Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
62s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 01:11
Static task
static1
Behavioral task
behavioral1
Sample
af12692a68de7a9e9b06b4ef4f250059d343d9f4448eb7b34d84d9224cd1a3ccN.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
af12692a68de7a9e9b06b4ef4f250059d343d9f4448eb7b34d84d9224cd1a3ccN.exe
Resource
win10v2004-20240802-en
General
-
Target
af12692a68de7a9e9b06b4ef4f250059d343d9f4448eb7b34d84d9224cd1a3ccN.exe
-
Size
519KB
-
MD5
90c22099cf3775b2a1b7b2c500b6af40
-
SHA1
a6a4ffa617cdce17c08272543549c70e1aca4df5
-
SHA256
af12692a68de7a9e9b06b4ef4f250059d343d9f4448eb7b34d84d9224cd1a3cc
-
SHA512
2b89dbc2e5b68f6d0e8424306772f5f8b06d7e7f0a54da848779d3511e3bc3e5489ce0a52e1ed1f73e16787699ae512b975db9f52a3038f8547b57522372b0e9
-
SSDEEP
3072:dCaoAs101Pol0xPTM7mRCAdJSSxPUkl3VyFNdQMQTCk/dN92sdNhavtrVdewnAxY:dqDAwl0xPTMiR9JSSxPUKYGdodHX
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3028 Sysqemyohie.exe 2704 Sysqemvtenw.exe 572 Sysqemafxnp.exe 2076 Sysqemmamvv.exe 2928 Sysqemqjsal.exe 2912 Sysqemuvkyp.exe 1148 Sysqemcdxyj.exe 3060 Sysqemlywlt.exe 2412 Sysqemyprob.exe 2052 Sysqemzddbq.exe 1336 Sysqemzvetk.exe 2464 Sysqemysaov.exe 2508 Sysqemiyaml.exe 2500 Sysqemzfzje.exe 1916 Sysqempvkjl.exe 2796 Sysqemektcr.exe 2880 Sysqemthbbe.exe 2608 Sysqemfyfwg.exe 2068 Sysqemtlomm.exe 2852 Sysqemejhzu.exe 2824 Sysqemuddme.exe 2816 Sysqemrwwzi.exe 2024 Sysqemgmhhp.exe 2236 Sysqemlvnmf.exe 1848 Sysqemgtgxa.exe 2656 Sysqemqltnm.exe 3020 Sysqemzztkc.exe 2120 Sysqemzojpt.exe 1484 Sysqemolrpg.exe 2268 Sysqemamvvl.exe 2288 Sysqemtuyah.exe 2724 Sysqemhusfz.exe 2052 Sysqemuhjvf.exe 2740 Sysqempgrqz.exe 1056 Sysqemezolj.exe 1316 Sysqemqudlw.exe 2180 Sysqemgbptd.exe 1284 Sysqemaptoe.exe 2780 Sysqempiqan.exe 2880 Sysqemjhfvx.exe 340 Sysqemrpbwr.exe 2352 Sysqemlyudx.exe 3044 Sysqemnfjgm.exe 1644 Sysqemqpaee.exe 1152 Sysqemcrglq.exe 3036 Sysqemjrcwe.exe 2204 Sysqemzkzrn.exe 2520 Sysqemowfwr.exe 1576 Sysqemdtfwd.exe 1524 Sysqemvwthx.exe 3040 Sysqemaxjco.exe 2332 Sysqemtamcn.exe 2504 Sysqemmhohs.exe 1900 Sysqemyfgub.exe 2096 Sysqemovsch.exe 2480 Sysqemvdnuc.exe 1796 Sysqemmcnca.exe 2056 Sysqemcszkh.exe 2532 Sysqemdbosz.exe 1896 Sysqemvmbkh.exe 1684 Sysqemscjdu.exe 632 Sysqemknxvc.exe 2432 Sysqemuekdo.exe 2280 Sysqembyiqd.exe -
Loads dropped DLL 64 IoCs
pid Process 2736 af12692a68de7a9e9b06b4ef4f250059d343d9f4448eb7b34d84d9224cd1a3ccN.exe 2736 af12692a68de7a9e9b06b4ef4f250059d343d9f4448eb7b34d84d9224cd1a3ccN.exe 3028 Sysqemyohie.exe 3028 Sysqemyohie.exe 2704 Sysqemvtenw.exe 2704 Sysqemvtenw.exe 572 Sysqemafxnp.exe 572 Sysqemafxnp.exe 2076 Sysqemmamvv.exe 2076 Sysqemmamvv.exe 2928 Sysqemqjsal.exe 2928 Sysqemqjsal.exe 2912 Sysqemuvkyp.exe 2912 Sysqemuvkyp.exe 1148 Sysqemcdxyj.exe 1148 Sysqemcdxyj.exe 3060 Sysqemlywlt.exe 3060 Sysqemlywlt.exe 2412 Sysqemyprob.exe 2412 Sysqemyprob.exe 2052 Sysqemzddbq.exe 2052 Sysqemzddbq.exe 1336 Sysqemzvetk.exe 1336 Sysqemzvetk.exe 2464 Sysqemysaov.exe 2464 Sysqemysaov.exe 2508 Sysqemiyaml.exe 2508 Sysqemiyaml.exe 2500 Sysqemzfzje.exe 2500 Sysqemzfzje.exe 1916 Sysqempvkjl.exe 1916 Sysqempvkjl.exe 2796 Sysqemektcr.exe 2796 Sysqemektcr.exe 2880 Sysqemthbbe.exe 2880 Sysqemthbbe.exe 2608 Sysqemfyfwg.exe 2608 Sysqemfyfwg.exe 2068 Sysqemtlomm.exe 2068 Sysqemtlomm.exe 2852 Sysqemejhzu.exe 2852 Sysqemejhzu.exe 2824 Sysqemuddme.exe 2824 Sysqemuddme.exe 2816 Sysqemrwwzi.exe 2816 Sysqemrwwzi.exe 2024 Sysqemgmhhp.exe 2024 Sysqemgmhhp.exe 2236 Sysqemlvnmf.exe 2236 Sysqemlvnmf.exe 1848 Sysqemgtgxa.exe 1848 Sysqemgtgxa.exe 2656 Sysqemqltnm.exe 2656 Sysqemqltnm.exe 3020 Sysqemzztkc.exe 3020 Sysqemzztkc.exe 2120 Sysqemzojpt.exe 2120 Sysqemzojpt.exe 1484 Sysqemolrpg.exe 1484 Sysqemolrpg.exe 2268 Sysqemamvvl.exe 2268 Sysqemamvvl.exe 2288 Sysqemtuyah.exe 2288 Sysqemtuyah.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemewwvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemshoot.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language af12692a68de7a9e9b06b4ef4f250059d343d9f4448eb7b34d84d9224cd1a3ccN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemthbbe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemdujhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemzfzje.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxcnmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemwnrxa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemwsquw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvtenw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemysaov.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlyudx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvmbkh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemeudoy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemuojzg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemyohie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemqjsal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemplejy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemiddpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemtwdtc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemtgatk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemzebat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgsyvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqempoigw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemjovmk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemrwwzi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemqudlw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemovsch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemcszkh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemfeetu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemzddbq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemzvetk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemzvlbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvzsqk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlctcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxogza.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemoncbs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemzztkc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemaptoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemirnbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqembarxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemnfjgm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemslxtz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemejhzu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgmhhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvriku.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvwxln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxpjvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemjrcwe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemzkzrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemupool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlvnmf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemuhjvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgomip.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemmhohs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemmcnca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemuekdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemunmzh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemuvkyp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemfyfwg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemhusfz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemqubda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemmamvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemolrpg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2736 wrote to memory of 3028 2736 af12692a68de7a9e9b06b4ef4f250059d343d9f4448eb7b34d84d9224cd1a3ccN.exe 30 PID 2736 wrote to memory of 3028 2736 af12692a68de7a9e9b06b4ef4f250059d343d9f4448eb7b34d84d9224cd1a3ccN.exe 30 PID 2736 wrote to memory of 3028 2736 af12692a68de7a9e9b06b4ef4f250059d343d9f4448eb7b34d84d9224cd1a3ccN.exe 30 PID 2736 wrote to memory of 3028 2736 af12692a68de7a9e9b06b4ef4f250059d343d9f4448eb7b34d84d9224cd1a3ccN.exe 30 PID 3028 wrote to memory of 2704 3028 Sysqemyohie.exe 31 PID 3028 wrote to memory of 2704 3028 Sysqemyohie.exe 31 PID 3028 wrote to memory of 2704 3028 Sysqemyohie.exe 31 PID 3028 wrote to memory of 2704 3028 Sysqemyohie.exe 31 PID 2704 wrote to memory of 572 2704 Sysqemvtenw.exe 32 PID 2704 wrote to memory of 572 2704 Sysqemvtenw.exe 32 PID 2704 wrote to memory of 572 2704 Sysqemvtenw.exe 32 PID 2704 wrote to memory of 572 2704 Sysqemvtenw.exe 32 PID 572 wrote to memory of 2076 572 Sysqemafxnp.exe 33 PID 572 wrote to memory of 2076 572 Sysqemafxnp.exe 33 PID 572 wrote to memory of 2076 572 Sysqemafxnp.exe 33 PID 572 wrote to memory of 2076 572 Sysqemafxnp.exe 33 PID 2076 wrote to memory of 2928 2076 Sysqemmamvv.exe 34 PID 2076 wrote to memory of 2928 2076 Sysqemmamvv.exe 34 PID 2076 wrote to memory of 2928 2076 Sysqemmamvv.exe 34 PID 2076 wrote to memory of 2928 2076 Sysqemmamvv.exe 34 PID 2928 wrote to memory of 2912 2928 Sysqemqjsal.exe 35 PID 2928 wrote to memory of 2912 2928 Sysqemqjsal.exe 35 PID 2928 wrote to memory of 2912 2928 Sysqemqjsal.exe 35 PID 2928 wrote to memory of 2912 2928 Sysqemqjsal.exe 35 PID 2912 wrote to memory of 1148 2912 Sysqemuvkyp.exe 36 PID 2912 wrote to memory of 1148 2912 Sysqemuvkyp.exe 36 PID 2912 wrote to memory of 1148 2912 Sysqemuvkyp.exe 36 PID 2912 wrote to memory of 1148 2912 Sysqemuvkyp.exe 36 PID 1148 wrote to memory of 3060 1148 Sysqemcdxyj.exe 37 PID 1148 wrote to memory of 3060 1148 Sysqemcdxyj.exe 37 PID 1148 wrote to memory of 3060 1148 Sysqemcdxyj.exe 37 PID 1148 wrote to memory of 3060 1148 Sysqemcdxyj.exe 37 PID 3060 wrote to memory of 2412 3060 Sysqemlywlt.exe 38 PID 3060 wrote to memory of 2412 3060 Sysqemlywlt.exe 38 PID 3060 wrote to memory of 2412 3060 Sysqemlywlt.exe 38 PID 3060 wrote to memory of 2412 3060 Sysqemlywlt.exe 38 PID 2412 wrote to memory of 2052 2412 Sysqemyprob.exe 39 PID 2412 wrote to memory of 2052 2412 Sysqemyprob.exe 39 PID 2412 wrote to memory of 2052 2412 Sysqemyprob.exe 39 PID 2412 wrote to memory of 2052 2412 Sysqemyprob.exe 39 PID 2052 wrote to memory of 1336 2052 Sysqemzddbq.exe 40 PID 2052 wrote to memory of 1336 2052 Sysqemzddbq.exe 40 PID 2052 wrote to memory of 1336 2052 Sysqemzddbq.exe 40 PID 2052 wrote to memory of 1336 2052 Sysqemzddbq.exe 40 PID 1336 wrote to memory of 2464 1336 Sysqemzvetk.exe 41 PID 1336 wrote to memory of 2464 1336 Sysqemzvetk.exe 41 PID 1336 wrote to memory of 2464 1336 Sysqemzvetk.exe 41 PID 1336 wrote to memory of 2464 1336 Sysqemzvetk.exe 41 PID 2464 wrote to memory of 2508 2464 Sysqemysaov.exe 42 PID 2464 wrote to memory of 2508 2464 Sysqemysaov.exe 42 PID 2464 wrote to memory of 2508 2464 Sysqemysaov.exe 42 PID 2464 wrote to memory of 2508 2464 Sysqemysaov.exe 42 PID 2508 wrote to memory of 2500 2508 Sysqemiyaml.exe 43 PID 2508 wrote to memory of 2500 2508 Sysqemiyaml.exe 43 PID 2508 wrote to memory of 2500 2508 Sysqemiyaml.exe 43 PID 2508 wrote to memory of 2500 2508 Sysqemiyaml.exe 43 PID 2500 wrote to memory of 1916 2500 Sysqemzfzje.exe 44 PID 2500 wrote to memory of 1916 2500 Sysqemzfzje.exe 44 PID 2500 wrote to memory of 1916 2500 Sysqemzfzje.exe 44 PID 2500 wrote to memory of 1916 2500 Sysqemzfzje.exe 44 PID 1916 wrote to memory of 2796 1916 Sysqempvkjl.exe 45 PID 1916 wrote to memory of 2796 1916 Sysqempvkjl.exe 45 PID 1916 wrote to memory of 2796 1916 Sysqempvkjl.exe 45 PID 1916 wrote to memory of 2796 1916 Sysqempvkjl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\af12692a68de7a9e9b06b4ef4f250059d343d9f4448eb7b34d84d9224cd1a3ccN.exe"C:\Users\Admin\AppData\Local\Temp\af12692a68de7a9e9b06b4ef4f250059d343d9f4448eb7b34d84d9224cd1a3ccN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyohie.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyohie.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvtenw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvtenw.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\Sysqemafxnp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemafxnp.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmamvv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmamvv.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqjsal.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqjsal.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuvkyp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuvkyp.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcdxyj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcdxyj.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlywlt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlywlt.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyprob.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyprob.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzddbq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzddbq.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzvetk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzvetk.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\Sysqemysaov.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemysaov.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\Sysqemiyaml.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiyaml.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzfzje.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzfzje.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\Sysqempvkjl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempvkjl.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\Sysqemektcr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemektcr.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\Sysqemthbbe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemthbbe.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfyfwg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfyfwg.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtlomm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtlomm.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\Sysqemejhzu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemejhzu.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuddme.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuddme.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrwwzi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrwwzi.exe"23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgmhhp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgmhhp.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlvnmf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlvnmf.exe"25⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgtgxa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgtgxa.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqltnm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqltnm.exe"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzztkc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzztkc.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzojpt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzojpt.exe"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\Sysqemolrpg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemolrpg.exe"30⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\Sysqemamvvl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemamvvl.exe"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtuyah.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtuyah.exe"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhusfz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhusfz.exe"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuhjvf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuhjvf.exe"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\Sysqempgrqz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempgrqz.exe"35⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\Sysqemezolj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemezolj.exe"36⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqudlw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqudlw.exe"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgbptd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgbptd.exe"38⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaptoe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaptoe.exe"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\Sysqempiqan.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempiqan.exe"40⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjhfvx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjhfvx.exe"41⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrpbwr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrpbwr.exe"42⤵
- Executes dropped EXE
