Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
50s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 10:15
Static task
static1
Behavioral task
behavioral1
Sample
9eedeb2eeb6302112cd796c8052a61c0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
9eedeb2eeb6302112cd796c8052a61c0N.exe
Resource
win10v2004-20240802-en
General
-
Target
9eedeb2eeb6302112cd796c8052a61c0N.exe
-
Size
728KB
-
MD5
9eedeb2eeb6302112cd796c8052a61c0
-
SHA1
b6d1cfac8b50eeefa46614184c68cca6d88826c6
-
SHA256
e28e4915de12b4c024d3aad5e30cd83b118484c44a46d86874f92d484b5be05a
-
SHA512
c31f9969dbbd463872ef2835572888536c0325dbd0fae14dfe8add643c3814d3ae955486a81a8118e223b61890a5a07d85317610ae3ddb941a41fe033211b4d5
-
SSDEEP
6144:dqDAwl0xPTMiR9JSSxPUKYGdodH/baqE7Al8jk2jcbaqE7Al8jk2jA:d+67XR9JSSxvYGdodH/1CVc1CVA
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemoucsx.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemvdfgd.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemcyylj.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemuwppo.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqembdgsa.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemlkdwo.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemossrw.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemiewwk.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemthakd.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemqdrey.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemyeqef.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemhnksx.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemqijhm.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemlocvm.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemnkuwj.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 9eedeb2eeb6302112cd796c8052a61c0N.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemlpooy.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqempuxxs.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemhymnf.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqempvhox.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemizsbb.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemxpyfs.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemvcedh.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemqsceh.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemihnhb.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemhbozy.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemomdkz.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemvhduc.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemnzhtw.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemctszb.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemfoaiw.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemeizkl.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemqecio.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemalptk.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemocwfe.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemlsqlg.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqempuphv.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemqyuli.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemacazs.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemngieu.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemmulah.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemcwthy.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemhkhgt.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemgwpet.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemdwoep.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemtsnnp.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemsmipl.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqempaegm.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemlvwkn.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqempafmg.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemfpzyy.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemfvnzr.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemnlvze.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemiokns.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemdcbfi.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemkolww.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemlowzo.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemmqwkf.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqembnodh.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemlbzlc.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemgzrbc.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemcjqzn.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemvimvc.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Sysqemckuka.exe -
Executes dropped EXE 64 IoCs
pid Process 4928 Sysqemrgisl.exe 1200 Sysqembnodh.exe 4760 Sysqemdxntz.exe 920 Sysqemjrzwk.exe 1272 Sysqemlbzlc.exe 4576 Sysqemtfjzm.exe 1348 Sysqemeunrv.exe 3320 Sysqemjzhrh.exe 4276 Sysqemqdrey.exe 4768 Sysqemyeqef.exe 4084 Sysqemgwpet.exe 2032 Sysqemoucsx.exe 4460 Sysqemomdkz.exe 3968 Sysqemlvwkn.exe 1616 Sysqembdgsa.exe 2268 Sysqemgqzat.exe 2484 Sysqembsfdl.exe 1392 Sysqemqecio.exe 912 Sysqemalptk.exe 3588 Sysqemlkdwo.exe 1276 Sysqemvrihk.exe 4344 Sysqemocwfe.exe 4712 Sysqemimzav.exe 1812 Sysqemthakd.exe 4516 Sysqemdpfvh.exe 4964 Sysqemvdfgd.exe 1352 Sysqemquhis.exe 1888 Sysqemdpqyy.exe 1496 Sysqemqgtbg.exe 4276 Sysqemdwoep.exe 2764 Sysqemqyuli.exe 1680 Sysqemgzrbc.exe 400 Sysqemlpooy.exe 1996 Sysqemvhduc.exe 3240 Sysqemossrw.exe 1276 Sysqemigfsf.exe 2404 Sysqemvimvc.exe 2364 Sysqemfpzyy.exe 1988 Sysqemizsbb.exe 4440 Sysqemioqlm.exe 2884 Sysqemqsceh.exe 4616 Sysqemgxljn.exe 1388 Sysqemqijhm.exe 1688 Sysqemxpyfs.exe 1092 Sysqemlocvm.exe 4664 Sysqemdcbfi.exe 2184 Sysqemtsnnp.exe 2200 Sysqemfutva.exe 2072 Sysqemvcedh.exe 1452 Sysqemlsqlg.exe 4880 Sysqemxmwbz.exe 2016 Sysqemkkzvi.exe 4196 Sysqemxxito.exe 3388 Sysqemkolww.exe 4884 Sysqemxmgqf.exe 3516 Sysqemiewwk.exe 2664 Sysqemlowzo.exe 2220 Sysqempuphv.exe 3700 Sysqemfvnzr.exe 4512 Sysqemsmipl.exe 2632 Sysqemafqau.exe 4384 Sysqemfoaiw.exe 1360 Sysqemnzhtw.exe 3784 Sysqemnlvze.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemqdrey.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemhkhgt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemnzhtw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxxito.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemngieu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemoucsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemqijhm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemkbzig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemkjjkn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvxqkk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemqgtbg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvimvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemfoaiw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemacazs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemihnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemtfjzm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqembdgsa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgxljn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemsmipl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqempafmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9eedeb2eeb6302112cd796c8052a61c0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlkdwo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemqecio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgzrbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemtsnnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemfvnzr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemfbsjc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgwpet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvhduc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemioqlm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlsqlg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemquhis.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqembykzw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxmgqf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemiewwk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemafqau.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemsjlfi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemnkuwj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqempuxxs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemyeqef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvdfgd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemcjqzn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemhymnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlbzlc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemqsceh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlowzo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqempaegm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemkkzvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgqzat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvcedh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemiokns.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemzdwem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemrgisl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemdwoep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqempawfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemmqwkf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemeizkl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemdpfvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemcyylj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemzqpco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemmjjtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemeunrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqembsfdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlocvm.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemihnhb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemckuka.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlsqlg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxmgqf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqempaegm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemocwfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqvxro.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemigfsf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemfoaiw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemfutva.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemiokns.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqempafmg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemfpzyy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqijhm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemimzav.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdwoep.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembsfdl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdpqyy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvcedh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemfevvo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemalptk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemftugq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemngieu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemueolz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrzfpl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjrzwk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtsnnp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvrihk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemkolww.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmulah.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqempvhox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzdwem.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgwpet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlkdwo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdpfvh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembykzw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvimvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemcwthy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxzknb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 9eedeb2eeb6302112cd796c8052a61c0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyeqef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemfzgcq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemacazs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqempawfv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtfjzm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemnlvze.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemioqlm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemiewwk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemktqvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlpooy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzqpco.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgzrbc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemkkzvi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlbzlc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqecio.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhkhgt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemcjqzn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhaqjx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlvwkn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmqwkf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemoobjq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemomdkz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuwppo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxmwbz.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2340 wrote to memory of 4928 2340 9eedeb2eeb6302112cd796c8052a61c0N.exe 85 PID 2340 wrote to memory of 4928 2340 9eedeb2eeb6302112cd796c8052a61c0N.exe 85 PID 2340 wrote to memory of 4928 2340 9eedeb2eeb6302112cd796c8052a61c0N.exe 85 PID 4928 wrote to memory of 1200 4928 Sysqemrgisl.exe 88 PID 4928 wrote to memory of 1200 4928 Sysqemrgisl.exe 88 PID 4928 wrote to memory of 1200 4928 Sysqemrgisl.exe 88 PID 1200 wrote to memory of 4760 1200 Sysqembnodh.exe 89 PID 1200 wrote to memory of 4760 1200 Sysqembnodh.exe 89 PID 1200 wrote to memory of 4760 1200 Sysqembnodh.exe 89 PID 4760 wrote to memory of 920 4760 Sysqemdxntz.exe 90 PID 4760 wrote to memory of 920 4760 Sysqemdxntz.exe 90 PID 4760 wrote to memory of 920 4760 Sysqemdxntz.exe 90 PID 920 wrote to memory of 1272 920 Sysqemjrzwk.exe 91 PID 920 wrote to memory of 1272 920 Sysqemjrzwk.exe 91 PID 920 wrote to memory of 1272 920 Sysqemjrzwk.exe 91 PID 1272 wrote to memory of 4576 1272 Sysqemlbzlc.exe 92 PID 1272 wrote to memory of 4576 1272 Sysqemlbzlc.exe 92 PID 1272 wrote to memory of 4576 1272 Sysqemlbzlc.exe 92 PID 4576 wrote to memory of 1348 4576 Sysqemtfjzm.exe 93 PID 4576 wrote to memory of 1348 4576 Sysqemtfjzm.exe 93 PID 4576 wrote to memory of 1348 4576 Sysqemtfjzm.exe 93 PID 1348 wrote to memory of 3320 1348 Sysqemeunrv.exe 94 PID 1348 wrote to memory of 3320 1348 Sysqemeunrv.exe 94 PID 1348 wrote to memory of 3320 1348 Sysqemeunrv.exe 94 PID 3320 wrote to memory of 4276 3320 Sysqemjzhrh.exe 123 PID 3320 wrote to memory of 4276 3320 Sysqemjzhrh.exe 123 PID 3320 wrote to memory of 4276 3320 Sysqemjzhrh.exe 123 PID 4276 wrote to memory of 4768 4276 Sysqemqdrey.exe 98 PID 4276 wrote to memory of 4768 4276 Sysqemqdrey.exe 98 PID 4276 wrote to memory of 4768 4276 Sysqemqdrey.exe 98 PID 4768 wrote to memory of 4084 4768 Sysqemyeqef.exe 99 PID 4768 wrote to memory of 4084 4768 Sysqemyeqef.exe 99 PID 4768 wrote to memory of 4084 4768 Sysqemyeqef.exe 99 PID 4084 wrote to memory of 2032 4084 Sysqemgwpet.exe 101 PID 4084 wrote to memory of 2032 4084 Sysqemgwpet.exe 101 PID 4084 wrote to memory of 2032 4084 Sysqemgwpet.exe 101 PID 2032 wrote to memory of 4460 2032 Sysqemoucsx.exe 103 PID 2032 wrote to memory of 4460 2032 Sysqemoucsx.exe 103 PID 2032 wrote to memory of 4460 2032 Sysqemoucsx.exe 103 PID 4460 wrote to memory of 3968 4460 Sysqemomdkz.exe 104 PID 4460 wrote to memory of 3968 4460 Sysqemomdkz.exe 104 PID 4460 wrote to memory of 3968 4460 Sysqemomdkz.exe 104 PID 3968 wrote to memory of 1616 3968 Sysqemlvwkn.exe 105 PID 3968 wrote to memory of 1616 3968 Sysqemlvwkn.exe 105 PID 3968 wrote to memory of 1616 3968 Sysqemlvwkn.exe 105 PID 1616 wrote to memory of 2268 1616 Sysqembdgsa.exe 106 PID 1616 wrote to memory of 2268 1616 Sysqembdgsa.exe 106 PID 1616 wrote to memory of 2268 1616 Sysqembdgsa.exe 106 PID 2268 wrote to memory of 2484 2268 Sysqemgqzat.exe 107 PID 2268 wrote to memory of 2484 2268 Sysqemgqzat.exe 107 PID 2268 wrote to memory of 2484 2268 Sysqemgqzat.exe 107 PID 2484 wrote to memory of 1392 2484 Sysqembsfdl.exe 109 PID 2484 wrote to memory of 1392 2484 Sysqembsfdl.exe 109 PID 2484 wrote to memory of 1392 2484 Sysqembsfdl.exe 109 PID 1392 wrote to memory of 912 1392 Sysqemqecio.exe 110 PID 1392 wrote to memory of 912 1392 Sysqemqecio.exe 110 PID 1392 wrote to memory of 912 1392 Sysqemqecio.exe 110 PID 912 wrote to memory of 3588 912 Sysqemalptk.exe 111 PID 912 wrote to memory of 3588 912 Sysqemalptk.exe 111 PID 912 wrote to memory of 3588 912 Sysqemalptk.exe 111 PID 3588 wrote to memory of 1276 3588 Sysqemlkdwo.exe 130 PID 3588 wrote to memory of 1276 3588 Sysqemlkdwo.exe 130 PID 3588 wrote to memory of 1276 3588 Sysqemlkdwo.exe 130 PID 1276 wrote to memory of 4344 1276 Sysqemvrihk.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\9eedeb2eeb6302112cd796c8052a61c0N.exe"C:\Users\Admin\AppData\Local\Temp\9eedeb2eeb6302112cd796c8052a61c0N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrgisl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrgisl.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\Sysqembnodh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembnodh.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdxntz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdxntz.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjrzwk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjrzwk.exe"5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlbzlc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlbzlc.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtfjzm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtfjzm.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeunrv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeunrv.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjzhrh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjzhrh.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqdrey.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqdrey.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyeqef.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyeqef.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgwpet.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgwpet.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\Sysqemoucsx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoucsx.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\Sysqemomdkz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemomdkz.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlvwkn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlvwkn.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\Sysqembdgsa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembdgsa.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgqzat.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgqzat.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\Sysqembsfdl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembsfdl.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqecio.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqecio.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\Sysqemalptk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemalptk.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlkdwo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlkdwo.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvrihk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvrihk.exe"22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\Sysqemocwfe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemocwfe.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\Sysqemimzav.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemimzav.exe"24⤵
- Executes dropped EXE
- Modifies registry class
