Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
99s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 12:55
Behavioral task
behavioral1
Sample
df735c8b977be9d15dcf57a12bfb6a30_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
df735c8b977be9d15dcf57a12bfb6a30_NeikiAnalytics.exe
-
Size
656KB
-
MD5
df735c8b977be9d15dcf57a12bfb6a30
-
SHA1
7a1e450e0928f2d993def7b6fc9dfb0d3e52a39e
-
SHA256
1decbc2c9c0accaf047ab0df876534fe04049e6d8752abc65ab83a7bd55a5221
-
SHA512
43e3b28e4663b03deeb1e87514b469e5f561fbb501e86c6b2a7322a45bc3178e2c52c07ef472fabd88040685b938d49f8f3ab4b3c5f73afd33184d0d79bc6607
-
SSDEEP
12288:w+67XR9JSSxvYGdodHDusQHNd1KidKjttRYLwG:w+6N986Y7DusQHNd1KidKjttRYLwG
Malware Config
Signatures
-
Malware Dropper & Backdoor - Berbew 20 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x000700000002343f-5.dat family_berbew behavioral2/files/0x000800000002343b-40.dat family_berbew behavioral2/files/0x0007000000023441-70.dat family_berbew behavioral2/files/0x0007000000023442-105.dat family_berbew behavioral2/files/0x0007000000023443-140.dat family_berbew behavioral2/files/0x0007000000023444-175.dat family_berbew behavioral2/files/0x0007000000023445-210.dat family_berbew behavioral2/files/0x0007000000023446-245.dat family_berbew behavioral2/files/0x0007000000023447-280.dat family_berbew behavioral2/files/0x000800000002297b-316.dat family_berbew behavioral2/files/0x0010000000009f7c-351.dat family_berbew behavioral2/files/0x000a0000000233a6-386.dat family_berbew behavioral2/files/0x000900000002339d-421.dat family_berbew behavioral2/files/0x000800000002296e-456.dat family_berbew behavioral2/files/0x0007000000023449-491.dat family_berbew behavioral2/files/0x000700000002344a-526.dat family_berbew behavioral2/files/0x000700000002344b-561.dat family_berbew behavioral2/files/0x000700000002344c-596.dat family_berbew behavioral2/files/0x000d0000000233a5-631.dat family_berbew behavioral2/files/0x000700000002344f-666.dat family_berbew -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemrlioa.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqembsqay.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemyjsbw.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemyljnn.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemidkri.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemjemju.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemtqqpt.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemzauuw.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemhgvge.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemlfwkg.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemurvkt.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemmxcuy.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemzmhpg.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemzjexc.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqembvhpp.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemggwsx.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemewxss.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemtrvzd.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemirxwy.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemjfarm.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqempoyki.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemhlszu.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemzathw.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemqoydb.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemyuabb.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemtnagr.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemlhpwr.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemuxwbe.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqembrpxd.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemtnjrf.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemgdhzn.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemrueor.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemtgzgf.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemtdjxd.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemzaisq.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemjbuvh.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqembdgsa.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemthwiu.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemjwvbo.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemfrlyo.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemhuxja.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemoipux.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemskoiz.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemdkriv.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqembofhv.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqembooyc.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemlirgw.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemdmgtq.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemihkhf.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemebqkd.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemvkuce.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemahyiw.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemopjir.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemrvomw.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemgsxru.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemeusvp.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemsmsnr.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemkdzzh.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemstttl.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemjinli.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemdgtjx.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemgylmb.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqemnxxip.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Sysqematvgg.exe -
Executes dropped EXE 64 IoCs
