Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2025, 06:49
Behavioral task
behavioral1
Sample
JaffaCakes118_f9f943e754e5a84ded793c7f846a6d20.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_f9f943e754e5a84ded793c7f846a6d20.exe
-
Size
101KB
-
MD5
f9f943e754e5a84ded793c7f846a6d20
-
SHA1
643e4007f4ec16c57b7b6ed49860b20dff1aea81
-
SHA256
a28c9804fbaed750b207223af9a870b018e576b71c39843ae49fc3da54932e39
-
SHA512
883f4979b0042f23a02f82562a67509e7e43895f83f1592256e55e939f9b21fe27e012a50f637d95de6773d38d9b6751d005f7e23267d986cfcf2377147dec59
-
SSDEEP
1536:AYjIyeC1eUfKjkhBYJ7mTCbqODiC1ZsyHZK0FjlqsS5eHyG9LU3YG8nC:ZdEUfKj8BYbDiC1ZTK7sxtLUIGJ
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemrsgeu.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqembmyke.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemlpooy.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemuiftx.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemsdhan.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqembigrs.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemkvxva.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemibibx.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemmbpog.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemuaeyk.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemlllml.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemcwgts.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemhcohb.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemeyjoj.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemycpta.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemzgbsv.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemgwkkg.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemucmbd.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemjmkbk.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemqxotm.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemvdljv.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemkadup.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemypmwx.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemfriyt.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemnddsh.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemjsncy.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemrfiwi.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemnenlj.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemlewdh.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemsnnzw.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqempfdcx.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemhmptd.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemwfarz.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemkfanf.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemaxhzj.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemxlgwj.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemfjrqn.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemlfcsi.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemfdnqz.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemuotyb.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemnkwuo.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemjngdz.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemgsdpv.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemkbtyk.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemtzmxf.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemsalda.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemvcqgy.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemyhhbv.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemngera.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemezgpy.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemqlwza.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemzumfx.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemlpxcj.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemkttqh.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemyvlcw.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemlqtuw.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemfzzaf.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemqrbbu.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemcrvvy.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemrkcod.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemlhjyq.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemqodku.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemarsse.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Sysqemmtllx.exe -
Executes dropped EXE 64 IoCs
pid Process 4860 Sysqemgksiz.exe 2512 Sysqemgofth.exe 720 Sysqemlpooy.exe 3732 Sysqemlpxcj.exe 4112 Sysqemgdfre.exe 432 Sysqemgsdpv.exe 4140 Sysqemvqkxo.exe 4764 Sysqemarsse.exe 4756 Sysqemyzefl.exe 4172 Sysqemnenlj.exe 4584 Sysqemdbwyh.exe 3040 Sysqemlrswn.exe 3568 Sysqemaobjl.exe 1708 Sysqemidyoj.exe 1892 Sysqemsddrn.exe 4548 Sysqemqlwza.exe 4596 Sysqemawmph.exe 4120 Sysqemvngsw.exe 4544 Sysqemiwmvz.exe 4068 Sysqemlgets.exe 4248 Sysqemnjhqe.exe 588 Sysqemsalda.exe 4348 Sysqemvcqgy.exe 3792 Sysqemngera.exe 1528 Sysqemlllml.exe 4588 Sysqemaxhzj.exe 5068 Sysqemsxkxi.exe 4172 Sysqemfzzaf.exe 5108 Sysqemndksi.exe 1376 Sysqemfdnqz.exe 220 Sysqemkasyn.exe 700 Sysqemkttqh.exe 4576 Sysqemxrxyj.exe 1088 Sysqemupwyc.exe 3000 Sysqemqrbbu.exe 444 Sysqemdtqwr.exe 876 Sysqemcigci.exe 4932 Sysqemsrauj.exe 1920 Sysqemkfanf.exe 3108 Sysqemsgznl.exe 1368 Sysqemumfpb.exe 4336 Sysqemnafix.exe 4416 Sysqemuqcgd.exe 4588 Sysqemxlgwj.exe 1048 Sysqemkolzb.exe 4060 Sysqemucmbd.exe 2684 Sysqemkshpv.exe 5088 Sysqemxxaxv.exe 5100 Sysqemmcbcb.exe 2568 Sysqemslskv.exe 3192 Sysqemncmns.exe 4644 Sysqemuotyb.exe 4516 Sysqemxgngq.exe 3792 Sysqemnkwuo.exe 2804 Sysqemkadup.exe 3744 Sysqempuxxs.exe 3136 Sysqemrtmsb.exe 2952 Sysqemulfvn.exe 3204 Sysqemxrtxd.exe 1092 Sysqemsxknp.exe 4764 Sysqempvhox.exe 4752 Sysqemflcbp.exe 964 Sysqempotzw.exe 4740 Sysqemrviuf.exe -
resource yara_rule behavioral2/memory/2072-0-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x0007000000023c89-6.dat upx behavioral2/files/0x0008000000023c85-41.dat upx behavioral2/files/0x0007000000023c8b-71.dat upx behavioral2/files/0x0008000000023c86-106.dat upx behavioral2/files/0x0007000000023c8d-141.dat upx behavioral2/files/0x0007000000023c8e-176.dat upx behavioral2/memory/2072-206-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x0007000000023c90-212.dat upx behavioral2/memory/4860-242-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x0007000000023c91-248.dat upx behavioral2/memory/2512-279-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/720-282-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x0007000000023c92-287.dat upx behavioral2/memory/3732-318-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x0007000000023c93-324.dat upx behavioral2/memory/4112-336-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/432-357-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x0007000000023c94-363.dat upx behavioral2/files/0x0007000000023c95-398.dat upx behavioral2/memory/4140-429-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x0007000000023c96-436.dat upx behavioral2/memory/4764-466-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x0007000000023c97-472.dat upx behavioral2/memory/4756-479-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x0007000000023c99-509.dat upx behavioral2/memory/4172-511-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x0007000000023c9a-545.dat upx behavioral2/memory/4584-576-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x0007000000023c9b-582.dat upx behavioral2/memory/3040-593-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x0007000000023c9c-619.dat upx