Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 02:36
Static task
static1
Behavioral task
behavioral1
Sample
324b7e7a3cf7cb9a7f30ff559c8e7dd7149c7da803b3b5eb42de45b57aa2dbb0_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
324b7e7a3cf7cb9a7f30ff559c8e7dd7149c7da803b3b5eb42de45b57aa2dbb0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
324b7e7a3cf7cb9a7f30ff559c8e7dd7149c7da803b3b5eb42de45b57aa2dbb0_NeikiAnalytics.exe
-
Size
531KB
-
MD5
3a72bb6ed6da0ad443195da42acd22c0
-
SHA1
2b94d0da17b9d8e24e8613d3d93332c03cfe340e
-
SHA256
324b7e7a3cf7cb9a7f30ff559c8e7dd7149c7da803b3b5eb42de45b57aa2dbb0
-
SHA512
f9a07082b1ff1f4b77beb1d49909f461bad8f150e96292c36389b6a59135e87d2b3de434ac874f9acb1cc7a3d8fc3cb74f96cb749dca09893a61bc8f056dac24
-
SSDEEP
3072:4Cao5s1x1Pkl0xPTM7mRCAdJSSxPUkl3VyFNdQMQTCk/dN92sdNhavtrVdewnAxp:4qal8l0xPTMiR9JSSxPUKYGdodHm
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemaaojv.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemgwuas.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemjdvpj.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemwkieo.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqempsppq.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemwrcbk.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemtfaqv.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemsrgtd.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemxgngq.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemgtiqz.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemitmrq.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemsnscb.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemfxukq.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemiqlsx.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemtwbdj.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemvixbr.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemkxreo.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemizcbf.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemmytap.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemtcmvo.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemikjwt.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemwagea.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemoultw.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemilewl.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemcvxxd.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemupimr.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemmkhak.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemgaqrm.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemziafn.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemefscu.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemdenjx.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqembtbdq.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemgqrhy.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemknhwk.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemrmcnq.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemiqqxd.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemexnus.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemjkfmu.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemhdjkj.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemvsnct.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemdlgqv.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemrzqtk.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemnapwa.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemdankq.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemsusyr.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemjvvme.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemvnpyi.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemalekf.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemsiqyd.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemuxzwz.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemkyxwu.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemenaaw.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemqfycf.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemgcxcz.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemquhis.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemgwohy.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemdyekv.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemcdmen.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemhouvc.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemacpbs.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemqusxg.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemsqeix.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemmakdc.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Sysqemikjgd.exe -
Executes dropped EXE 64 IoCs
pid Process 4340 Sysqemrmcnq.exe 4012 Sysqemmakdc.exe 1988 Sysqemqfdlk.exe 1288 Sysqemjyrjd.exe 4032 Sysqemwagea.exe 1356 Sysqemgcxcz.exe 2936 Sysqemteexe.exe 5012 Sysqemjgcpz.exe 912 Sysqemdbpfr.exe 1932 Sysqemwldll.exe 3780 Sysqemgwuas.exe 2004 Sysqemqhkqq.exe 4484 Sysqemgaqrm.exe 880 Sysqemtcxmj.exe 1852 Sysqemjvvme.exe 3248 Sysqemwxchj.exe 3096 Sysqemjdvpj.exe 4772 Sysqembzvaf.exe 4656 Sysqemoqodu.exe 1848 Sysqemybnsb.exe 1388 Sysqemoultw.exe 1716 Sysqemilewl.exe 840 Sysqemwkieo.exe 1536 Sysqemitmrq.exe 3716 Sysqemyjzej.exe 4968 Sysqemixahs.exe 4480 Sysqemdlrxf.exe 4360 Sysqembizkr.exe 4596 Sysqemycwlt.exe 1824 Sysqemquhis.exe 2452 Sysqemgvfbn.exe 2804 Sysqemvwrbo.exe 4148 Sysqemqkhri.exe 3064 Sysqemdpazi.exe 2652 Sysqemtfunb.exe 756 Sysqemgwohy.exe 4748 Sysqemsnscb.exe 2292 Sysqemdjuau.exe 5080 Sysqemsrgtd.exe 2600 Sysqemftnoa.exe 3652 Sysqemsvcjx.exe 4480 Sysqemlgroq.exe 4360 Sysqemsoomw.exe 1712 Sysqemdyekv.exe 4960 Sysqemvjtho.exe 1800 Sysqemfxukq.exe 2804 Sysqemvnpyi.exe 4224 Sysqemapyls.exe 3544 Sysqemtwbdj.exe 2396 Sysqemfffru.exe 4736 Sysqemczbmk.exe 5072 Sysqemcdmen.exe 3356 Sysqemsxkxi.exe 4520 Sysqemiqqxd.exe 5036 Sysqemvsxsa.exe 4868 Sysqemkxgfy.exe 5092 Sysqemdlgqv.exe 3596 Sysqemvixbr.exe 2652 Sysqemktdou.exe 680 Sysqemizcbf.exe 2292 Sysqemkxreo.exe 220 Sysqemfaxhg.exe 332 Sysqemarykv.exe 1184 Sysqempzlce.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemiqqxd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemikjgd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmkhak.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemcfhpq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemoultw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdjuau.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrltfz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqkrxs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvwrbo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemeqefn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdpazi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhdjkj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemnapwa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwldll.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdlrxf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemitmrq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemknhwk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsqeix.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlqtuw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyxrxp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuxzwz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqusxg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemiqlsx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemffiok.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqfycf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemacpbs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvsxsa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqempeswx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemkautf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmytap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlkzuy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhyizz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrmcnq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgwuas.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemefyao.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 324b7e7a3cf7cb9a7f30ff559c8e7dd7149c7da803b3b5eb42de45b57aa2dbb0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemoojnw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemarykv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemkyxwu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjjsnx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemquhis.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsnscb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemcpqni.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdyekv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtwbdj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemapyls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxgngq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemumyzv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemobwxb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsxkxi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxehyy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzgxtb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrzqtk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdankq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqkhri.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemfzgcq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvixbr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemffebq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemswego.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtfaqv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjdvpj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembizkr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembtbdq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemikjwt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2536 wrote to memory of 4340 2536 324b7e7a3cf7cb9a7f30ff559c8e7dd7149c7da803b3b5eb42de45b57aa2dbb0_NeikiAnalytics.exe 80 PID 2536 wrote to memory of 4340 2536 324b7e7a3cf7cb9a7f30ff559c8e7dd7149c7da803b3b5eb42de45b57aa2dbb0_NeikiAnalytics.exe 80 PID 2536 wrote to memory of 4340 2536 324b7e7a3cf7cb9a7f30ff559c8e7dd7149c7da803b3b5eb42de45b57aa2dbb0_NeikiAnalytics.exe 80 PID 4340 wrote to memory of 4012 4340 Sysqemrmcnq.exe 81 PID 4340 wrote to memory of 4012 4340 Sysqemrmcnq.exe 81 PID 4340 wrote to memory of 4012 4340 Sysqemrmcnq.exe 81 PID 4012 wrote to memory of 1988 4012 Sysqemmakdc.exe 82 PID 4012 wrote to memory of 1988 4012 Sysqemmakdc.exe 82 PID 4012 wrote to memory of 1988 4012 Sysqemmakdc.exe 82 PID 1988 wrote to memory of 1288 1988 Sysqemqfdlk.exe 83 PID 1988 wrote to memory of 1288 1988 Sysqemqfdlk.exe 83 PID 1988 wrote to memory of 1288 1988 Sysqemqfdlk.exe 83 PID 1288 wrote to memory of 4032 1288 Sysqemjyrjd.exe 84 PID 1288 wrote to memory of 4032 1288 Sysqemjyrjd.exe 84 PID 1288 wrote to memory of 4032 1288 Sysqemjyrjd.exe 84 PID 4032 wrote to memory of 1356 4032 Sysqemwagea.exe 85 PID 4032 wrote to memory of 1356 4032 Sysqemwagea.exe 85 PID 4032 wrote to memory of 1356 4032 Sysqemwagea.exe 85 PID 1356 wrote to memory of 2936 1356 Sysqemgcxcz.exe 86 PID 1356 wrote to memory of 2936 1356 Sysqemgcxcz.exe 86 PID 1356 wrote to memory of 2936 1356 Sysqemgcxcz.exe 86 PID 2936 wrote to memory of 5012 2936 Sysqemteexe.exe 87 PID 2936 wrote to memory of 5012 2936 Sysqemteexe.exe 87 PID 2936 wrote to memory of 5012 2936 Sysqemteexe.exe 87 PID 5012 wrote to memory of 912 5012 Sysqemjgcpz.exe 88 PID 5012 wrote to memory of 912 5012 Sysqemjgcpz.exe 88 PID 5012 wrote to memory of 912 5012 Sysqemjgcpz.exe 88 PID 912 wrote to memory of 1932 912 Sysqemdbpfr.exe 89 PID 912 wrote to memory of 1932 912 Sysqemdbpfr.exe 89 PID 912 wrote to memory of 1932 912 Sysqemdbpfr.exe 89 PID 1932 wrote to memory of 3780 1932 Sysqemwldll.exe 90 PID 1932 wrote to memory of 3780 1932 Sysqemwldll.exe 90 PID 1932 wrote to memory of 3780 1932 Sysqemwldll.exe 90 PID 3780 wrote to memory of 2004 3780 Sysqemgwuas.exe 91 PID 3780 wrote to memory of 2004 3780 Sysqemgwuas.exe 91 PID 3780 wrote to memory of 2004 3780 Sysqemgwuas.exe 91 PID 2004 wrote to memory of 4484 2004 Sysqemqhkqq.exe 92 PID 2004 wrote to memory of 4484 2004 Sysqemqhkqq.exe 92 PID 2004 wrote to memory of 4484 2004 Sysqemqhkqq.exe 92 PID 4484 wrote to memory of 880 4484 Sysqemgaqrm.exe 93 PID 4484 wrote to memory of 880 4484 Sysqemgaqrm.exe 93 PID 4484 wrote to memory of 880 4484 Sysqemgaqrm.exe 93 PID 880 wrote to memory of 1852 880 Sysqemtcxmj.exe 94 PID 880 wrote