pid Process 4356 Sysqemzaisq.exe 5012 Sysqemralqh.exe 2864 Sysqemwyqyv.exe 4160 Sysqemxbdqj.exe 3288 Sysqembooyc.exe 2580 Sysqemjpvyr.exe 4444 Sysqemrtxla.exe 1784 Sysqemzphys.exe 1940 Sysqemjemju.exe 2648 Sysqemjwvbo.exe 2076 Sysqemrlioa.exe 4416 Sysqemzmhpg.exe 1088 Sysqemjiiho.exe 3360 Sysqemudjre.exe 3780 Sysqemwnbhw.exe 756 Sysqemuwlpj.exe 2248 Sysqemzjexc.exe 116 Sysqemjbuvh.exe 3768 Sysqemrttvw.exe 1244 Sysqemwdbqe.exe 4420 Sysqemezldw.exe 5004 Sysqemzcobi.exe 3032 Sysqembmgqa.exe 2900 Sysqemohygg.exe 4636 Sysqemwditq.exe 3320 Sysqemeehte.exe 1200 Sysqemlirgw.exe 4352 Sysqemtaqhc.exe 4324 Sysqemetfeh.exe 2060 Sysqemrrahq.exe 2452 Sysqemeeswv.exe 4984 Sysqemjfarm.exe 2268 Sysqemgdhzn.exe 3572 Sysqemtqqpt.exe 4892 Sysqemjjopo.exe 2584 Sysqemebqkd.exe 1536 Sysqemwxqdz.exe 680 Sysqemmurix.exe 4412 Sysqemjryiy.exe 1784 Sysqemopdye.exe 436 Sysqemtnagr.exe 4356 Sysqemzauuw.exe 1624 Sysqemoipux.exe 5076 Sysqembvhpp.exe 3468 Sysqembzvaf.exe 2472 Sysqembdgsa.exe 496 Sysqemypcfy.exe 4752 Sysqemytpqh.exe 2304 Sysqemlohly.exe 3680 Sysqemdgtjx.exe 1528 Sysqemgylmb.exe 3392 Sysqemyyxxl.exe 3028 Sysqemvkuce.exe 1576 Sysqemggwsx.exe 4104 Sysqemdhplm.exe 3324 Sysqemnsgjt.exe 920 Sysqemlizws.exe 3732 Sysqemqvujx.exe 1676 Sysqemajvmh.exe 3872 Sysqemolbpq.exe 1956 Sysqemlfwkg.exe 4092 Sysqemyzefl.exe 2236 Sysqemdmgtq.exe 732 Sysqemnxxip.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjwvbo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtaqhc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemnsgjt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrvomw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqgzuw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrttvw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtdefz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemfrlyo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzmnqw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqoydb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjryiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlfwkg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemihkhf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdkriv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemiwmvz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzqygd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuxwbe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemidpvo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemopjir.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwditq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemetfeh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemypcfy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemytpqh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemretdx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuofjs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjoqzf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ df735c8b977be9d15dcf57a12bfb6a30_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembvhpp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdhplm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyzefl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemcunyg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzathw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhuxja.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjpvyr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwnbhw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtqqpt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmurix.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzauuw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembdgsa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemnxxip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemerixi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemevoun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzaisq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzjexc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemeeswv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemggwsx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemcdmen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemcptbd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmorkg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtyqfu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtnjrf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwyqyv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzcobi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemoipux.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlizws.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqempoyki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrpjdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemewxss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuwlpj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgylmb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsmsnr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyljnn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemralqh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzmhpg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2616 wrote to memory of 4356 2616 df735c8b977be9d15dcf57a12bfb6a30_NeikiAnalytics.exe 84 PID 2616 wrote to memory of 4356 2616 df735c8b977be9d15dcf57a12bfb6a30_NeikiAnalytics.exe 84 PID 2616 wrote to memory of 4356 2616 df735c8b977be9d15dcf57a12bfb6a30_NeikiAnalytics.exe 84 PID 4356 wrote to memory of 5012 4356 Sysqemzaisq.exe 86 PID 4356 wrote to memory of 5012 4356 Sysqemzaisq.exe 86 PID 4356 wrote to memory of 5012 4356 Sysqemzaisq.exe 86 PID 5012 wrote to memory of 2864 5012 Sysqemralqh.exe 87 PID 5012 wrote to memory of 2864 5012 Sysqemralqh.exe 87 PID 5012 wrote to memory of 2864 5012 Sysqemralqh.exe 87 PID 2864 wrote to memory of 4160 2864 Sysqemwyqyv.exe 89 PID 2864 wrote to memory of 4160 2864 Sysqemwyqyv.exe 89 PID 2864 wrote to memory of 4160 2864 Sysqemwyqyv.exe 89 PID 4160 wrote to memory of 3288 4160 Sysqemxbdqj.exe 90 PID 4160 wrote to memory of 3288 4160 Sysqemxbdqj.exe 90 PID 4160 wrote to memory of 3288 4160 Sysqemxbdqj.exe 90 PID 3288 wrote to memory of 2580 3288 Sysqembooyc.exe 91 PID 3288 wrote to memory of 2580 3288 Sysqembooyc.exe 91 PID 3288 wrote to memory of 2580 3288 Sysqembooyc.exe 91 PID 2580 wrote to memory of 4444 2580 Sysqemjpvyr.exe 92 PID 2580 wrote to memory of 4444 2580 Sysqemjpvyr.exe 92 PID 2580 wrote to memory of 4444 2580 Sysqemjpvyr.exe 92 PID 4444 wrote to memory of 1784 4444 Sysqemrtxla.exe 93 PID 4444 wrote to memory of 1784 4444 Sysqemrtxla.exe 93 PID 4444 wrote to memory of 1784 4444 Sysqemrtxla.exe 93 PID 1784 wrote to memory of 1940 1784 Sysqemzphys.exe 96 PID 1784 wrote to memory of 1940 1784 Sysqemzphys.exe 96 PID 1784 wrote to memory of 1940 1784 Sysqemzphys.exe 96 PID 1940 wrote to memory of 2648 1940 Sysqemjemju.exe 97 PID 1940 wrote to memory of 2648 1940 Sysqemjemju.exe 97 PID 1940 wrote to memory of 2648 1940 Sysqemjemju.exe 97 PID 2648 wrote to memory of 2076 2648 Sysqemjwvbo.exe 98 PID 2648 