behavioral2/memory/4596-621-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x0007000000023c9d-655.dat upx behavioral2/memory/3568-684-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/1708-718-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/1892-784-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/4548-786-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/4596-819-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/4120-825-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/4544-855-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/4068-889-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/4248-926-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/4588-928-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/588-957-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/4348-991-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/3792-1004-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/1528-1059-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/4588-1098-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/5068-1135-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/4172-1193-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/5108-1200-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/1376-1229-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/220-1263-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/700-1297-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/4576-1331-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/1088-1397-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/3108-1403-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/3000-1432-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/444-1466-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/876-1476-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/4932-1501-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/1920-1508-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/3108-1537-0x0000000000400000-0x0000000000491000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxrxyj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemguoll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemaromd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvltse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemdtqwr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemcrvvy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemmlhfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgwkkg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemrfiwi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemumfpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvdljv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvyhcy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemuiftx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemldzgw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlrswn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemjmkbk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlrtru.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqempigcn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemmqjjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemeyjoj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgsdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemarsse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvcqgy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemupwyc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemqddsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxqdzt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemuaeyk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemslskv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlglrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemyzefl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemsxkxi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemncmns.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemnkwuo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemouqyn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgtcua.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemqxotm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqembmyke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemhdjig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqempotzw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemthaia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvkigj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemauaik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemhyizz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemuqcgd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxlgwj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqempppbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemqodku.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemkmgbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemkttqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemkshpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlhjyq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqempvhox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgetqt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemkolzb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemzztma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemuxgyk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlconc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemmifnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemtppjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemtfzdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemzzktf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemnliac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemortvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemsgznl.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemibibx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemfutia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemeyjoj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemycpta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemaximt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxqdzt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhjylc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtzmxf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvcqgy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemndksi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuiftx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembmyke.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyzefl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdtqwr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlqtuw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmtllx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemcwgts.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemortvh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwszlz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyeyac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemccuud.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemkfanf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlbnkg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuaeyk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrxand.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgdfre.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlllml.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqempotzw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemkvxva.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlfcsi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjngdz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsyfoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmifnf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlgets.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembigrs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqxotm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlclah.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemutpjf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvdljv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgjmyy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemfzzaf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxxaxv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhhqsg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmbpog.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxrxyj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuotyb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyvlcw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsxvkd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemfdnqz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjplac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemumfpb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgczrh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemezgpy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlpooy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxgngq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemcrvvy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzlkaz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrsgeu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemoednn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqempjztr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsxkxi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemkleej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrviuf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvlotk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2072 wrote to memory of 4860 2072 JaffaCakes118_f9f943e754e5a84ded793c7f846a6d20.exe 83 PID 2072 wrote to memory of 4860 2072 JaffaCakes118_f9f943e754e5a84ded793c7f846a6d20.exe 83 PID 2072 wrote to memory of 4860 2072 JaffaCakes118_f9f943e754e5a84ded793c7f846a6d20.exe 83 PID 4860 wrote to memory of 2512 4860 Sysqemgksiz.exe 84 PID 4860 wrote to memory of 2512 4860 Sysqemgksiz.exe 84 PID 4860 wrote to memory of 2512 4860 Sysqemgksiz.exe 84 PID 2512 wrote to memory of 720 2512 Sysqemgofth.exe 85 PID 2512 wrote to memory of 720 2512 Sysqemgofth.exe 85 PID 2512 wrote to memory of 720 2512 Sysqemgofth.exe 85 PID 720 wrote to memory of 3732 720 Sysqemlpooy.exe 86 PID 720 wrote to memory of 3732 720 Sysqemlpooy.exe 86 PID 720 wrote to memory of 3732 720 Sysqemlpooy.exe 86 PID 3732 wrote to memory of 4112 3732 Sysqemlpxcj.exe 87 PID 3732 wrote to memory of 4112 3732 Sysqemlpxcj.exe 87 PID 3732 wrote to memory of 4112 3732 Sysqemlpxcj.exe 87 PID 4112 wrote to memory of 432 4112 Sysqemgdfre.exe 88 PID 4112 wrote to memory of 432 4112 Sysqemgdfre.exe 88 PID 4112 wrote to memory of 432 4112 Sysqemgdfre.exe 88 PID 432 wrote to memory of 4140 432 Sysqemgsdpv.exe 90 PID 432 wrote to memory of 4140 432 Sysqemgsdpv.exe 90 PID 432 wrote to memory of 4140 432 Sysqemgsdpv.exe 90 PID 4140 wrote to memory of 4764 4140 Sysqemvqkxo.exe 91 PID 4140 wrote to memory of 4764 4140 Sysqemvqkxo.exe 91 PID 4140 wrote to memory of 4764 4140 Sysqemvqkxo.exe 91 PID 4764 wrote to memory of 4756 4764 Sysqemarsse.exe 92 PID 4764 wrote to memory of 4756 4764 Sysqemarsse.exe 92 PID 4764 wrote to memory of 4756 4764 Sysqemarsse.exe 92 PID 4756 wrote to memory of 4172 4756 Sysqemyzefl.exe 93 PID 4756 wrote to memory of 4172 4756 Sysqemyzefl.exe 93 PID 4756 wrote to memory of 4172 4756 Sysqemyzefl.exe 93 PID 4172 wrote to memory of 4584 4172 Sysqemnenlj.exe 94 PID 4172 wrote to memory of 4584 4172 Sysqemnenlj.exe 94 PID 4172 wrote to memory of 4584 4172 Sysqemnenlj.exe 94 PID 4584 wrote to memory of 3040 4584 Sysqemdbwyh.exe 95 PID 4584 wrote to memory of 3040 4584 Sysqemdbwyh.exe 95 PID 4584 wrote to memory of 3040 4584 Sysqemdbwyh.exe 95 PID 3040 wrote to memory of 3568 3040 Sysqemlrswn.exe 96 PID 3040 wrote to memory of 3568 3040 Sysqemlrswn.exe 96 PID 3040 wrote to memory of 3568 3040 Sysqemlrswn.exe 96 PID 3568 wrote to memory of 1708 3568 Sysqemaobjl.exe 97 PID 3568 wrote to memory of 1708 3568 Sysqemaobjl.exe 97 PID 3568 wrote to memory of 1708 3568 Sysqemaobjl.exe 97 PID 1708 wrote to memory of 1892 1708 Sysqemidyoj.exe 98 PID 1708 wrote to memory of 1892 1708 Sysqemidyoj.exe 98 PID 1708 wrote to memory of 1892 1708 Sysqemidyoj.exe 98 PID 1892 wrote to memory of 4548 1892 Sysqemsddrn.exe 101 PID 1892 wrote to memory of 4548 1892 Sysqemsddrn.exe 101 PID 1892 wrote to memory of 4548 1892 Sysqemsddrn.exe 101 PID 4548 wrote to memory of 4596 4548 Sysqemqlwza.exe 102 PID 4548 wrote to memory of 4596 4548 Sysqemqlwza.exe 102 PID 4548 wrote to memory of 4596 4548 Sysqemqlwza.exe 102 PID 4596 wrote to memory of 4120 4596 Sysqemawmph.exe 106 PID 4596 wrote to memory of 4120 4596 Sysqemawmph.exe 106 PID 4596 wrote to memory of 4120 4596 Sysqemawmph.exe 106 PID 4120 wrote to memory of 4544 4120 Sysqemvngsw.exe 107 PID 4120 wrote to memory of 4544 4120 Sysqemvngsw.exe 107 PID 4120 wrote to memory of 4544 4120 Sysqemvngsw.exe 107 PID 4544 wrote to memory of 4068 4544 Sysqemiwmvz.exe 108 PID 4544 wrote to memory of 4068 4544 Sysqemiwmvz.exe 108 PID 4544 wrote to memory of 4068 4544 Sysqemiwmvz.exe 108 PID 4068 wrote to memory of 4248 4068 Sysqemlgets.exe 109 PID 4068 wrote to memory of 4248 4068 Sysqemlgets.exe 109 PID 4068 wrote to memory of 4248 4068 Sysqemlgets.exe 109 PID 4248 wrote to memory of 588 4248 Sysqemnjhqe.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f943e754e5a84ded793c7f846a6d20.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f943e754e5a84ded793c7f846a6d20.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgksiz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgksiz.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgofth.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgofth.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlpooy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlpooy.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlpxcj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlpxcj.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgdfre.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgdfre.exe"6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgsdpv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgsdpv.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvqkxo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvqkxo.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\Sysqemarsse.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemarsse.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyzefl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyzefl.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnenlj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnenlj.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdbwyh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdbwyh.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlrswn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlrswn.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaobjl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaobjl.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\Sysqemidyoj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemidyoj.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsddrn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsddrn.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqlwza.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqlwza.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\Sysqemawmph.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemawmph.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvngsw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvngsw.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\Sysqemiwmvz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiwmvz.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlgets.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlgets.exe"21⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnjhqe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnjhqe.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsalda.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsalda.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
