Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
84s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/01/2025, 06:49
Behavioral task
behavioral1
Sample
JaffaCakes118_f9f943e754e5a84ded793c7f846a6d20.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_f9f943e754e5a84ded793c7f846a6d20.exe
-
Size
101KB
-
MD5
f9f943e754e5a84ded793c7f846a6d20
-
SHA1
643e4007f4ec16c57b7b6ed49860b20dff1aea81
-
SHA256
a28c9804fbaed750b207223af9a870b018e576b71c39843ae49fc3da54932e39
-
SHA512
883f4979b0042f23a02f82562a67509e7e43895f83f1592256e55e939f9b21fe27e012a50f637d95de6773d38d9b6751d005f7e23267d986cfcf2377147dec59
-
SSDEEP
1536:AYjIyeC1eUfKjkhBYJ7mTCbqODiC1ZsyHZK0FjlqsS5eHyG9LU3YG8nC:ZdEUfKj8BYbDiC1ZTK7sxtLUIGJ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1968 Sysqemnbbxu.exe 2816 Sysqemarwad.exe 3012 Sysqemjyxhv.exe 2008 Sysqemfxqsq.exe 2680 Sysqemeeocp.exe 2368 Sysqemujoxt.exe 2956 Sysqemgddxz.exe 2328 Sysqemsjuav.exe 900 Sysqemhjgsw.exe 1620 Sysqemxgosi.exe 1696 Sysqemrjtia.exe 2372 Sysqemjthai.exe 2412 Sysqemyjqtp.exe 3020 Sysqemorbbv.exe 2736 Sysqemvnmyh.exe 2184 Sysqemurgve.exe 2712 Sysqemptctc.exe 2584 Sysqemgtadj.exe 2160 Sysqembdebh.exe 2076 Sysqemenwya.exe 2148 Sysqemvfxin.exe 2272 Sysqemtzbed.exe 1808 Sysqemlkhwl.exe 2080 Sysqemsrcox.exe 2428 Sysqemfxtrt.exe 2508 Sysqemkvqzz.exe 2312 Sysqemfagji.exe 2752 Sysqemrgpew.exe 2004 Sysqemhzmzg.exe 920 Sysqemmbcuw.exe 2492 Sysqemydibh.exe 2372 Sysqemtxnrz.exe 1032 Sysqemlxpjn.exe 2704 Sysqemnedmc.exe 2808 Sysqemfvfeq.exe 2776 Sysqemnweew.exe 2472 Sysqemzbwzt.exe 2908 Sysqemwdgmo.exe 1980 Sysqemrfkjm.exe 692 Sysqemtpbhf.exe 2672 Sysqemybvhy.exe 1924 Sysqemqtxzl.exe 1748 Sysqemnreze.exe 2744 Sysqemixtkn.exe 876 Sysqemsexhx.exe 2096 Sysqemkswmi.exe 1944 Sysqemjkxfc.exe 2892 Sysqemenbca.exe 1160 Sysqemejnzf.exe 1996 Sysqemztrxd.exe 2276 Sysqemjsvuv.exe 1848 Sysqemeuzst.exe 2728 Sysqemgtnhr.exe 1852 Sysqemxhenc.exe 1548 Sysqemhzrcg.exe 1492 Sysqemcbvam.exe 1472 Sysqemryekt.exe 1572 Sysqemmbiir.exe 2792 Sysqemdtjal.exe 1980 Sysqemwalfq.exe 2868 Sysqemyooql.exe 2440 Sysqemqcnvv.exe 320 Sysqemndxar.exe 2552 Sysqemfswfc.exe -
Loads dropped DLL 64 IoCs
pid Process 1700 JaffaCakes118_f9f943e754e5a84ded793c7f846a6d20.exe 1700 JaffaCakes118_f9f943e754e5a84ded793c7f846a6d20.exe 1968 Sysqemnbbxu.exe 1968 Sysqemnbbxu.exe 2816 Sysqemarwad.exe 2816 Sysqemarwad.exe 3012 Sysqemjyxhv.exe 3012 Sysqemjyxhv.exe 2008 Sysqemfxqsq.exe 2008 Sysqemfxqsq.exe 2680 Sysqemeeocp.exe 2680 Sysqemeeocp.exe 2368 Sysqemujoxt.exe 2368 Sysqemujoxt.exe 2956 Sysqemgddxz.exe 2956 Sysqemgddxz.exe 2328 Sysqemsjuav.exe 2328 Sysqemsjuav.exe 900 Sysqemhjgsw.exe 900 Sysqemhjgsw.exe 1620 Sysqemxgosi.exe 1620 Sysqemxgosi.exe 1696 Sysqemrjtia.exe 1696 Sysqemrjtia.exe 2372 Sysqemjthai.exe 2372 Sysqemjthai.exe 2412 Sysqemyjqtp.exe 2412 Sysqemyjqtp.exe 1744 Sysqemaptoe.exe 1744 Sysqemaptoe.exe 2736 Sysqemvnmyh.exe 2736 Sysqemvnmyh.exe 2184 Sysqemurgve.exe 2184 Sysqemurgve.exe 2712 Sysqemptctc.exe 2712 Sysqemptctc.exe 2584 Sysqemgtadj.exe 2584 Sysqemgtadj.exe 2160 Sysqembdebh.exe 2160 Sysqembdebh.exe 2076 Sysqemenwya.exe 2076 Sysqemenwya.exe 2148 Sysqemvfxin.exe 2148 Sysqemvfxin.exe 2272 Sysqemtzbed.exe 2272 Sysqemtzbed.exe 1808 Sysqemlkhwl.exe 1808 Sysqemlkhwl.exe 2080 Sysqemsrcox.exe 2080 Sysqemsrcox.exe 2428 Sysqemfxtrt.exe 2428 Sysqemfxtrt.exe 2508 Sysqemkvqzz.exe 2508 Sysqemkvqzz.exe 2312 Sysqemfagji.exe 2312 Sysqemfagji.exe 2752 Sysqemrgpew.exe 2752 Sysqemrgpew.exe 2004 Sysqemhzmzg.exe 2004 Sysqemhzmzg.exe 920 Sysqemmbcuw.exe 920 Sysqemmbcuw.exe 2492 Sysqemydibh.exe 2492 Sysqemydibh.exe -
resource yara_rule behavioral1/memory/1700-0-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/files/0x0008000000016d3f-6.dat upx behavioral1/memory/1968-22-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/files/0x0008000000016d36-21.dat upx behavioral1/files/0x0008000000016d47-24.dat upx behavioral1/memory/2816-31-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/files/0x0007000000016d63-38.dat upx behavioral1/memory/3012-46-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/files/0x0007000000016d69-53.dat upx behavioral1/memory/3012-55-0x0000000003610000-0x00000000036A1000-memory.dmp upx behavioral1/memory/1700-67-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2008-66-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/files/0x0008000000016cc5-69.dat upx behavioral1/memory/1968-77-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2680-81-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/files/0x0007000000016d6d-85.dat upx behavioral1/memory/2368-100-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/3012-99-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2816-98-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/files/0x0009000000016dd9-102.dat upx behavioral1/memory/2956-114-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/files/0x00050000000186f8-117.dat upx behavioral1/memory/2328-125-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/files/0x0005000000018731-133.dat upx behavioral1/memory/2680-139-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/files/0x0005000000018742-151.dat upx behavioral1/memory/2956-157-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/1620-163-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/files/0x0005000000018781-167.dat upx behavioral1/memory/1696-174-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/files/0x000500000001878c-182.dat upx behavioral1/memory/2328-188-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2372-195-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/900-206-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2412-205-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/3020-214-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/1620-213-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/1744-220-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/1696-219-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2736-227-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/1744-226-0x0000000003440000-0x00000000034D1000-memory.dmp upx