Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemicrqd.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemniwbo.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxkznl.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnopbt.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemvhyzn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnbfzi.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhwhwb.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemksvcv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemvcydy.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkkzxb.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemsdavv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemgeyze.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemvmmfr.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemagjtl.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemghpiy.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtmivr.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemagexn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqnsss.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxjedp.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemlolmz.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnfkdv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnqwzg.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkwrsp.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzqela.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrgqsp.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemmznub.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemoxjru.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemwrspp.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemetiim.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnjjid.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqinjd.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemizjtq.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtkjre.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemdwttu.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrcwpi.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempguam.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnwtjj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqematclh.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzqoww.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrrxbv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzhoqd.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemmjeqm.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemfxmcf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzgumn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkcfui.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemchoje.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempjxju.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempuvvs.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqfopr.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhxbkv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemcabkj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemsgggc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemmqica.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemcbwok.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemsjxpv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhrsvh.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnzjiz.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemanlvt.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemdhwmv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemvffbe.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqembtfvj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqvybf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemiasti.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemawtrq.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqhfyd.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemfeuhs.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemanyzu.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxbzxs.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemboiyt.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemwylzw.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhaukh.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqembmmwx.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemuydrw.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemyioso.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqfkmr.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemgcvxb.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrqlju.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjerib.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrmpts.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemeudzo.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemeyrpi.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempxkwk.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempamid.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemwbjyd.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempjrta.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempoznt.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqembqqgv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemesvrm.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemuawtx.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemthvou.exe'
Malicious functions:
Creates and executes the following:
- '%TEMP%\Sysqemicrqd.exe'
- '%TEMP%\Sysqemniwbo.exe'
- '%TEMP%\Sysqemxkznl.exe'
- '%TEMP%\Sysqemnopbt.exe'
- '%TEMP%\Sysqemvhyzn.exe'
- '%TEMP%\Sysqemnbfzi.exe'
- '%TEMP%\Sysqemhwhwb.exe'
- '%TEMP%\Sysqemksvcv.exe'
- '%TEMP%\Sysqemvcydy.exe'
- '%TEMP%\Sysqemkkzxb.exe'
- '%TEMP%\Sysqemsdavv.exe'
- '%TEMP%\Sysqemgeyze.exe'
- '%TEMP%\Sysqemvmmfr.exe'
- '%TEMP%\Sysqemagjtl.exe'
- '%TEMP%\Sysqemghpiy.exe'
- '%TEMP%\Sysqemtmivr.exe'
- '%TEMP%\Sysqemagexn.exe'
- '%TEMP%\Sysqemqnsss.exe'
- '%TEMP%\Sysqemxjedp.exe'
- '%TEMP%\Sysqemlolmz.exe'
- '%TEMP%\Sysqemnfkdv.exe'
- '%TEMP%\Sysqemnqwzg.exe'
- '%TEMP%\Sysqemkwrsp.exe'
- '%TEMP%\Sysqemzqela.exe'
- '%TEMP%\Sysqemrgqsp.exe'
- '%TEMP%\Sysqemmznub.exe'
- '%TEMP%\Sysqemoxjru.exe'
- '%TEMP%\Sysqemwrspp.exe'
- '%TEMP%\Sysqemetiim.exe'
- '%TEMP%\Sysqemnjjid.exe'
- '%TEMP%\Sysqemqinjd.exe'
- '%TEMP%\Sysqemizjtq.exe'
- '%TEMP%\Sysqemtkjre.exe'
- '%TEMP%\Sysqemdwttu.exe'
- '%TEMP%\Sysqemrcwpi.exe'
- '%TEMP%\Sysqempguam.exe'
- '%TEMP%\Sysqemnwtjj.exe'
- '%TEMP%\Sysqematclh.exe'
- '%TEMP%\Sysqemzqoww.exe'
- '%TEMP%\Sysqemrrxbv.exe'
- '%TEMP%\Sysqemzhoqd.exe'
- '%TEMP%\Sysqemmjeqm.exe'
- '%TEMP%\Sysqemfxmcf.exe'
- '%TEMP%\Sysqemzgumn.exe'
- '%TEMP%\Sysqemkcfui.exe'
- '%TEMP%\Sysqemchoje.exe'
- '%TEMP%\Sysqempjxju.exe'
- '%TEMP%\Sysqempuvvs.exe'
- '%TEMP%\Sysqemqfopr.exe'
- '%TEMP%\Sysqemhxbkv.exe'
- '%TEMP%\Sysqemcabkj.exe'
- '%TEMP%\Sysqemsgggc.exe'
- '%TEMP%\Sysqemmqica.exe'
- '%TEMP%\Sysqemcbwok.exe'
- '%TEMP%\Sysqemsjxpv.exe'
- '%TEMP%\Sysqemhrsvh.exe'
- '%TEMP%\Sysqemnzjiz.exe'
- '%TEMP%\Sysqemanlvt.exe'
- '%TEMP%\Sysqemdhwmv.exe'
- '%TEMP%\Sysqemvffbe.exe'
- '%TEMP%\Sysqembtfvj.exe'
- '%TEMP%\Sysqemqvybf.exe'
- '%TEMP%\Sysqemiasti.exe'
- '%TEMP%\Sysqemawtrq.exe'
- '%TEMP%\Sysqemqhfyd.exe'
- '%TEMP%\Sysqemfeuhs.exe'