PID:588 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvcqgy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvcqgy.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\Sysqemngera.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemngera.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlllml.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlllml.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaxhzj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaxhzj.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsxkxi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsxkxi.exe"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfzzaf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfzzaf.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\Sysqemndksi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemndksi.exe"30⤵
- Executes dropped EXE
- Modifies registry class
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfdnqz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfdnqz.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkasyn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkasyn.exe"32⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkttqh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkttqh.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:700 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxrxyj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxrxyj.exe"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\Sysqemupwyc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemupwyc.exe"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqrbbu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqrbbu.exe"36⤵
- Checks computer location settings
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdtqwr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdtqwr.exe"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:444 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcigci.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcigci.exe"38⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsrauj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsrauj.exe"39⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkfanf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkfanf.exe"40⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsgznl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsgznl.exe"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\Sysqemumfpb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemumfpb.exe"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnafix.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnafix.exe"43⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuqcgd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuqcgd.exe"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxlgwj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxlgwj.exe"45⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkolzb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkolzb.exe"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\Sysqemucmbd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemucmbd.exe"47⤵
- Checks computer location settings
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkshpv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkshpv.exe"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxxaxv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxxaxv.exe"49⤵
- Executes dropped EXE
- Modifies registry class
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmcbcb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmcbcb.exe"50⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\Sysqemslskv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemslskv.exe"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\Sysqemncmns.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemncmns.exe"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuotyb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuotyb.exe"53⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\Sysqemriptr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemriptr.exe"54⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\Sysqemxgngq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxgngq.exe"55⤵
- Executes dropped EXE
- Modifies registry class
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnkwuo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnkwuo.exe"56⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkadup.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkadup.exe"57⤵
- Checks computer location settings
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\Sysqempuxxs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempuxxs.exe"58⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrtmsb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrtmsb.exe"59⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\Sysqemulfvn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemulfvn.exe"60⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxrtxd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxrtxd.exe"61⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsxknp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsxknp.exe"62⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\Sysqempvhox.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempvhox.exe"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\Sysqemflcbp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemflcbp.exe"64⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\Sysqempotzw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempotzw.exe"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:964 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrviuf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrviuf.exe"66⤵
- Executes dropped EXE
- Modifies registry class
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzztma.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzztma.exe"67⤵
- System Location Discovery: System Language Discovery
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhhqsg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhhqsg.exe"68⤵
- Modifies registry class
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcrvvy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcrvvy.exe"69⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmtllx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmtllx.exe"70⤵
- Checks computer location settings
- Modifies registry class
PID:756 -
C:\Users\Admin\AppData\Local\Temp\Sysqempppbd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempppbd.exe"71⤵
- System Location Discovery: System Language Discovery
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeivty.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeivty.exe"72⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\Sysqemrkcod.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrkcod.exe"73⤵