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\Sysqemthakd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemthakd.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdpfvh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdpfvh.exe"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvdfgd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvdfgd.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\Sysqemquhis.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemquhis.exe"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdpqyy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdpqyy.exe"29⤵
- Executes dropped EXE
- Modifies registry class
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqgtbg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqgtbg.exe"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdwoep.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdwoep.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqyuli.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqyuli.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgzrbc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgzrbc.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlpooy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlpooy.exe"34⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:400 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvhduc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvhduc.exe"35⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\Sysqemossrw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemossrw.exe"36⤵
- Checks computer location settings
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\Sysqembykzw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembykzw.exe"37⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\Sysqemigfsf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemigfsf.exe"38⤵
- Executes dropped EXE
- Modifies registry class
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvimvc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvimvc.exe"39⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfpzyy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfpzyy.exe"40⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\Sysqemizsbb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemizsbb.exe"41⤵
- Checks computer location settings
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\Sysqemioqlm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemioqlm.exe"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqsceh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqsceh.exe"43⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgxljn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgxljn.exe"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqijhm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqijhm.exe"45⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxpyfs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxpyfs.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlocvm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlocvm.exe"47⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdcbfi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdcbfi.exe"48⤵
- Checks computer location settings
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtsnnp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtsnnp.exe"49⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfutva.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfutva.exe"50⤵
- Executes dropped EXE
- Modifies registry class
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvcedh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvcedh.exe"51⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlsqlg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlsqlg.exe"52⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxmwbz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxmwbz.exe"53⤵
- Executes dropped EXE
- Modifies registry class
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkkzvi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkkzvi.exe"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxxito.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxxito.exe"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkolww.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkolww.exe"56⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxmgqf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxmgqf.exe"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\Sysqemiewwk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiewwk.exe"58⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlowzo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlowzo.exe"59⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\Sysqempuphv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempuphv.exe"60⤵
- Checks computer location settings
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfvnzr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfvnzr.exe"61⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsmipl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsmipl.exe"62⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\Sysqemafqau.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemafqau.exe"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfoaiw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfoaiw.exe"64⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnzhtw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnzhtw.exe"65⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnlvze.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnlvze.exe"66⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\Sysqemicptt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemicptt.exe"67⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\Sysqemacazs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemacazs.exe"68⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqvxro.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqvxro.exe"69⤵
- Modifies registry class
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcjqzn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcjqzn.exe"70⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\Sysqemihnhb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemihnhb.exe"71⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvxqkk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvxqkk.exe"72⤵
- System Location Discovery: System Language Discovery
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\Sysqemiokns.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiokns.exe"73⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsjlfi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsjlfi.exe"74⤵
- System Location Discovery: System Language Discovery
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfevvo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfevvo.exe"75⤵
- Modifies registry class