wrote to memory of 2076 2648 Sysqemjwvbo.exe 98 PID 2648 wrote to memory of 2076 2648 Sysqemjwvbo.exe 98 PID 2076 wrote to memory of 4416 2076 Sysqemrlioa.exe 99 PID 2076 wrote to memory of 4416 2076 Sysqemrlioa.exe 99 PID 2076 wrote to memory of 4416 2076 Sysqemrlioa.exe 99 PID 4416 wrote to memory of 1088 4416 Sysqemzmhpg.exe 101 PID 4416 wrote to memory of 1088 4416 Sysqemzmhpg.exe 101 PID 4416 wrote to memory of 1088 4416 Sysqemzmhpg.exe 101 PID 1088 wrote to memory of 3360 1088 Sysqemjiiho.exe 103 PID 1088 wrote to memory of 3360 1088 Sysqemjiiho.exe 103 PID 1088 wrote to memory of 3360 1088 Sysqemjiiho.exe 103 PID 3360 wrote to memory of 3780 3360 Sysqemudjre.exe 104 PID 3360 wrote to memory of 3780 3360 Sysqemudjre.exe 104 PID 3360 wrote to memory of 3780 3360 Sysqemudjre.exe 104 PID 3780 wrote to memory of 756 3780 Sysqemwnbhw.exe 105 PID 3780 wrote to memory of 756 3780 Sysqemwnbhw.exe 105 PID 3780 wrote to memory of 756 3780 Sysqemwnbhw.exe 105 PID 756 wrote to memory of 2248 756 Sysqemuwlpj.exe 106 PID 756 wrote to memory of 2248 756 Sysqemuwlpj.exe 106 PID 756 wrote to memory of 2248 756 Sysqemuwlpj.exe 106 PID 2248 wrote to memory of 116 2248 Sysqemzjexc.exe 107 PID 2248 wrote to memory of 116 2248 Sysqemzjexc.exe 107 PID 2248 wrote to memory of 116 2248 Sysqemzjexc.exe 107 PID 116 wrote to memory of 3768 116 Sysqemjbuvh.exe 108 PID 116 wrote to memory of 3768 116 Sysqemjbuvh.exe 108 PID 116 wrote to memory of 3768 116 Sysqemjbuvh.exe 108 PID 3768 wrote to memory of 1244 3768 Sysqemrttvw.exe 109 PID 3768 wrote to memory of 1244 3768 Sysqemrttvw.exe 109 PID 3768 wrote to memory of 1244 3768 Sysqemrttvw.exe 109 PID 1244 wrote to memory of 4420 1244 Sysqemwdbqe.exe 110 PID 1244 wrote to memory of 4420 1244 Sysqemwdbqe.exe 110 PID 1244 wrote to memory of 4420 1244 Sysqemwdbqe.exe 110 PID 4420 wrote to memory of 5004 4420 Sysqemezldw.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\df735c8b977be9d15dcf57a12bfb6a30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\df735c8b977be9d15dcf57a12bfb6a30_NeikiAnalytics.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzaisq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzaisq.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\Sysqemralqh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemralqh.exe"3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwyqyv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwyqyv.exe"4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxbdqj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxbdqj.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\Sysqembooyc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembooyc.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjpvyr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjpvyr.exe"7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrtxla.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrtxla.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzphys.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzphys.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjemju.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjemju.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjwvbo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjwvbo.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrlioa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrlioa.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzmhpg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzmhpg.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjiiho.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjiiho.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\Sysqemudjre.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemudjre.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwnbhw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwnbhw.exe"16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuwlpj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuwlpj.exe"17⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzjexc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzjexc.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjbuvh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjbuvh.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrttvw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrttvw.exe"20⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwdbqe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwdbqe.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\Sysqemezldw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemezldw.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzcobi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzcobi.exe"23⤵
- Executes dropped EXE
- Modifies registry class
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\Sysqembmgqa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembmgqa.exe"24⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\Sysqemohygg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemohygg.exe"25⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwditq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwditq.exe"26⤵
- Executes dropped EXE
- Modifies registry class
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeehte.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeehte.exe"27⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlirgw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlirgw.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtaqhc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtaqhc.exe"29⤵
- Executes dropped EXE
- Modifies registry class
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\Sysqemetfeh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemetfeh.exe"30⤵
- Executes dropped EXE
- Modifies registry class
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrrahq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrrahq.exe"31⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeeswv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeeswv.exe"32⤵
- Executes dropped EXE
- Modifies registry class
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjfarm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjfarm.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgdhzn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgdhzn.exe"34⤵
- Checks computer location settings
