxts.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqvjgy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemizcyp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemidzrh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemywlho.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembosfw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemshzih.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrvjzr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyllcb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxmgqf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrwade.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtfzyb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemihqxr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyclac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgtmvg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemytzrk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvanuv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuuzim.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjvobs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlvbog.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemguuim.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjzink.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemksozo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjpwuy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrdokp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembavcb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemedysn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvdfgd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemaskdp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdajrk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwukrm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemiflvo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqkqka.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqempqcph.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrpkjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembgndu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjkofy.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4724 wrote to memory of 6108 4724 bc3f527fbf94f852e96037b2185eba80_NeikiAnalytics.exe 82 PID 4724 wrote to memory of 6108 4724 bc3f527fbf94f852e96037b2185eba80_NeikiAnalytics.exe 82 PID 4724 wrote to memory of 6108 4724 bc3f527fbf94f852e96037b2185eba80_NeikiAnalytics.exe 82 PID 6108 wrote to memory of 2988 6108 Sysqemeivmu.exe 83 PID 6108 wrote to memory of 2988 6108 Sysqemeivmu.exe 83 PID 6108 wrote to memory of 2988 6108 Sysqemeivmu.exe 83 PID 2988 wrote to memory of 3096 2988 Sysqemzdiuu.exe 85 PID 2988 wrote to memory of 3096 2988 Sysqemzdiuu.exe 85 PID 2988 wrote to memory of 3096 2988 Sysqemzdiuu.exe 85 PID 3096 wrote to memory of 3348 3096 Sysqemcdafe.exe 88 PID 3096 wrote to memory of 3348 3096 Sysqemcdafe.exe 88 PID 3096 wrote to memory of 3348 3096 Sysqemcdafe.exe 88 PID 3348 wrote to memory of 4632 3348 Sysqemjkofy.exe 89 PID 3348 wrote to memory of 4632 3348 Sysqemjkofy.exe 89 PID 3348 wrote to memory of 4632 3348 Sysqemjkofy.exe 89 PID 4632 wrote to memory of 3328 4632 Sysqemrzjsc.exe 90 PID 4632 wrote to memory of 3328 4632 Sysqemrzjsc.exe 90 PID 4632 wrote to memory of 3328 4632 Sysqemrzjsc.exe 90 PID 3328 wrote to memory of 3660 3328 Sysqembhnpm.exe 93 PID 3328 wrote to memory of 3660 3328 Sysqembhnpm.exe 93 PID 3328 wrote to memory of 3660 3328 Sysqembhnpm.exe 93 PID 3660 wrote to memory of 5200 3660 Sysqemencab.exe 94 PID 3660 wrote to memory of 5200 3660 Sysqemencab.exe 94 PID 3660 wrote to memory of 5200 3660 Sysqemencab.exe 94 PID 5200 wrote to memory of 1472 5200 Sysqemrwade.exe 95 PID 5200 wrote to memory of 1472 5200 Sysqemrwade.exe 95 PID 5200 wrote to memory of 1472 5200 Sysqemrwade.exe 95 PID 1472 wrote to memory of 2636 1472 Sysqemwbuly.exe 97 PID 1472 wrote to memory of 2636 1472 Sysqemwbuly.exe 97 PID 1472 wrote to memory of 2636 1472 Sysqemwbuly.exe 97 PID 2636 wrote to memory of 260 2636 Sysqemblkgo.exe 99 PID 2636 wrote to memory of 260 2636 Sysqemblkgo.exe 99 PID 2636 wrote to memory of 260 2636 Sysqemblkgo.exe 99 PID 260 wrote to memory of 540 260 Sysqemmvzlt.exe 100 PID 260 wrote to memory of 540 260 Sysqemmvzlt.exe 100 PID 260 wrote to memory of 540 260 Sysqemmvzlt.exe 100 PID 540 wrote to memory of 3332 540 Sysqemuzcyk.exe 123 PID 540 wrote to memory of 3332 540 Sysqemuzcyk.exe 123 PID 540 wrote to memory of 3332 540 Sysqemuzcyk.exe 123 PID 3332 wrote to memory of 5948 3332 Sysqemrtxla.exe 102 PID 3332 wrote to memory of 5948 3332 Sysqemrtxla.exe 102 PID 3332 wrote to memory of 5948 3332 Sysqemrtxla.exe 102 PID 5948 wrote to memory of 5704 5948 Sysqemzitym.exe 103 PID 5948 wrote to memory of 5704 5948 Sysqemzitym.exe 103 PID 5948 wrote to memory of 5704 5948 Sysqemzitym.exe 103 PID 5704 wrote to memory of 372 5704 Sysqemhbszt.exe 104 PID 5704 wrote to memory of 372 5704 Sysqemhbszt.exe 104 PID 5704 wrote to memory of 372 5704 Sysqemhbszt.exe 104 PID 372 wrote to memory of 1752 372 Sysqembexot.exe 107 PID 372 wrote to memory of 1752 372 Sysqembexot.exe 107 PID 372 wrote to memory of 1752 372 Sysqembexot.exe 107 PID 1752 wrote to memory of 2612 1752 Sysqemzqtcj.exe 108 PID 1752 wrote to memory of 2612 1752 Sysqemzqtcj.exe 108 PID 1752 wrote to memory of 2612 1752 Sysqemzqtcj.exe 108 PID 2612 wrote to memory of 4024 2612 Sysqemhqrcy.exe 110 PID 2612 wrote to memory of 4024 2612 Sysqemhqrcy.exe 110 PID 2612 wrote to memory of 4024 2612 Sysqemhqrcy.exe 110 PID 4024 wrote to memory of 5172 4024 Sysqemmsaxg.exe 112 PID 4024 wrote to memory of 5172 4024 Sysqemmsaxg.exe 112 PID 4024 wrote to memory of 5172 4024 Sysqemmsaxg.exe 112 PID 5172 wrote to memory of 2324 5172 Sysqemuszxv.exe 113 PID 5172 wrote to memory of 2324 5172 Sysqemuszxv.exe 113 PID 5172 wrote to memory of 2324 5172 Sysqemuszxv.exe 113 PID 2324 wrote to memory of 5464 2324 Sysqemerluf.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc3f527fbf94f852e96037b2185eba80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bc3f527fbf94f852e96037b2185eba80_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeivmu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeivmu.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzdiuu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzdiuu.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcdafe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcdafe.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjkofy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjkofy.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrzjsc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrzjsc.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\Sysqembhnpm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembhnpm.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\Sysqemencab.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemencab.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrwade.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrwade.exe"9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwbuly.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwbuly.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\Sysqemblkgo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemblkgo.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmvzlt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmvzlt.exe"12⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuzcyk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuzcyk.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrtxla.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrtxla.exe"14⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzitym.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzitym.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhbszt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhbszt.exe"16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\Sysqembexot.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembexot.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzqtcj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzqtcj.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhqrcy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhqrcy.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmsaxg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmsaxg.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuszxv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuszxv.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\Sysqemerluf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemerluf.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrigxo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrigxo.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\Sysqembavcb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembavcb.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\Sysqemedysn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemedysn.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrmcnq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrmcnq.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjiuym.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjiuym.exe"27⤵
- Executes dropped EXE
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\Sysqemttidx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemttidx.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyjoef.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyjoef.exe"29⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjqbgj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjqbgj.exe"30⤵
- Executes dropped EXE
- Modifies registry class
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjfzma.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjfzma.exe"31⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\Sysqemteexe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemteexe.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlbehs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlbehs.exe"33⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyrzkb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyrzkb.exe"34⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtiany.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtiany.exe"35⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmbpls.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmbpls.exe"36⤵
- Checks computer location settings
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtfzyb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtfzyb.exe"37⤵
- Executes dropped EXE
- Modifies registry class
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\Sysqembkkqe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembkkqe.exe"38⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwtndv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwtndv.exe"39⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtymzg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtymzg.exe"40⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\Sysqemexzjk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemexzjk.exe"41⤵
- Checks computer location settings
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtryuz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtryuz.exe"42⤵
- Checks computer location settings
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\Sysqembdgni.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembdgni.exe"43⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\Sysqembosfw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembosfw.exe"44⤵
- Executes dropped EXE
- Modifies registry class
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\Sysqemihqxr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemihqxr.exe"45⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwgmom.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwgmom.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdruyu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdruyu.exe"47⤵
- Executes dropped EXE
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\Sysqembaegi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembaegi.exe"48⤵
- Executes dropped EXE
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtapeh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtapeh.exe"49⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaezry.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaezry.exe"50⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqiaec.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqiaec.exe"51⤵
- Executes dropped EXE
- Modifies registry class
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgrued.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgrued.exe"52⤵
- Checks computer location settings
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwghsv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwghsv.exe"53⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyclac.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyclac.exe"54⤵
- Executes dropped EXE
- Modifies registry class
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjxnyv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjxnyv.exe"55⤵
- Executes dropped EXE
- Modifies registry class
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgyflz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgyflz.exe"56⤵
- Executes dropped EXE
- Modifies registry class
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvdfgd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvdfgd.exe"57⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\Sysqemiflvo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiflvo.exe"58⤵
- Executes dropped EXE
- Modifies registry class
PID:408 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyjtik.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyjtik.exe"59⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyvgjh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyvgjh.exe"60⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqvjgy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqvjgy.exe"61⤵
- Executes dropped EXE
- Modifies registry class
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtqnom.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtqnom.exe"62⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\Sysqembuyhh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembuyhh.exe"63⤵
- Checks computer location settings
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnlbkq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnlbkq.exe"64⤵
- Executes dropped EXE
- Modifies registry class
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdbmsx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdbmsx.exe"65⤵
- Executes dropped EXE
- Modifies registry class
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvbnxi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvbnxi.exe"66⤵
- Checks computer location settings
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlukks.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlukks.exe"67⤵
- Checks computer location settings
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\Sysqembkvsz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembkvsz.exe"68⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqkqka.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqkqka.exe"69⤵
- Modifies registry class
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvfknk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvfknk.exe"70⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\Sysqemkqhso.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkqhso.exe"71⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\Sysqemgtmvg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgtmvg.exe"72⤵