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\Sysqempawfv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempawfv.exe"76⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\Sysqemftugq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemftugq.exe"77⤵
- Modifies registry class
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcyylj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcyylj.exe"78⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxbtjv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxbtjv.exe"79⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\Sysqemfbsjc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfbsjc.exe"80⤵
- System Location Discovery: System Language Discovery
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\Sysqempaegm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempaegm.exe"81⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\Sysqempafmg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempafmg.exe"82⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhaqjx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhaqjx.exe"83⤵
- Modifies registry class
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmqwkf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmqwkf.exe"84⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\Sysqemckuka.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemckuka.exe"85⤵
- Checks computer location settings
- Modifies registry class
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmulah.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmulah.exe"86⤵
- Checks computer location settings
- Modifies registry class
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmjjtj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmjjtj.exe"87⤵
- System Location Discovery: System Language Discovery
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\Sysqemngieu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemngieu.exe"88⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnkuwj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnkuwj.exe"89⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhbozy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhbozy.exe"90⤵
- Checks computer location settings
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcwthy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcwthy.exe"91⤵
- Checks computer location settings
- Modifies registry class
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzqpco.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzqpco.exe"92⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\Sysqempuxxs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempuxxs.exe"93⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\Sysqemctszb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemctszb.exe"94⤵
- Checks computer location settings
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\Sysqempnyhm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempnyhm.exe"95⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\Sysqemfzgcq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfzgcq.exe"96⤵
- Modifies registry class
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrtmsb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrtmsb.exe"97⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\Sysqemhymnf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhymnf.exe"98⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuwppo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuwppo.exe"99⤵
- Checks computer location settings
- Modifies registry class
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhnksx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhnksx.exe"100⤵
- Checks computer location settings
PID:100 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxzknb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxzknb.exe"101⤵
- Modifies registry class
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\Sysqemktqvm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemktqvm.exe"102⤵
- Modifies registry class
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkbzig.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkbzig.exe"103⤵
- System Location Discovery: System Language Discovery
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\Sysqemueolz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemueolz.exe"104⤵
- Modifies registry class
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\Sysqempvhox.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempvhox.exe"105⤵
- Checks computer location settings
- Modifies registry class
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhkhgt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhkhgt.exe"106⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzdwem.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzdwem.exe"107⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\Sysqemoobjq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoobjq.exe"108⤵
- Modifies registry class
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeizkl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeizkl.exe"109⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkjjkn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkjjkn.exe"110⤵
- System Location Discovery: System Language Discovery
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrzfpl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrzfpl.exe"111⤵
- Modifies registry class
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjggsb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjggsb.exe"112⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\Sysqembcgdx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembcgdx.exe"113⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\Sysqemcrewi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcrewi.exe"114⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\Sysqemzlbok.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzlbok.exe"115⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\Sysqemksozo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemksozo.exe"116⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\Sysqemhxlfy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhxlfy.exe"117⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\Sysqemxnxsr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxnxsr.exe"118⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\Sysqembwbfb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembwbfb.exe"119⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\Sysqemgiway.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgiway.exe"120⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\Sysqemrpjdc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrpjdc.exe"121⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\Sysqemritbi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemritbi.exe"122⤵PID:3852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-