behavioral1/memory/2372-238-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2712-250-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2584-258-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/3020-256-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2736-267-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2160-269-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2076-284-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2184-279-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2712-291-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2584-301-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2076-321-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/1808-317-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2160-316-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2080-331-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2428-342-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2148-341-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2272-351-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2312-368-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/1808-367-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2752-381-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2080-375-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2004-393-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2428-392-0x0000000000400000-0x0000000000491000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemnbbxu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemenwya.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemeuzst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxvqmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemcqrqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemoijgo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlkhwl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemejnzf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemectnz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqempndji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemfoepn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemyorlw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemssnca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemcrrzk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemaffdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemrjtia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvqbbw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemjzvhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqembgfmu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemfvfeq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxqyxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqembasna.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemqiobq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemjjbxz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgtnhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemcbvam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemjdrmk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlinaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvndfz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemkegoj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqempgxil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemnoitd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemiijyg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqempfbhy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemyiqqj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemryekt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemzdaky.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemijplk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemfophg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxzczf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemacuqi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemdlzdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemarwad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemjthai.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemywqbu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemrwxpw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemyooql.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemwjubt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemzficy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemikcft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemypjos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemswgat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemifufu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemkvqzz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemjsvuv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgpejf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvdmbu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemdvfun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemhzmzg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlvagx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgnfyr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemydlel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemkoyli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemfnqvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1700 wrote to memory of 1968 1700 JaffaCakes118_f9f943e754e5a84ded793c7f846a6d20.exe 30 PID 1700 wrote to memory of 1968 1700 JaffaCakes118_f9f943e754e5a84ded793c7f846a6d20.exe 30 PID 1700 wrote to memory of 1968 1700 JaffaCakes118_f9f943e754e5a84ded793c7f846a6d20.exe 30 PID 1700 wrote to memory of 1968 1700 JaffaCakes118_f9f943e754e5a84ded793c7f846a6d20.exe 30 PID 1968 wrote to memory of 2816 1968 Sysqemnbbxu.exe 31 PID 1968 wrote to memory of 2816 1968 Sysqemnbbxu.exe 31 PID 1968 wrote to memory of 2816 1968 Sysqemnbbxu.exe 31 PID 1968 wrote to memory of 2816 1968 Sysqemnbbxu.exe 31 PID 2816 wrote to memory of 3012 2816 Sysqemarwad.exe 32 PID 2816 wrote to memory of 3012 2816 Sysqemarwad.exe 32 PID 2816 wrote to memory of 3012 2816 Sysqemarwad.exe 32 PID 2816 wrote to memory of 3012 2816 Sysqemarwad.exe 32 PID 3012 wrote to memory of 2008 3012 Sysqemjyxhv.exe 33 PID 3012 wrote to memory of 2008 3012 Sysqemjyxhv.exe 33 PID 3012 wrote to memory of 2008 3012 Sysqemjyxhv.exe 33 PID 3012 wrote to memory of 2008 3012 Sysqemjyxhv.exe 33 PID 2008 wrote to memory of 2680 2008 Sysqemfxqsq.exe 34 