Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 05:53
Static task
static1
Behavioral task
behavioral1
Sample
228aa4cf8aa952d51d4830b97c7fd2e0_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
228aa4cf8aa952d51d4830b97c7fd2e0_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
228aa4cf8aa952d51d4830b97c7fd2e0_NeikiAnalytics.exe
-
Size
4.3MB
-
MD5
228aa4cf8aa952d51d4830b97c7fd2e0
-
SHA1
26952edfbc1c305f0e26a84d536d41089d927ca3
-
SHA256
3d64112e7067aa286b7e8bf6e4d6c1e81c84a97a604a1a346adaed3b6a767750
-
SHA512
e5f7627db6fbce43a92882c518037f13c3431f8718a91a4bc404d99602f58c2f9fd30c6b4c587bdf4824f5c4719fffcb1645d801fb424b27e63405f651567074
-
SSDEEP
24576:EZtM+M9NoZS/6oTNfRh3Qh3OXuaq4gPZrIbXEu8CkB7m8yWLth1Utl0uPD5DBQ:E4+CoZKTh36dZ4gPZU8JUjItvUjFly
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemxsutk.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemauveq.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemrtelv.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemnfyee.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemhutjf.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemfcdpw.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemlmixp.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemnwncm.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemznvvw.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemgrrkt.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemyismm.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemyiyjn.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemwndiq.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemlhqmw.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemjhnol.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqembcmok.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemtnkef.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemgqghc.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemsdnxw.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemnawhn.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqembrmue.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemeyyff.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqempbgwi.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemxzhkf.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemrifss.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 228aa4cf8aa952d51d4830b97c7fd2e0_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemnfsak.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemncvfs.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemeumkv.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemrtmxj.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemvixbr.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemnapwa.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqempxfny.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemxocnr.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqembtukj.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemtvxtr.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemgfbrz.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemdqvij.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemhdvhw.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqembgujv.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemgqlkx.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemrquwx.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemhplbb.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemozunk.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemvmwsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemusxqc.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemblhst.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemtiqrw.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemtmyed.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemjuuqb.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemoclbn.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemttmdr.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemqrpxk.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemgdfre.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemmxcuy.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemvukyw.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemazimu.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemwgszf.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqembtbdq.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemowrdt.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemmqfdc.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemkhxum.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemggwia.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Sysqemviofx.exe -
Executes dropped EXE 64 IoCs
pid Process 220 Sysqempbgwi.exe 1212 Sysqembpywi.exe 2804 Sysqemwgszf.exe 4848 Sysqemgudhb.exe 4576 Sysqemmwwni.exe 5008 Sysqemjxhfy.exe 2836 Sysqemwwkoy.exe 4324 Sysqemwsxyp.exe 4836 Sysqemjjlep.exe 3788 Sysqemyrzkb.exe 3700 Sysqemowrdt.exe 3484 Sysqemzhiyd.exe 1192 Sysqembcmok.exe 2216 Sysqemtnkef.exe 2444 Sysqemroeky.exe 744 Sysqemblhst.exe 656 Sysqemrxetv.exe 3272 Sysqemtsibk.exe 4772 Sysqemoclbn.exe 2380 Sysqemtarcu.exe 4360 Sysqembipne.exe 536 Sysqemelskq.exe 2556 Sysqemttmdr.exe 2924 Sysqemabbix.exe 2640 Sysqemgksiz.exe 1912 Sysqemauveq.exe 3452 Sysqemlmlpg.exe 2900 Sysqemgdfre.exe 3044 Sysqemnwncm.exe 4152 Sysqemljipr.exe 1468 Sysqemylpko.exe 4772 Sysqemkqhso.exe 3920 Sysqemlfgdr.exe 3968 Sysqemqppmt.exe 852 Sysqemyiyjn.exe 3328 Sysqemtdefz.exe 2392 Sysqemnfsak.exe 3344 Sysqemnnrqv.exe 2348 Sysqemyitox.exe 4028 Sysqemaskdp.exe 4632 Sysqemymher.exe 3152 Sysqemseihu.exe 4708 Sysqemfgpcz.exe 5060 Sysqemabuks.exe 2248 Sysqemqrpxk.exe 1004 Sysqemnsaqz.exe 3228 Sysqemvixbr.exe 1372 Sysqemvahyw.exe 3328 Sysqemcfujt.exe 1256 Sysqemnawhn.exe 4884 Sysqemxluxt.exe 4032 Sysqemkqmft.exe 2256 Sysqemsvyyw.exe 3888 Sysqemcfonv.exe 3992 Sysqemmqfdc.exe 3932 Sysqemzhggr.exe 4480 Sysqemrvgrn.exe 392 Sysqemhahel.exe 2824 Sysqemkhxum.exe 3124 Sysqemkwvfx.exe 3812 Sysqemnnwib.exe 3724 Sysqemifqlq.exe 1308 Sysqempbbic.exe 2208 Sysqemnkuwj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembipne.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxsutk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemcfonv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqhvjl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqempzygq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjuuqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemazimu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemybfnr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemprbpu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxwthr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzhrxq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemroeky.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemaskdp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrvgrn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemowxwi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgqlkx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtmyed.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmxcuy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzwceh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemblhst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgksiz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrtelv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemnsaqz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgihon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhplbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemnocjq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvqvth.