Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemdhqji.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtplhv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemozuew.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjidap.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqembeeqx.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemwtajy.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemikeku.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemgopqo.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqememmfd.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqgutc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjdmfu.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqembgjvi.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrvauk.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzrzbx.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjyorn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemdrupq.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtwfha.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemofoeb.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemgtdit.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzxsyh.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemwmvkc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemsuqos.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemazahc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemfdlow.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemfkynr.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqzbvn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhtdwm.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemathhx.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemslhya.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnqfhq.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzlvnp.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqpvjq.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemybucf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemvceok.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemgmjfb.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemsvogp.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemfoazs.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqgoui.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqgftx.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnnbnc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemdpatj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemsfoqn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemikijh.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemlalgn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqsloz.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemlrpps.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkesyc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkanjs.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkhbnz.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhwgat.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemckfrf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemutdqa.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjywci.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemwrojc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhhxgp.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhxekq.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemlhocq.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemdtyeo.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemortwh.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemeyalc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqembodal.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemaijpf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhfgax.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzivql.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemravho.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhixok.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzwyra.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemedixm.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemmiuaj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemohyec.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjtsgy.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzydzq.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemcmyit.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemmlnlr.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkpysl.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxgruj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemsjxpv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxfwnm.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempeiyx.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemcftfd.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemuuije.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemmuuuo.exe'
Malicious functions:
Creates and executes the following:
- '%TEMP%\Sysqemdhqji.exe'
- '%TEMP%\Sysqemtplhv.exe'
- '%TEMP%\Sysqemozuew.exe'
- '%TEMP%\Sysqemjidap.exe'
- '%TEMP%\Sysqembeeqx.exe'
- '%TEMP%\Sysqemwtajy.exe'
- '%TEMP%\Sysqemikeku.exe'
- '%TEMP%\Sysqemgopqo.exe'
- '%TEMP%\Sysqememmfd.exe'
- '%TEMP%\Sysqemqgutc.exe'
- '%TEMP%\Sysqemjdmfu.exe'
- '%TEMP%\Sysqembgjvi.exe'
- '%TEMP%\Sysqemrvauk.exe'
- '%TEMP%\Sysqemzrzbx.exe'
- '%TEMP%\Sysqemjyorn.exe'
- '%TEMP%\Sysqemdrupq.exe'
- '%TEMP%\Sysqemtwfha.exe'
- '%TEMP%\Sysqemofoeb.exe'
- '%TEMP%\Sysqemgtdit.exe'
- '%TEMP%\Sysqemzxsyh.exe'
- '%TEMP%\Sysqemwmvkc.exe'
- '%TEMP%\Sysqemsuqos.exe'
- '%TEMP%\Sysqemazahc.exe'
- '%TEMP%\Sysqemfdlow.exe'
- '%TEMP%\Sysqemfkynr.exe'
- '%TEMP%\Sysqemqzbvn.exe'
- '%TEMP%\Sysqemhtdwm.exe'
- '%TEMP%\Sysqemathhx.exe'
- '%TEMP%\Sysqemslhya.exe'
- '%TEMP%\Sysqemnqfhq.exe'
- '%TEMP%\Sysqemzlvnp.exe'
- '%TEMP%\Sysqemqpvjq.exe'
- '%TEMP%\Sysqemybucf.exe'
- '%TEMP%\Sysqemvceok.exe'
- '%TEMP%\Sysqemgmjfb.exe'
- '%TEMP%\Sysqemsvogp.exe'
- '%TEMP%\Sysqemfoazs.exe'
- '%TEMP%\Sysqemqgoui.exe'
- '%TEMP%\Sysqemqgftx.exe'
- '%TEMP%\Sysqemnnbnc.exe'
- '%TEMP%\Sysqemdpatj.exe'
- '%TEMP%\Sysqemsfoqn.exe'
- '%TEMP%\Sysqemikijh.exe'
- '%TEMP%\Sysqemlalgn.exe'
- '%TEMP%\Sysqemqsloz.exe'
- '%TEMP%\Sysqemlrpps.exe'
- '%TEMP%\Sysqemkesyc.exe'
- '%TEMP%\Sysqemkanjs.exe'
- '%TEMP%\Sysqemkhbnz.exe'
- '%TEMP%\Sysqemhwgat.exe'
- '%TEMP%\Sysqemckfrf.exe'
- '%TEMP%\Sysqemutdqa.exe'
- '%TEMP%\Sysqemjywci.exe'
- '%TEMP%\Sysqemwrojc.exe'
- '%TEMP%\Sysqemhhxgp.exe'
- '%TEMP%\Sysqemhxekq.exe'
- '%TEMP%\Sysqemlhocq.exe'
- '%TEMP%\Sysqemdtyeo.exe'
- '%TEMP%\Sysqemortwh.exe'
- '%TEMP%\Sysqemeyalc.exe'
- '%TEMP%\Sysqembodal.exe'
- '%TEMP%\Sysqemaijpf.exe'
- '%TEMP%\Sysqemhfgax.exe'
- '%TEMP%\Sysqemzivql.exe'
- '%TEMP%\Sysqemravho.exe'
- '%TEMP%\Sysqemhixok.exe'
- '%TEMP%\Sysqemzwyra.exe'
- '%TEMP%\Sysqemedixm.exe'
- '%TEMP%\Sysqemmiuaj.exe'
- '%TEMP%\Sysqemohyec.exe'
- '%TEMP%\Sysqemjtsgy.exe'
- '%TEMP%\Sysqemzydzq.exe'
- '%TEMP%\Sysqemcmyit.exe'
- '%TEMP%\Sysqemmlnlr.exe'
- '%TEMP%\Sysqemkpysl.exe'
- '%TEMP%\Sysqemxgruj.exe'
- '%TEMP%\Sysqemsjxpv.exe'
- '%TEMP%\Sysqemxfwnm.exe'
- '%TEMP%\Sysqempeiyx.exe'
- '%TEMP%\Sysqemcftfd.exe'
- '%TEMP%\Sysqemuuije.exe'
- '%TEMP%\Sysqemmuuuo.exe'
Modifies file system :
Creates the following files:
- %TEMP%\Sysqemdhqji.exe
- %TEMP%\Sysqemtplhv.exe
- %TEMP%\Sysqemozuew.exe
- %TEMP%\Sysqemjidap.exe
- %TEMP%\Sysqembeeqx.exe
- %TEMP%\Sysqemwtajy.exe
- %TEMP%\Sysqemikeku.exe
- %TEMP%\Sysqemgopqo.exe
- %TEMP%\Sysqememmfd.exe
- %TEMP%\Sysqemqgutc.exe
- %TEMP%\Sysqemtwfha.exe
- %TEMP%\Sysqemrvauk.exe
- %TEMP%\Sysqemjdmfu.exe
- %TEMP%\Sysqemjyorn.exe
- %TEMP%\Sysqemmiuaj.exe
- %TEMP%\Sysqemzrzbx.exe