to memory of 1852 880 Sysqemtcxmj.exe 94 PID 880 wrote to memory of 1852 880 Sysqemtcxmj.exe 94 PID 1852 wrote to memory of 3248 1852 Sysqemjvvme.exe 95 PID 1852 wrote to memory of 3248 1852 Sysqemjvvme.exe 95 PID 1852 wrote to memory of 3248 1852 Sysqemjvvme.exe 95 PID 3248 wrote to memory of 3096 3248 Sysqemwxchj.exe 96 PID 3248 wrote to memory of 3096 3248 Sysqemwxchj.exe 96 PID 3248 wrote to memory of 3096 3248 Sysqemwxchj.exe 96 PID 3096 wrote to memory of 4772 3096 Sysqemjdvpj.exe 97 PID 3096 wrote to memory of 4772 3096 Sysqemjdvpj.exe 97 PID 3096 wrote to memory of 4772 3096 Sysqemjdvpj.exe 97 PID 4772 wrote to memory of 4656 4772 Sysqembzvaf.exe 98 PID 4772 wrote to memory of 4656 4772 Sysqembzvaf.exe 98 PID 4772 wrote to memory of 4656 4772 Sysqembzvaf.exe 98 PID 4656 wrote to memory of 1848 4656 Sysqemoqodu.exe 99 PID 4656 wrote to memory of 1848 4656 Sysqemoqodu.exe 99 PID 4656 wrote to memory of 1848 4656 Sysqemoqodu.exe 99 PID 1848 wrote to memory of 1388 1848 Sysqemybnsb.exe 100 PID 1848 wrote to memory of 1388 1848 Sysqemybnsb.exe 100 PID 1848 wrote to memory of 1388 1848 Sysqemybnsb.exe 100 PID 1388 wrote to memory of 1716 1388 Sysqemoultw.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\324b7e7a3cf7cb9a7f30ff559c8e7dd7149c7da803b3b5eb42de45b57aa2dbb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\324b7e7a3cf7cb9a7f30ff559c8e7dd7149c7da803b3b5eb42de45b57aa2dbb0_NeikiAnalytics.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrmcnq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrmcnq.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmakdc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmakdc.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqfdlk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqfdlk.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjyrjd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjyrjd.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwagea.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwagea.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgcxcz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgcxcz.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\Sysqemteexe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemteexe.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjgcpz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjgcpz.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdbpfr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdbpfr.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwldll.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwldll.exe"11⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgwuas.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgwuas.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqhkqq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqhkqq.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgaqrm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgaqrm.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtcxmj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtcxmj.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjvvme.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjvvme.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwxchj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwxchj.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjdvpj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjdvpj.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\Sysqembzvaf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembzvaf.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\Sysqemoqodu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoqodu.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\Sysqemybnsb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemybnsb.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\Sysqemoultw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoultw.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\Sysqemilewl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemilewl.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwkieo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwkieo.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\Sysqemitmrq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemitmrq.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyjzej.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyjzej.exe"26⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\Sysqemixahs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemixahs.exe"27⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdlrxf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdlrxf.exe"28⤵
- Executes dropped EXE
- Modifies registry class
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\Sysqembizkr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembizkr.exe"29⤵
- Executes dropped EXE
- Modifies registry class
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\Sysqemycwlt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemycwlt.exe"30⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\Sysqemquhis.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemquhis.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgvfbn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgvfbn.exe"32⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvwrbo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvwrbo.exe"33⤵
- Executes dropped EXE
- Modifies registry class
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqkhri.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqkhri.exe"34⤵
- Executes dropped EXE
- Modifies registry class
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdpazi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdpazi.exe"35⤵
- Executes dropped EXE
- Modifies registry class
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtfunb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtfunb.exe"36⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgwohy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgwohy.exe"37⤵
- Checks computer location settings
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsnscb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsnscb.exe"38⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdjuau.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdjuau.exe"39⤵