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqrpxk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembtbdq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxrtws.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwgszf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemcfujt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemeyyff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlmlpg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemnfsak.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemseihu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemguoll.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzwwav.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyrzkb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzolmz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemabykw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgqghc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrquwx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemltvwk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdvmcb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemymher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgnqyb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemklgoq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemywiyi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqwatq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembcmok.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqppmt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjhnol.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemohpdg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhutjf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwsxyp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlhdgz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsjifn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuttkl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemncvfs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqvnog.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgudhb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlmlxk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemabbix.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 220 2236 228aa4cf8aa952d51d4830b97c7fd2e0_NeikiAnalytics.exe 81 PID 2236 wrote to memory of 220 2236 228aa4cf8aa952d51d4830b97c7fd2e0_NeikiAnalytics.exe 81 PID 2236 wrote to memory of 220 2236 228aa4cf8aa952d51d4830b97c7fd2e0_NeikiAnalytics.exe 81 PID 220 wrote to memory of 1212 220 Sysqempbgwi.exe 83 PID 220 wrote to memory of 1212 220 Sysqempbgwi.exe 83 PID 220 wrote to memory of 1212 220 Sysqempbgwi.exe 83 PID 1212 wrote to memory of 2804 1212 Sysqembpywi.exe 84 PID 1212 wrote to memory of 2804 1212 Sysqembpywi.exe 84 PID 1212 wrote to memory of 2804 1212 Sysqembpywi.exe 84 PID 2804 wrote to memory of 4848 2804 Sysqemwgszf.exe 85 PID 2804 wrote to memory of 4848 2804 Sysqemwgszf.exe 85 PID 2804 wrote to memory of 4848 2804 Sysqemwgszf.exe 85 PID 4848 wrote to memory of 4576 4848 Sysqemgudhb.exe 86 PID 4848 wrote to memory of 4576 4848 Sysqemgudhb.exe 86 PID 4848 wrote to memory of 4576 4848 Sysqemgudhb.exe 86 PID 4576 wrote to memory of 5008 4576 Sysqemmwwni.exe 87 PID 4576 wrote to memory of 5008 4576 Sysqemmwwni.exe 87 PID 4576 wrote to memory of 5008 4576 Sysqemmwwni.exe 87 PID 5008 wrote to memory of 2836 5008 Sysqemjxhfy.exe 88 PID 5008 wrote to memory of 2836 5008 Sysqemjxhfy.exe 88 PID 5008 wrote to memory of 2836 5008 Sysqemjxhfy.exe 88 PID 2836 wrote to memory of 4324 2836 Sysqemwwkoy.exe 89 PID 2836 wrote to memory of 4324 2836 Sysqemwwkoy.exe 89 PID 2836 wrote to memory of 4324 2836 Sysqemwwkoy.exe 89 PID 4324 wrote to memory of 4836 4324 Sysqemwsxyp.exe 90 PID 4324 wrote to memory of 4836 4324 Sysqemwsxyp.exe 90 PID 4324 wrote to memory of 4836 4324 Sysqemwsxyp.exe 90 PID 4836 wrote to memory of 3788 4836 Sysqemjjlep.exe 91 PID 4836 wrote to memory of 3788 4836 Sysqemjjlep.exe 91 PID 4836 wrote to memory of 3788 4836 Sysqemjjlep.exe 91 PID 3788 wrote to memory of 3700 3788 Sysqemyrzkb.exe 92 PID 3788 wrote to memory of 3700 3788 Sysqemyrzkb.exe 92 PID 3788 wrote to memory of 3700 3788 Sysqemyrzkb.exe 92 PID 3700 wrote to memory of 3484 3700 Sysqemowrdt.exe 93 PID 3700 wrote to memory of 3484 3700 Sysqemowrdt.exe 93 PID 3700 wrote to memory of 3484 3700 Sysqemowrdt.exe 93 PID 3484 wrote to memory of 1192 3484 Sysqemzhiyd.exe 94 PID 3484 wrote to memory of 1192 3484 Sysqemzhiyd.exe 94 PID 3484 wrote to memory of 1192 3484 Sysqemzhiyd.exe 94 PID 1192 wrote to memory of 2216 1192 Sysqembcmok.exe 95 PID 1192 wrote to memory of 2216 1192 Sysqembcmok.exe 95 PID 1192 wrote to memory of 2216 1192 Sysqembcmok.exe 95 PID 2216 wrote to memory of 2444 2216 Sysqemtnkef.exe 96 PID 2216 wrote to memory of 2444 2216 Sysqemtnkef.exe 96 PID 2216 wrote to memory of 2444 2216 Sysqemtnkef.exe 96 PID 2444 wrote to memory of 744 2444 Sysqemroeky.exe 97 PID 2444 wrote to memory of 744 2444 Sysqemroeky.exe 97 PID 2444 wrote to memory of 744 2444 Sysqemroeky.exe 97 PID 744 wrote to memory of 656 744 Sysqemblhst.exe 98 PID 744 wrote to memory of 656 744 Sysqemblhst.exe 98 PID 744 wrote to memory of 656 744 Sysqemblhst.exe 98 PID 656 wrote to memory of 3272 656 Sysqemrxetv.exe 99 PID 656 wrote to memory of 3272 656 Sysqemrxetv.exe 99 PID 656 wrote to memory of 3272 656 Sysqemrxetv.exe 99 PID 3272 wrote to memory of 4772 3272 Sysqemtsibk.exe 100 PID 3272 wrote to memory of 4772 3272 Sysqemtsibk.exe 100 PID 3272 wrote to memory of 4772 3272 Sysqemtsibk.exe 100 PID 4772 wrote to memory of 2380 4772 Sysqemoclbn.exe 101 PID 4772 wrote to memory of 2380 4772 Sysqemoclbn.exe 101 PID 4772 wrote to memory of 2380 4772 Sysqemoclbn.exe 101 PID 2380 wrote to memory of 4360 2380 Sysqemtarcu.exe 102 PID 2380 wrote to memory of 4360 2380 Sysqemtarcu.exe 102 PID 2380 wrote to memory of 4360 2380 Sysqemtarcu.exe 102 PID 4360 wrote to memory of 536 4360 Sysqembipne.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\228aa4cf8aa952d51d4830b97c7fd2e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\228aa4cf8aa952d51d4830b97c7fd2e0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\Sysqempbgwi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempbgwi.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\Sysqembpywi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembpywi.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwgszf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwgszf.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgudhb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgudhb.exe"5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmwwni.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmwwni.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjxhfy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjxhfy.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwwkoy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwwkoy.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwsxyp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwsxyp.exe"9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjjlep.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjjlep.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyrzkb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyrzkb.exe"11⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\Sysqemowrdt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemowrdt.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzhiyd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzhiyd.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\Sysqembcmok.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembcmok.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtnkef.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtnkef.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\Sysqemroeky.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemroeky.exe"16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\Sysqemblhst.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemblhst.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrxetv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrxetv.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtsibk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtsibk.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\Sysqemoclbn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoclbn.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtarcu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtarcu.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\Sysqembipne.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembipne.exe"22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\Sysqemelskq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemelskq.exe"23⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\Sysqemttmdr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemttmdr.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\Sysqemabbix.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemabbix.exe"25⤵
- Executes dropped EXE
- Modifies registry class
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgksiz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgksiz.exe"26⤵
- Executes dropped EXE
- Modifies registry class
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\Sysqemauveq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemauveq.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlmlpg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlmlpg.exe"28⤵
- Executes dropped EXE
- Modifies registry class
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgdfre.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgdfre.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnwncm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnwncm.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\Sysqemljipr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemljipr.exe"31⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\Sysqemylpko.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemylpko.exe"32⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkqhso.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkqhso.exe"33⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlfgdr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlfgdr.exe"34⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqppmt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqppmt.exe"35⤵
- Executes dropped EXE
- Modifies registry class
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyiyjn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyiyjn.exe"36⤵
- Checks computer location settings
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtdefz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtdefz.exe"37⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnfsak.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnfsak.exe"38⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnnrqv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnnrqv.exe"39⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyitox.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyitox.exe"40⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaskdp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaskdp.exe"41⤵
- Executes dropped EXE
- Modifies registry class
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\Sysqemymher.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemymher.exe"42⤵
- Executes dropped EXE
- Modifies registry class
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\Sysqemseihu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemseihu.exe"43⤵
- Executes dropped EXE
- Modifies registry class
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfgpcz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfgpcz.exe"44⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\Sysqemabuks.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemabuks.exe"45⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqrpxk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqrpxk.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnsaqz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnsaqz.exe"47⤵
- Executes dropped EXE
- Modifies registry class
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvixbr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvixbr.exe"48⤵
- Checks computer location settings
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvahyw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvahyw.exe"49⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcfujt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcfujt.exe"50⤵
- Executes dropped EXE
- Modifies registry class
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnawhn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnawhn.exe"51⤵
- Checks computer location settings
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxluxt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxluxt.exe"52⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkqmft.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkqmft.exe"53⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsvyyw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsvyyw.exe"54⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcfonv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcfonv.exe"55⤵
- Executes dropped EXE
- Modifies registry class
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmqfdc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmqfdc.exe"56⤵
- Checks computer location settings
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzhggr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzhggr.exe"57⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrvgrn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrvgrn.exe"58⤵
- Executes dropped EXE
- Modifies registry class
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhahel.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhahel.exe"59⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkhxum.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkhxum.exe"60⤵
- Checks computer location settings
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkwvfx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkwvfx.exe"61⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnnwib.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnnwib.exe"62⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\Sysqemifqlq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemifqlq.exe"63⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\Sysqempbbic.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempbbic.exe"64⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnkuwj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnkuwj.exe"65⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\Sysqemklgoq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemklgoq.exe"66⤵
- Modifies registry class
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\Sysqempjmpy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempjmpy.exe"67⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmhuck.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmhuck.exe"68⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\Sysqempkyfi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempkyfi.exe"69⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\Sysqemznvvw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemznvvw.exe"70⤵
- Checks computer location settings