- %TEMP%\Sysqemofoeb.exe
- %TEMP%\Sysqemdrupq.exe
- %TEMP%\Sysqemzxsyh.exe
- %TEMP%\Sysqembgjvi.exe
- %TEMP%\Sysqemgtdit.exe
- %TEMP%\Sysqemsuqos.exe
- %TEMP%\Sysqemazahc.exe
- %TEMP%\Sysqemfdlow.exe
- %TEMP%\Sysqemfkynr.exe
- %TEMP%\Sysqemqzbvn.exe
- %TEMP%\Sysqemhtdwm.exe
- %TEMP%\Sysqemathhx.exe
- %TEMP%\Sysqemslhya.exe
- %TEMP%\Sysqemnqfhq.exe
- %TEMP%\Sysqemzlvnp.exe
- %TEMP%\Sysqemqgoui.exe
- %TEMP%\Sysqemvceok.exe
- %TEMP%\Sysqemqpvjq.exe
- %TEMP%\Sysqemsvogp.exe
- %TEMP%\Sysqemwmvkc.exe
- %TEMP%\Sysqemgmjfb.exe
- %TEMP%\Sysqemqgftx.exe
- %TEMP%\Sysqemfoazs.exe
- %TEMP%\Sysqemdpatj.exe
- %TEMP%\Sysqemybucf.exe
- %TEMP%\Sysqemnnbnc.exe
- %TEMP%\Sysqemlalgn.exe
- %TEMP%\Sysqemsfoqn.exe
- %TEMP%\Sysqemlrpps.exe
- %TEMP%\Sysqemdtyeo.exe
- %TEMP%\Sysqemqsloz.exe
- %TEMP%\Sysqemkhbnz.exe
- %TEMP%\Sysqemkesyc.exe
- %TEMP%\Sysqemckfrf.exe
- %TEMP%\Sysqemikijh.exe
- %TEMP%\Sysqemhwgat.exe
- %TEMP%\Sysqemlhocq.exe
- %TEMP%\Sysqemhxekq.exe
- %TEMP%\Sysqemwrojc.exe
- %TEMP%\Sysqemhhxgp.exe
- %TEMP%\qpath.ini
- %TEMP%\Sysqamqqvaqqd.exe
- %TEMP%\Sysqembodal.exe
- %TEMP%\Sysqemortwh.exe
- %TEMP%\Sysqemeyalc.exe
- %TEMP%\Sysqemutdqa.exe
- %TEMP%\Sysqemjywci.exe
- %TEMP%\Sysqemravho.exe
- %TEMP%\Sysqemhfgax.exe
- %TEMP%\Sysqemzwyra.exe
- %TEMP%\Sysqempeiyx.exe
- %TEMP%\Sysqemhixok.exe
- %TEMP%\Sysqemohyec.exe
- %TEMP%\Sysqemedixm.exe
- %TEMP%\Sysqemzydzq.exe
- %TEMP%\Sysqemzivql.exe
- %TEMP%\Sysqemjtsgy.exe
- %TEMP%\Sysqemxfwnm.exe
- %TEMP%\Sysqemsjxpv.exe
- %TEMP%\Sysqemkpysl.exe
- %TEMP%\Sysqemxgruj.exe
- %TEMP%\Sysqemkanjs.exe
- %TEMP%\Sysqemaijpf.exe
- %TEMP%\Sysqemmuuuo.exe
- %TEMP%\Sysqemcftfd.exe
- %TEMP%\Sysqemuuije.exe
- %TEMP%\Sysqemcmyit.exe
- %TEMP%\Sysqemmlnlr.exe
Sets the 'hidden' attribute to the following files:
- %TEMP%\Sysqemdhqji.exe
- %TEMP%\Sysqemtplhv.exe
- %TEMP%\Sysqemozuew.exe
- %TEMP%\Sysqemjidap.exe
- %TEMP%\Sysqembeeqx.exe
- %TEMP%\Sysqemwtajy.exe
- %TEMP%\Sysqemikeku.exe
- %TEMP%\Sysqemgopqo.exe
- %TEMP%\Sysqememmfd.exe
- %TEMP%\Sysqemqgutc.exe
- %TEMP%\Sysqemjdmfu.exe
- %TEMP%\Sysqembgjvi.exe
- %TEMP%\Sysqemrvauk.exe
- %TEMP%\Sysqemzrzbx.exe
- %TEMP%\Sysqemjyorn.exe
- %TEMP%\Sysqemdrupq.exe
- %TEMP%\Sysqemtwfha.exe
- %TEMP%\Sysqemofoeb.exe
- %TEMP%\Sysqemgtdit.exe
- %TEMP%\Sysqemzxsyh.exe
- %TEMP%\Sysqemwmvkc.exe
- %TEMP%\Sysqemsuqos.exe
- %TEMP%\Sysqemazahc.exe
- %TEMP%\Sysqemfdlow.exe
- %TEMP%\Sysqemfkynr.exe
- %TEMP%\Sysqemqzbvn.exe
- %TEMP%\Sysqemhtdwm.exe
- %TEMP%\Sysqemathhx.exe
- %TEMP%\Sysqemslhya.exe
- %TEMP%\Sysqemnqfhq.exe
- %TEMP%\Sysqemzlvnp.exe
- %TEMP%\Sysqemqpvjq.exe
- %TEMP%\Sysqemybucf.exe
- %TEMP%\Sysqemvceok.exe
- %TEMP%\Sysqemgmjfb.exe
- %TEMP%\Sysqemsvogp.exe
- %TEMP%\Sysqemfoazs.exe
- %TEMP%\Sysqemqgoui.exe
- %TEMP%\Sysqemqgftx.exe
- %TEMP%\Sysqemnnbnc.exe
- %TEMP%\Sysqemdpatj.exe
- %TEMP%\Sysqemmiuaj.exe
- %TEMP%\Sysqemlalgn.exe
- %TEMP%\Sysqemsfoqn.exe
- %TEMP%\Sysqemlrpps.exe
- %TEMP%\Sysqemdtyeo.exe
- %TEMP%\Sysqemqsloz.exe
- %TEMP%\Sysqemkhbnz.exe
- %TEMP%\Sysqemkesyc.exe
- %TEMP%\Sysqemckfrf.exe
- %TEMP%\Sysqemikijh.exe
- %TEMP%\Sysqemhwgat.exe
- %TEMP%\Sysqemwrojc.exe
- %TEMP%\Sysqemutdqa.exe
- %TEMP%\Sysqemhxekq.exe
- %TEMP%\Sysqemhhxgp.exe
- %TEMP%\Sysqamqqvaqqd.exe
- %TEMP%\Sysqemortwh.exe
- %TEMP%\Sysqemlhocq.exe
- %TEMP%\Sysqembodal.exe
- %TEMP%\Sysqemjywci.exe
- %TEMP%\Sysqemeyalc.exe
- %TEMP%\Sysqemkanjs.exe
- %TEMP%\Sysqemravho.exe
- %TEMP%\Sysqemhfgax.exe
- %TEMP%\Sysqemzwyra.exe
- %TEMP%\Sysqempeiyx.exe
- %TEMP%\Sysqemhixok.exe
- %TEMP%\Sysqemohyec.exe
- %TEMP%\Sysqemedixm.exe
- %TEMP%\Sysqemzydzq.exe
- %TEMP%\Sysqemzivql.exe
- %TEMP%\Sysqemjtsgy.exe
- %TEMP%\Sysqemkpysl.exe
- %TEMP%\Sysqemcmyit.exe
- %TEMP%\Sysqemsjxpv.exe
- %TEMP%\Sysqemaijpf.exe
- %TEMP%\Sysqemxgruj.exe
- %TEMP%\Sysqemcftfd.exe
- %TEMP%\Sysqemxfwnm.exe
- %TEMP%\Sysqemmuuuo.exe
- %TEMP%\Sysqemmlnlr.exe
- %TEMP%\Sysqemuuije.exe