- Executes dropped EXE
- Modifies registry class
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsrgtd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsrgtd.exe"40⤵
- Checks computer location settings
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\Sysqemftnoa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemftnoa.exe"41⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsvcjx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsvcjx.exe"42⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlgroq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlgroq.exe"43⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsoomw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsoomw.exe"44⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdyekv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdyekv.exe"45⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvjtho.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvjtho.exe"46⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfxukq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfxukq.exe"47⤵
- Checks computer location settings
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvnpyi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvnpyi.exe"48⤵
- Checks computer location settings
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\Sysqemapyls.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemapyls.exe"49⤵
- Executes dropped EXE
- Modifies registry class
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtwbdj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtwbdj.exe"50⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfffru.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfffru.exe"51⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\Sysqemczbmk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemczbmk.exe"52⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcdmen.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcdmen.exe"53⤵
- Checks computer location settings
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsxkxi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsxkxi.exe"54⤵
- Executes dropped EXE
- Modifies registry class
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\Sysqemiqqxd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiqqxd.exe"55⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvsxsa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvsxsa.exe"56⤵
- Executes dropped EXE
- Modifies registry class
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkxgfy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkxgfy.exe"57⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdlgqv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdlgqv.exe"58⤵
- Checks computer location settings
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvixbr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvixbr.exe"59⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\Sysqemktdou.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemktdou.exe"60⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\Sysqemizcbf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemizcbf.exe"61⤵
- Checks computer location settings
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkxreo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkxreo.exe"62⤵
- Checks computer location settings
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfaxhg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfaxhg.exe"63⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\Sysqemarykv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemarykv.exe"64⤵
- Executes dropped EXE
- Modifies registry class
PID:332 -
C:\Users\Admin\AppData\Local\Temp\Sysqempzlce.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempzlce.exe"65⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxdwvz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxdwvz.exe"66⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\Sysqemikjgd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemikjgd.exe"67⤵
- Checks computer location settings
- Modifies registry class
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxehyy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxehyy.exe"68⤵
- Modifies registry class
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\Sysqempeswx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempeswx.exe"69⤵
- Modifies registry class
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\Sysqempidos.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempidos.exe"70⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\Sysqemffebq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemffebq.exe"71⤵
- Modifies registry class
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\Sysqemexnus.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemexnus.exe"72⤵
- Checks computer location settings
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\Sysqemalekf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemalekf.exe"73⤵
- Checks computer location settings
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhtshk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhtshk.exe"74⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\Sysqemcvxxd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcvxxd.exe"75⤵
- Checks computer location settings
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\Sysqemefyao.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemefyao.exe"76⤵
- Modifies registry class
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\Sysqemckxnz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemckxnz.exe"77⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\Sysqemkautf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkautf.exe"78⤵
- Modifies registry class
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\Sysqemswego.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemswego.exe"79⤵
- Modifies registry class
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsiqyd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsiqyd.exe"80⤵
- Checks computer location settings
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxgngq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxgngq.exe"81⤵
- Checks computer location settings
- Modifies registry class