PID:340 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlyudx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlyudx.exe"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnfjgm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnfjgm.exe"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqpaee.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqpaee.exe"45⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcrglq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcrglq.exe"46⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjrcwe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjrcwe.exe"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzkzrn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzkzrn.exe"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\Sysqemowfwr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemowfwr.exe"49⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdtfwd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdtfwd.exe"50⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvwthx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvwthx.exe"51⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaxjco.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaxjco.exe"52⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtamcn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtamcn.exe"53⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmhohs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmhohs.exe"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyfgub.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyfgub.exe"55⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\Sysqemovsch.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemovsch.exe"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvdnuc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvdnuc.exe"57⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmcnca.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmcnca.exe"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcszkh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcszkh.exe"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdbosz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdbosz.exe"60⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvmbkh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvmbkh.exe"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\Sysqemscjdu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemscjdu.exe"62⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\Sysqemknxvc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemknxvc.exe"63⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuekdo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuekdo.exe"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\Sysqembyiqd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembyiqd.exe"65⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvwxln.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvwxln.exe"66⤵
- System Location Discovery: System Language Discovery
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgsyvc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgsyvc.exe"67⤵
- System Location Discovery: System Language Discovery
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfdiyq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfdiyq.exe"68⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\Sysqemuaigd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuaigd.exe"69⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\Sysqembaeqr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembaeqr.exe"70⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqubda.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqubda.exe"71⤵
- System Location Discovery: System Language Discovery
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcgrwa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcgrwa.exe"72⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\Sysqemureoi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemureoi.exe"73⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\Sysqemlrfwg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlrfwg.exe"74⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjlarf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjlarf.exe"75⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\Sysqemyajbl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyajbl.exe"76⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\Sysqempoigw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempoigw.exe"77⤵
- System Location Discovery: System Language Discovery
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzvlbr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzvlbr.exe"78⤵
- System Location Discovery: System Language Discovery
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\Sysqemplejy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemplejy.exe"79⤵
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\Sysqemycjrk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemycjrk.exe"80⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\Sysqemowgmu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemowgmu.exe"81⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\Sysqemvznkd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvznkd.exe"82⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\Sysqemktkxn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemktkxn.exe"83⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\Sysqemwnrxa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwnrxa.exe"84⤵
- System Location Discovery: System Language Discovery