- Checks computer location settings
- Modifies registry class
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\Sysqemysxbx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemysxbx.exe"73⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\Sysqemizcyp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemizcyp.exe"74⤵
- Checks computer location settings
- Modifies registry class
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\Sysqemytzrk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemytzrk.exe"75⤵
- Checks computer location settings
- Modifies registry class
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnmxrf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnmxrf.exe"76⤵
- Checks computer location settings
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyllcb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyllcb.exe"77⤵
- Checks computer location settings
- Modifies registry class
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaszfr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaszfr.exe"78⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\Sysqemahoki.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemahoki.exe"79⤵
- Checks computer location settings
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\Sysqemshzih.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemshzih.exe"80⤵
- Modifies registry class
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\Sysqemiaxic.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiaxic.exe"81⤵
- Modifies registry class
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\Sysqemipvnb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemipvnb.exe"82⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\Sysqemguuim.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemguuim.exe"83⤵
- Checks computer location settings
- Modifies registry class
PID:448 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaskdp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaskdp.exe"84⤵
- Modifies registry class
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxmgqf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxmgqf.exe"85⤵
- Checks computer location settings
- Modifies registry class
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxqsrt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxqsrt.exe"86⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\Sysqemiexbv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiexbv.exe"87⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqmsbq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqmsbq.exe"88⤵
- Checks computer location settings
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\Sysqempqcph.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempqcph.exe"89⤵
- Checks computer location settings
- Modifies registry class
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdajrk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdajrk.exe"90⤵
- Checks computer location settings
- Modifies registry class
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaitzx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaitzx.exe"91⤵
- Checks computer location settings
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvanuv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvanuv.exe"92⤵
- Modifies registry class
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuhlsg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuhlsg.exe"93⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\Sysqemaugfl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaugfl.exe"94⤵
- Modifies registry class
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsigqh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsigqh.exe"95⤵
- Checks computer location settings
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdmioa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdmioa.exe"96⤵
- Checks computer location settings
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\Sysqemajqbn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemajqbn.exe"97⤵
- Checks computer location settings
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\Sysqemancub.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemancub.exe"98⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\Sysqemidzrh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemidzrh.exe"99⤵
- Checks computer location settings
- Modifies registry class
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkycho.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkycho.exe"100⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\Sysqemfetxa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfetxa.exe"101⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\Sysqemzkjsd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzkjsd.exe"102⤵
- Checks computer location settings
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\Sysqemakkfo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemakkfo.exe"103⤵
- Checks computer location settings
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsgkql.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsgkql.exe"104⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\Sysqemkynok.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkynok.exe"105⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\Sysqemdrctd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdrctd.exe"106⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\Sysqemkolzb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkolzb.exe"107⤵
- Modifies registry class
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmmauk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmmauk.exe"108⤵
- Modifies registry class
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxqcre.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxqcre.exe"109⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmcbcb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmcbcb.exe"110⤵
- Checks computer location settings
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxydau.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxydau.exe"111⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\Sysqemckxnz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemckxnz.exe"112⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\Sysqemkhryw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkhryw.exe"113⤵
- Checks computer location settings
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhbnlm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhbnlm.exe"114⤵
- Checks computer location settings
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhuxja.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhuxja.exe"115⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\Sysqemzqpco.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzqpco.exe"116⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjansv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjansv.exe"117⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\Sysqemuasur.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuasur.exe"118⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\Sysqempruxo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempruxo.exe"119⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmzffb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmzffb.exe"120⤵
- Checks computer location settings
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzclbn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzclbn.exe"121⤵
- Modifies registry class
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmbpjh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmbpjh.exe"122⤵PID:5720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-