PID 2008 wrote to memory of 2680 2008 Sysqemfxqsq.exe 34 PID 2008 wrote to memory of 2680 2008 Sysqemfxqsq.exe 34 PID 2008 wrote to memory of 2680 2008 Sysqemfxqsq.exe 34 PID 2680 wrote to memory of 2368 2680 Sysqemeeocp.exe 35 PID 2680 wrote to memory of 2368 2680 Sysqemeeocp.exe 35 PID 2680 wrote to memory of 2368 2680 Sysqemeeocp.exe 35 PID 2680 wrote to memory of 2368 2680 Sysqemeeocp.exe 35 PID 2368 wrote to memory of 2956 2368 Sysqemujoxt.exe 36 PID 2368 wrote to memory of 2956 2368 Sysqemujoxt.exe 36 PID 2368 wrote to memory of 2956 2368 Sysqemujoxt.exe 36 PID 2368 wrote to memory of 2956 2368 Sysqemujoxt.exe 36 PID 2956 wrote to memory of 2328 2956 Sysqemgddxz.exe 37 PID 2956 wrote to memory of 2328 2956 Sysqemgddxz.exe 37 PID 2956 wrote to memory of 2328 2956 Sysqemgddxz.exe 37 PID 2956 wrote to memory of 2328 2956 Sysqemgddxz.exe 37 PID 2328 wrote to memory of 900 2328 Sysqemsjuav.exe 38 PID 2328 wrote to memory of 900 2328 Sysqemsjuav.exe 38 PID 2328 wrote to memory of 900 2328 Sysqemsjuav.exe 38 PID 2328 wrote to memory of 900 2328 Sysqemsjuav.exe 38 PID 900 wrote to memory of 1620 900 Sysqemhjgsw.exe 39 PID 900 wrote to memory of 1620 900 Sysqemhjgsw.exe 39 PID 900 wrote to memory of 1620 900 Sysqemhjgsw.exe 39 PID 900 wrote to memory of 1620 900 Sysqemhjgsw.exe 39 PID 1620 wrote to memory of 1696 1620 Sysqemxgosi.exe 40 PID 1620 wrote to memory of 1696 1620 Sysqemxgosi.exe 40 PID 1620 wrote to memory of 1696 1620 Sysqemxgosi.exe 40 PID 1620 wrote to memory of 1696 1620 Sysqemxgosi.exe 40 PID 1696 wrote to memory of 2372 1696 Sysqemrjtia.exe 41 PID 1696 wrote to memory of 2372 1696 Sysqemrjtia.exe 41 PID 1696 wrote to memory of 2372 1696 Sysqemrjtia.exe 41 PID 1696 wrote to memory of 2372 1696 Sysqemrjtia.exe 41 PID 2372 wrote to memory of 2412 2372 Sysqemjthai.exe 42 PID 2372 wrote to memory of 2412 2372 Sysqemjthai.exe 42 PID 2372 wrote to memory of 2412 2372 Sysqemjthai.exe 42 PID 2372 wrote to memory of 2412 2372 Sysqemjthai.exe 42 PID 2412 wrote to memory of 3020 2412 Sysqemyjqtp.exe 43 PID 2412 wrote to memory of 3020 2412 Sysqemyjqtp.exe 43 PID 2412 wrote to memory of 3020 2412 Sysqemyjqtp.exe 43 PID 2412 wrote to memory of 3020 2412 Sysqemyjqtp.exe 43 PID 1744 wrote to memory of 2736 1744 Sysqemaptoe.exe 45 PID 1744 wrote to memory of 2736 1744 Sysqemaptoe.exe 45 PID 1744 wrote to memory of 2736 1744 Sysqemaptoe.exe 45 PID 1744 wrote to memory of 2736 1744 Sysqemaptoe.exe 45 PID 2736 wrote to memory of 2184 2736 Sysqemvnmyh.exe 46 PID 2736 wrote to memory of 2184 2736 Sysqemvnmyh.exe 46 PID 2736 wrote to memory of 2184 2736 Sysqemvnmyh.exe 46 PID 2736 wrote to memory of 2184 2736 Sysqemvnmyh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f943e754e5a84ded793c7f846a6d20.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f943e754e5a84ded793c7f846a6d20.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnbbxu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnbbxu.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\Sysqemarwad.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemarwad.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjyxhv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjyxhv.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfxqsq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfxqsq.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeeocp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeeocp.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\Sysqemujoxt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemujoxt.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgddxz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgddxz.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsjuav.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsjuav.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhjgsw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhjgsw.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxgosi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxgosi.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrjtia.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrjtia.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjthai.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjthai.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyjqtp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyjqtp.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\Sysqemorbbv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemorbbv.exe"15⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaptoe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaptoe.exe"16⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvnmyh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvnmyh.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\Sysqemurgve.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemurgve.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\Sysqemptctc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemptctc.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgtadj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgtadj.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\Sysqembdebh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembdebh.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\Sysqemenwya.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemenwya.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvfxin.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvfxin.exe"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtzbed.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtzbed.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlkhwl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlkhwl.exe"25⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsrcox.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsrcox.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfxtrt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfxtrt.exe"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkvqzz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkvqzz.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfagji.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfagji.exe"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrgpew.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrgpew.exe"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhzmzg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhzmzg.exe"31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmbcuw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmbcuw.exe"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\Sysqemydibh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemydibh.exe"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtxnrz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtxnrz.exe"34⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlxpjn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlxpjn.exe"35⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnedmc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnedmc.exe"36⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfvfeq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfvfeq.exe"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnweew.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnweew.exe"38⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzbwzt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzbwzt.exe"39⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwdgmo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwdgmo.exe"40⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrfkjm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrfkjm.exe"41⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtpbhf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtpbhf.exe"42⤵
- Executes dropped EXE
PID:692 -
C:\Users\Admin\AppData\Local\Temp\Sysqemybvhy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemybvhy.exe"43⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqtxzl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqtxzl.exe"44⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnreze.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnreze.exe"45⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\Sysqemixtkn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemixtkn.exe"46⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsexhx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsexhx.exe"47⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkswmi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkswmi.exe"48⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjkxfc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjkxfc.exe"49⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\Sysqemenbca.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemenbca.exe"50⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\Sysqemejnzf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemejnzf.exe"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\Sysqemztrxd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemztrxd.exe"52⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjsvuv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjsvuv.exe"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeuzst.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeuzst.exe"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgtnhr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgtnhr.exe"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxhenc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxhenc.exe"56⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhzrcg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhzrcg.exe"57⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcbvam.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcbvam.exe"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\Sysqemryekt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemryekt.exe"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmbiir.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmbiir.exe"60⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdtjal.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdtjal.exe"61⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwalfq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwalfq.exe"62⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyooql.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyooql.exe"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqcnvv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqcnvv.exe"64⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\Sysqemndxar.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemndxar.exe"65⤵
- Executes dropped EXE
PID:320 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfswfc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfswfc.exe"66⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\Sysqempnpyj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempnpyj.exe"67⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\Sysqemekxyw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemekxyw.exe"68⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\Sysqemudtlf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemudtlf.exe"69⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\Sysqempgxil.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempgxil.exe"70⤵
- System Location Discovery: System Language Discovery
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrbalg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrbalg.exe"71⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjmolg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjmolg.exe"72⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\Sysqemgnyyk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgnyyk.exe"73⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\Sysqemyuadh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyuadh.exe"74⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\Sysqemvvsql.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvvsql.exe"75⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnkjwn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnkjwn.exe"76⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\Sysqemklbjr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemklbjr.exe"77⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\Sysqemzeywb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzeywb.exe"78⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\Sysqemebswo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemebswo.exe"79⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\Sysqemwjubt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwjubt.exe"80⤵