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtqqpt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtqqpt.exe"35⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjjopo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjjopo.exe"36⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\Sysqemebqkd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemebqkd.exe"37⤵
- Checks computer location settings
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwxqdz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwxqdz.exe"38⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmurix.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmurix.exe"39⤵
- Executes dropped EXE
- Modifies registry class
PID:680 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjryiy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjryiy.exe"40⤵
- Executes dropped EXE
- Modifies registry class
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\Sysqemopdye.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemopdye.exe"41⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtnagr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtnagr.exe"42⤵
- Checks computer location settings
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzauuw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzauuw.exe"43⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\Sysqemoipux.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoipux.exe"44⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\Sysqembvhpp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembvhpp.exe"45⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\Sysqembzvaf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembzvaf.exe"46⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\Sysqembdgsa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembdgsa.exe"47⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\Sysqemypcfy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemypcfy.exe"48⤵
- Executes dropped EXE
- Modifies registry class
PID:496 -
C:\Users\Admin\AppData\Local\Temp\Sysqemytpqh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemytpqh.exe"49⤵
- Executes dropped EXE
- Modifies registry class
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlohly.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlohly.exe"50⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdgtjx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdgtjx.exe"51⤵
- Checks computer location settings
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgylmb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgylmb.exe"52⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyyxxl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyyxxl.exe"53⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvkuce.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvkuce.exe"54⤵
- Checks computer location settings
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\Sysqemggwsx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemggwsx.exe"55⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdhplm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdhplm.exe"56⤵
- Executes dropped EXE
- Modifies registry class
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnsgjt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnsgjt.exe"57⤵
- Executes dropped EXE
- Modifies registry class
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlizws.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlizws.exe"58⤵
- Executes dropped EXE
- Modifies registry class
PID:920 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqvujx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqvujx.exe"59⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\Sysqemajvmh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemajvmh.exe"60⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\Sysqemolbpq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemolbpq.exe"61⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlfwkg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlfwkg.exe"62⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyzefl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyzefl.exe"63⤵
- Executes dropped EXE
- Modifies registry class
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdmgtq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdmgtq.exe"64⤵
- Checks computer location settings
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnxxip.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnxxip.exe"65⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:732 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyektt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyektt.exe"66⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqeowe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqeowe.exe"67⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\Sysqemihkhf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemihkhf.exe"68⤵
- Checks computer location settings
- Modifies registry class
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtdefz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtdefz.exe"69⤵
- Modifies registry class
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdkriv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdkriv.exe"70⤵
- Checks computer location settings
- Modifies registry class
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\Sysqemahyiw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemahyiw.exe"71⤵
- Checks computer location settings
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\Sysqemiwmvz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiwmvz.exe"72⤵
- Modifies registry class
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgjiqy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgjiqy.exe"73⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqxjtz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqxjtz.exe"74⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\Sysqemlhpwr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlhpwr.exe"75⤵
- Checks computer location settings
PID:680 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvcqgy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvcqgy.exe"76⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\Sysqematvgg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqematvgg.exe"77⤵
- Checks computer location settings
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcdmen.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcdmen.exe"78⤵
- Modifies registry class