PID:372 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmoihr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmoihr.exe"82⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\Sysqemupimr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemupimr.exe"83⤵
- Checks computer location settings
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfzgcq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfzgcq.exe"84⤵
- Modifies registry class
PID:212 -
C:\Users\Admin\AppData\Local\Temp\Sysqemziafn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemziafn.exe"85⤵
- Checks computer location settings
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmkhak.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmkhak.exe"86⤵
- Checks computer location settings
- Modifies registry class
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcpqni.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcpqni.exe"87⤵
- Modifies registry class
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhouvc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhouvc.exe"88⤵
- Checks computer location settings
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzgxtb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzgxtb.exe"89⤵
- Modifies registry class
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuxzwz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuxzwz.exe"90⤵
- Checks computer location settings
- Modifies registry class
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkyxwu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkyxwu.exe"91⤵
- Checks computer location settings
- Modifies registry class
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\Sysqemumyzv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemumyzv.exe"92⤵
- Modifies registry class
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\Sysqempsppq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempsppq.exe"93⤵
- Checks computer location settings
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcfhpq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcfhpq.exe"94⤵
- Modifies registry class
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuuzim.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuuzim.exe"95⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\Sysqemknfah.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemknfah.exe"96⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\Sysqemrzqtk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrzqtk.exe"97⤵
- Checks computer location settings
- Modifies registry class
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwqwts.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwqwts.exe"98⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\Sysqemccrox.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemccrox.exe"99⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjkfmu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjkfmu.exe"100⤵
- Checks computer location settings
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\Sysqemefscu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemefscu.exe"101⤵
- Checks computer location settings
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\Sysqemugqcq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemugqcq.exe"102⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmytap.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmytap.exe"103⤵
- Checks computer location settings
- Modifies registry class
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\Sysqemobwxb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemobwxb.exe"104⤵
- Modifies registry class
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmkfyd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmkfyd.exe"105⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjwbtt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjwbtt.exe"106⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\Sysqembtbdq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembtbdq.exe"107⤵
- Checks computer location settings
- Modifies registry class
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtwxor.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtwxor.exe"108⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjmkbk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjmkbk.exe"109⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\Sysqemwrcbk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwrcbk.exe"110⤵
- Checks computer location settings
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\Sysqemevoun.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemevoun.exe"111⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjmtuu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjmtuu.exe"112⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjjsnx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjjsnx.exe"113⤵
- Modifies registry class
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqusxg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqusxg.exe"114⤵
- Checks computer location settings
- Modifies registry class
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrffdg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrffdg.exe"115⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\Sysqemehuyd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemehuyd.exe"116⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmxjwj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmxjwj.exe"117⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\Sysqemlqtuw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlqtuw.exe"118⤵
- Modifies registry class
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhdjkj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhdjkj.exe"119⤵
- Checks computer location settings
- Modifies registry class
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeqefn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeqefn.exe"120⤵
- Modifies registry class
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqvxfn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqvxfn.exe"121⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\Sysqemtcmvo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtcmvo.exe"122⤵
- Checks computer location settings
PID:4488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-