- Checks computer location settings
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmqtwk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmqtwk.exe"74⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\Sysqemglymk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemglymk.exe"75⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\Sysqemrsmpo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrsmpo.exe"76⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjplac.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjplac.exe"77⤵
- Modifies registry class
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\Sysqemortvh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemortvh.exe"78⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeyfqz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeyfqz.exe"79⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\Sysqemthaia.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemthaia.exe"80⤵
- System Location Discovery: System Language Discovery
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\Sysqemouqyn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemouqyn.exe"81⤵
- System Location Discovery: System Language Discovery
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjmkbk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjmkbk.exe"82⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrfkms.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrfkms.exe"83⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\Sysqemgypmo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgypmo.exe"84⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\Sysqemezbfv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemezbfv.exe"85⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjxhau.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjxhau.exe"86⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\Sysqemzgbsv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzgbsv.exe"87⤵
- Checks computer location settings
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjngdz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjngdz.exe"88⤵
- Checks computer location settings
- Modifies registry class
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwszlz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwszlz.exe"89⤵
- Modifies registry class
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuxgyk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuxgyk.exe"90⤵
- System Location Discovery: System Language Discovery
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\Sysqembigrs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembigrs.exe"91⤵
- Checks computer location settings
- Modifies registry class
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlqtuw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlqtuw.exe"92⤵
- Checks computer location settings
- Modifies registry class
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyvlcw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyvlcw.exe"93⤵
- Checks computer location settings
- Modifies registry class
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\Sysqemirlms.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemirlms.exe"94⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\Sysqemyhyil.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyhyil.exe"95⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\Sysqemzlkaz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzlkaz.exe"96⤵
- Modifies registry class
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlconc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlconc.exe"97⤵
- System Location Discovery: System Language Discovery
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgetqt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgetqt.exe"98⤵
- System Location Discovery: System Language Discovery
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyhhbv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyhhbv.exe"99⤵
- Checks computer location settings
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlglrp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlglrp.exe"100⤵
- System Location Discovery: System Language Discovery
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrsgeu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrsgeu.exe"101⤵
- Checks computer location settings
- Modifies registry class
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwfarz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwfarz.exe"102⤵
- Checks computer location settings
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgtcua.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgtcua.exe"103⤵
- System Location Discovery: System Language Discovery
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyqcfx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyqcfx.exe"104⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\Sysqemojafs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemojafs.exe"105⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\Sysqemguoll.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemguoll.exe"106⤵
- System Location Discovery: System Language Discovery
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlhjyq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlhjyq.exe"107⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqxotm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqxotm.exe"108⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:448 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvkigj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvkigj.exe"109⤵
- System Location Discovery: System Language Discovery
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgczrh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgczrh.exe"110⤵
- Modifies registry class
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\Sysqemygmcq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemygmcq.exe"111⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\Sysqemabykw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemabykw.exe"112⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\Sysqemauaik.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemauaik.exe"113⤵
- System Location Discovery: System Language Discovery
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlbnkg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlbnkg.exe"114⤵
- Modifies registry class
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtfzdj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtfzdj.exe"115⤵
- System Location Discovery: System Language Discovery
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvlotk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvlotk.exe"116⤵
- Modifies registry class
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\Sysqemanxgu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemanxgu.exe"117⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\Sysqemoaqkm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoaqkm.exe"118⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqodku.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqodku.exe"119⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlclah.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlclah.exe"120⤵
- Modifies registry class
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyspib.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyspib.exe"121⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqddsd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqddsd.exe"122⤵
- System Location Discovery: System Language Discovery
PID:1020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-