- System Location Discovery: System Language Discovery
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtknop.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtknop.exe"81⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\Sysqemlvagx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlvagx.exe"82⤵
- System Location Discovery: System Language Discovery
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\Sysqempoigw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempoigw.exe"83⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\Sysqemizvgv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemizvgv.exe"84⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\Sysqemxtstf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxtstf.exe"85⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnaebm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnaebm.exe"86⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\Sysqemsnxjf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsnxjf.exe"87⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\Sysqemkylbf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkylbf.exe"88⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\Sysqemostbe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemostbe.exe"89⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjuxzk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjuxzk.exe"90⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\Sysqemiyjeh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiyjeh.exe"91⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\Sysqemyguen.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyguen.exe"92⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\Sysqemyvskf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyvskf.exe"93⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\Sysqemtjzuf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtjzuf.exe"94⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\Sysqemhyimu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhyimu.exe"95⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\Sysqemxvqmg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxvqmg.exe"96⤵
- System Location Discovery: System Language Discovery
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzficy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzficy.exe"97⤵
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrqvuy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrqvuy.exe"98⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\Sysqemwgapu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwgapu.exe"99⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\Sysqemoncuz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoncuz.exe"100⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\Sysqemldjcs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemldjcs.exe"101⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqfpke.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqfpke.exe"102⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\Sysqempbbpa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempbbpa.exe"103⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\Sysqemfuyck.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfuyck.exe"104⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\Sysqemenzvm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemenzvm.exe"105⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\Sysqemxubaj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxubaj.exe"106⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\Sysqemwbykr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwbykr.exe"107⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\Sysqemlnvfs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlnvfs.exe"108⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\Sysqemtnufh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtnufh.exe"109⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\Sysqemikcft.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemikcft.exe"110⤵
- System Location Discovery: System Language Discovery
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfijfm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfijfm.exe"111⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\Sysqemvqvft.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvqvft.exe"112⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\Sysqemkfdxa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkfdxa.exe"113⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\Sysqemcqrqh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcqrqh.exe"114⤵
- System Location Discovery: System Language Discovery
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\Sysqembudve.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembudve.exe"115⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\Sysqemufqnm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemufqnm.exe"116⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\Sysqemyvnii.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyvnii.exe"117⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\Sysqemrupnf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrupnf.exe"118⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqyjlk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqyjlk.exe"119⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\Sysqemijplk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemijplk.exe"120⤵
- System Location Discovery: System Language Discovery
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnoitd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnoitd.exe"121⤵
- System Location Discovery: System Language Discovery
PID:444 -
C:\Users\Admin\AppData\Local\Temp\Sysqemclqtp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemclqtp.exe"122⤵PID:2592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-