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqcqmh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqcqmh.exe"79⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnzysm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnzysm.exe"80⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\Sysqemsmsnr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsmsnr.exe"81⤵
- Checks computer location settings
- Modifies registry class
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\Sysqemviwvx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemviwvx.exe"82⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\Sysqemcptbd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcptbd.exe"83⤵
- Modifies registry class
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxdjrx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxdjrx.exe"84⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\Sysqemfhvjs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfhvjs.exe"85⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\Sysqemdfdpf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdfdpf.exe"86⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\Sysqempoyki.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempoyki.exe"87⤵
- Checks computer location settings
- Modifies registry class
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaraij.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaraij.exe"88⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\Sysqemsgasf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsgasf.exe"89⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\Sysqemikjgd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemikjgd.exe"90⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\Sysqemskoiz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemskoiz.exe"91⤵
- Checks computer location settings
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcunyg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcunyg.exe"92⤵
- Modifies registry class
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkdzzh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkdzzh.exe"93⤵
- Checks computer location settings
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxmgbk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxmgbk.exe"94⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\Sysqemhlszu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhlszu.exe"95⤵
- Checks computer location settings
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxfqzp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxfqzp.exe"96⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\Sysqemzathw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzathw.exe"97⤵
- Checks computer location settings
- Modifies registry class
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\Sysqemurvkt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemurvkt.exe"98⤵
- Checks computer location settings
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhtcfq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhtcfq.exe"99⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\Sysqemretdx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemretdx.exe"100⤵
- Modifies registry class
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfrlyo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfrlyo.exe"101⤵
- Checks computer location settings
- Modifies registry class
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\Sysqemstttl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemstttl.exe"102⤵
- Checks computer location settings
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuofjs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuofjs.exe"103⤵
- Modifies registry class
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhuxja.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhuxja.exe"104⤵
- Checks computer location settings
- Modifies registry class
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\Sysqempjmpy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempjmpy.exe"105⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmvqph.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmvqph.exe"106⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\Sysqemzmnqw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzmnqw.exe"107⤵
- Modifies registry class
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\Sysqempgtir.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempgtir.exe"108⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\Sysqemhgvge.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhgvge.exe"109⤵
- Checks computer location settings
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwdetc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwdetc.exe"110⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmxcuy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmxcuy.exe"111⤵
- Checks computer location settings
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmfdzj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmfdzj.exe"112⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmxnxp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmxnxp.exe"113⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\Sysqemrkiku.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrkiku.exe"114⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\Sysqemetlfe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemetlfe.exe"115⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\Sysqemhhbvf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhhbvf.exe"116⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\Sysqemzobyw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzobyw.exe"117⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmjutn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmjutn.exe"118⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjoqzf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjoqzf.exe"119⤵
- Modifies registry class
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\Sysqemoxihz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoxihz.exe"120⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\Sysqembzpce.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembzpce.exe"121⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\Sysqembofhv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembofhv.exe"122⤵
- Checks computer location settings
PID:2100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-