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmhork.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmhork.exe"85⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\Sysqemxmdky.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxmdky.exe"86⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnjlkk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnjlkk.exe"87⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\Sysqemudkul.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemudkul.exe"88⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmnyvt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmnyvt.exe"89⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\Sysqemylqij.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemylqij.exe"90⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\Sysqemlctcs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlctcs.exe"91⤵
- System Location Discovery: System Language Discovery
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\Sysqemiddpn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiddpn.exe"92⤵
- System Location Discovery: System Language Discovery
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\Sysqemarcvy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemarcvy.exe"93⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\Sysqemxpjvr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxpjvr.exe"94⤵
- System Location Discovery: System Language Discovery
PID:876 -
C:\Users\Admin\AppData\Local\Temp\Sysqemewwvl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemewwvl.exe"95⤵
- System Location Discovery: System Language Discovery
PID:856 -
C:\Users\Admin\AppData\Local\Temp\Sysqembjbav.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembjbav.exe"96⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\Sysqemgomip.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgomip.exe"97⤵
- System Location Discovery: System Language Discovery
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnlfga.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnlfga.exe"98⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\Sysqemchfgn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemchfgn.exe"99⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\Sysqemirnbd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemirnbd.exe"100⤵
- System Location Discovery: System Language Discovery
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuwfdr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuwfdr.exe"101⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\Sysqemupool.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemupool.exe"102⤵
- System Location Discovery: System Language Discovery
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjxzws.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjxzws.exe"103⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\Sysqemtwdtc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtwdtc.exe"104⤵
- System Location Discovery: System Language Discovery
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjbltp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjbltp.exe"105⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\Sysqemtwmle.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtwmle.exe"106⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\Sysqemitmlj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemitmlj.exe"107⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\Sysqemaambo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaambo.exe"108⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\Sysqemshoot.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemshoot.exe"109⤵
- System Location Discovery: System Language Discovery
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeudoy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeudoy.exe"110⤵
- System Location Discovery: System Language Discovery
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzhkzh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzhkzh.exe"111⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\Sysqemtgatk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtgatk.exe"112⤵
- System Location Discovery: System Language Discovery
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgigjv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgigjv.exe"113⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjovmk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjovmk.exe"114⤵
- System Location Discovery: System Language Discovery
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxogza.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxogza.exe"115⤵
- System Location Discovery: System Language Discovery
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\Sysqemunmzh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemunmzh.exe"116⤵
- System Location Discovery: System Language Discovery
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkyjuj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkyjuj.exe"117⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\Sysqemwsquw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwsquw.exe"118⤵
- System Location Discovery: System Language Discovery
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\Sysqemycpkp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemycpkp.exe"119⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnaycv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnaycv.exe"120⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\Sysqemxcnmi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxcnmi.exe"121⤵
- System Location Discovery: System Language Discovery
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuojzg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuojzg.exe"122⤵
- System Location Discovery: System Language Discovery
PID:1236
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-