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuxyjn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuxyjn.exe"71⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmxcuy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmxcuy.exe"72⤵
- Checks computer location settings
- Modifies registry class
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjukzc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjukzc.exe"73⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\Sysqemcfhpq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcfhpq.exe"74⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\Sysqemhhrxs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhhrxs.exe"75⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjcvfy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjcvfy.exe"76⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\Sysqemrsrle.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrsrle.exe"77⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\Sysqemzwceh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzwceh.exe"78⤵
- Modifies registry class
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\Sysqemowxwi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemowxwi.exe"79⤵
- Modifies registry class
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhplbb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhplbb.exe"80⤵
- Checks computer location settings
- Modifies registry class
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\Sysqemejicd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemejicd.exe"81⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\Sysqemxnxsr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxnxsr.exe"82⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\Sysqemwndiq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwndiq.exe"83⤵
- Checks computer location settings
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\Sysqembtbdq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembtbdq.exe"84⤵
- Checks computer location settings
- Modifies registry class
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlhdgz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlhdgz.exe"85⤵
- Modifies registry class
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\Sysqemedcrn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemedcrn.exe"86⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\Sysqemgqghc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgqghc.exe"87⤵
- Checks computer location settings
- Modifies registry class
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrifss.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrifss.exe"88⤵
- Checks computer location settings
PID:436 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgrrkt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgrrkt.exe"89⤵
- Checks computer location settings
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\Sysqemupvsn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemupvsn.exe"90⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\Sysqembavlw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembavlw.exe"91⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\Sysqemgnqyb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgnqyb.exe"92⤵
- Modifies registry class
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtpfty.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtpfty.exe"93⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\Sysqemewkec.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemewkec.exe"94⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\Sysqemokvmp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemokvmp.exe"95⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\Sysqembrmue.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembrmue.exe"96⤵
- Checks computer location settings
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\Sysqemluokf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemluokf.exe"97⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\Sysqembrydo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembrydo.exe"98⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\Sysqemtrcan.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtrcan.exe"99⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\Sysqembvnti.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembvnti.exe"100⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\Sysqemgihon.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgihon.exe"101⤵
- Modifies registry class
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyismm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyismm.exe"102⤵
- Checks computer location settings
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqhvjl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqhvjl.exe"103⤵
- Modifies registry class
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlzxei.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlzxei.exe"104⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\Sysqemybfnr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemybfnr.exe"105⤵
- Modifies registry class
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlgyvr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlgyvr.exe"106⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\Sysqemguoll.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemguoll.exe"107⤵
- Modifies registry class
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjpsts.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjpsts.exe"108⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\Sysqemrtelv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrtelv.exe"109⤵
- Checks computer location settings
- Modifies registry class
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgfbrz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgfbrz.exe"110⤵
- Checks computer location settings
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlhqmw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlhqmw.exe"111⤵
- Checks computer location settings
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtiqrw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtiqrw.exe"112⤵
- Checks computer location settings
PID:212 -
C:\Users\Admin\AppData\Local\Temp\Sysqemabykw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemabykw.exe"113⤵
- Modifies registry class
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqrlxp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqrlxp.exe"114⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\Sysqembqyit.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembqyit.exe"115⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\Sysqemggwia.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemggwia.exe"116⤵
- Checks computer location settings
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtildx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtildx.exe"117⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\Sysqemirxwy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemirxwy.exe"118⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnapwa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnapwa.exe"119⤵
- Checks computer location settings
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlmlxk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlmlxk.exe"120⤵
- Modifies registry class
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\Sysqemviofx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemviofx.exe"121⤵
- Checks computer location settings
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsjifn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsjifn.exe"122⤵
- Modifies registry class
PID:3768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-