- '%TEMP%\Sysqemanyzu.exe'
- '%TEMP%\Sysqemxbzxs.exe'
- '%TEMP%\Sysqemboiyt.exe'
- '%TEMP%\Sysqemwylzw.exe'
- '%TEMP%\Sysqemhaukh.exe'
- '%TEMP%\Sysqembmmwx.exe'
- '%TEMP%\Sysqemuydrw.exe'
- '%TEMP%\Sysqemyioso.exe'
- '%TEMP%\Sysqemqfkmr.exe'
- '%TEMP%\Sysqemgcvxb.exe'
- '%TEMP%\Sysqemrqlju.exe'
- '%TEMP%\Sysqemjerib.exe'
- '%TEMP%\Sysqemrmpts.exe'
- '%TEMP%\Sysqemeudzo.exe'
- '%TEMP%\Sysqemeyrpi.exe'
- '%TEMP%\Sysqempxkwk.exe'
- '%TEMP%\Sysqempamid.exe'
- '%TEMP%\Sysqemwbjyd.exe'
- '%TEMP%\Sysqempjrta.exe'
- '%TEMP%\Sysqempoznt.exe'
- '%TEMP%\Sysqembqqgv.exe'
- '%TEMP%\Sysqemesvrm.exe'
- '%TEMP%\Sysqemuawtx.exe'
- '%TEMP%\Sysqemthvou.exe'
Executes the following:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Modifies file system :
Creates the following files:
- %TEMP%\Sysqemicrqd.exe
- %TEMP%\Sysqemniwbo.exe
- %TEMP%\Sysqemxkznl.exe
- %TEMP%\Sysqemnopbt.exe
- %TEMP%\Sysqemvhyzn.exe
- %TEMP%\Sysqemnbfzi.exe
- %TEMP%\Sysqemhwhwb.exe
- %TEMP%\Sysqemksvcv.exe
- %TEMP%\Sysqemvcydy.exe
- %TEMP%\Sysqemkkzxb.exe
- %TEMP%\Sysqemsdavv.exe
- %TEMP%\Sysqemxjedp.exe
- %TEMP%\Sysqemagjtl.exe
- %TEMP%\Sysqemgeyze.exe
- %TEMP%\Sysqemtmivr.exe
- %TEMP%\Sysqemgcvxb.exe
- %TEMP%\Sysqemghpiy.exe
- %TEMP%\Sysqemvmmfr.exe
- %TEMP%\Sysqemlolmz.exe
- %TEMP%\Sysqemqnsss.exe
- %TEMP%\Sysqemnqwzg.exe
- %TEMP%\Sysqemagexn.exe
- %TEMP%\Sysqemnfkdv.exe
- %TEMP%\Sysqemzqela.exe
- %TEMP%\Sysqemrgqsp.exe
- %TEMP%\Sysqemmznub.exe
- %TEMP%\Sysqemoxjru.exe
- %TEMP%\Sysqemwrspp.exe
- %TEMP%\Sysqemetiim.exe
- %TEMP%\Sysqemnjjid.exe
- %TEMP%\Sysqemqinjd.exe
- %TEMP%\Sysqemizjtq.exe
- %TEMP%\Sysqemtkjre.exe
- %TEMP%\Sysqemdwttu.exe
- %TEMP%\Sysqemmjeqm.exe
- %TEMP%\Sysqemnwtjj.exe
- %TEMP%\Sysqemrcwpi.exe
- %TEMP%\Sysqemzqoww.exe
- %TEMP%\Sysqemkwrsp.exe
- %TEMP%\Sysqematclh.exe
- %TEMP%\Sysqempguam.exe
- %TEMP%\Sysqemfxmcf.exe
- %TEMP%\Sysqemzhoqd.exe
- %TEMP%\Sysqemkcfui.exe
- %TEMP%\Sysqemrrxbv.exe
- %TEMP%\Sysqemzgumn.exe
- %TEMP%\Sysqempuvvs.exe
- %TEMP%\Sysqemchoje.exe
- %TEMP%\Sysqemhxbkv.exe
- %TEMP%\Sysqemawtrq.exe
- %TEMP%\Sysqemqfopr.exe
- %TEMP%\Sysqempjxju.exe
- %TEMP%\Sysqemcbwok.exe
- %TEMP%\Sysqemsgggc.exe
- %TEMP%\Sysqemhrsvh.exe
- %TEMP%\Sysqemcabkj.exe
- %TEMP%\Sysqemsjxpv.exe
- %TEMP%\Sysqemiasti.exe
- %TEMP%\Sysqembtfvj.exe
- %TEMP%\Sysqemdhwmv.exe
- %TEMP%\Sysqemvffbe.exe
- %TEMP%\qpath.ini
- %TEMP%\Sysqamqqvaqqd.exe
- %TEMP%\Sysqemnzjiz.exe
- %TEMP%\Sysqemanyzu.exe
- %TEMP%\Sysqemqhfyd.exe
- %TEMP%\Sysqemfeuhs.exe
- %TEMP%\Sysqemanlvt.exe
- %TEMP%\Sysqemqvybf.exe
- %TEMP%\Sysqemhaukh.exe
- %TEMP%\Sysqemboiyt.exe
- %TEMP%\Sysqemuydrw.exe
- %TEMP%\Sysqembqqgv.exe
- %TEMP%\Sysqembmmwx.exe
- %TEMP%\Sysqemwylzw.exe
- %TEMP%\Sysqemrqlju.exe
- %TEMP%\Sysqemqfkmr.exe
- %TEMP%\Sysqemrmpts.exe
- %TEMP%\Sysqemyioso.exe
- %TEMP%\Sysqemjerib.exe
- %TEMP%\Sysqempoznt.exe
- %TEMP%\Sysqemwbjyd.exe
- %TEMP%\Sysqempxkwk.exe
- %TEMP%\Sysqempamid.exe
- %TEMP%\Sysqemmqica.exe
- %TEMP%\Sysqemxbzxs.exe
- %TEMP%\Sysqemeudzo.exe
- %TEMP%\Sysqemthvou.exe
- %TEMP%\Sysqemesvrm.exe
- %TEMP%\Sysqemuawtx.exe
- %TEMP%\Sysqemeyrpi.exe
- %TEMP%\Sysqempjrta.exe
Sets the 'hidden' attribute to the following files:
- %TEMP%\Sysqemicrqd.exe
- %TEMP%\Sysqemniwbo.exe
- %TEMP%\Sysqemxkznl.exe
- %TEMP%\Sysqemnopbt.exe
- %TEMP%\Sysqemvhyzn.exe
- %TEMP%\Sysqemnbfzi.exe
- %TEMP%\Sysqemhwhwb.exe
- %TEMP%\Sysqemksvcv.exe
- %TEMP%\Sysqemvcydy.exe
- %TEMP%\Sysqemkkzxb.exe
- %TEMP%\Sysqemsdavv.exe
- %TEMP%\Sysqemgeyze.exe
- %TEMP%\Sysqemvmmfr.exe
- %TEMP%\Sysqemagjtl.exe
- %TEMP%\Sysqemghpiy.exe
- %TEMP%\Sysqemtmivr.exe
- %TEMP%\Sysqemagexn.exe
- %TEMP%\Sysqemqnsss.exe
- %TEMP%\Sysqemxjedp.exe
- %TEMP%\Sysqemlolmz.exe
- %TEMP%\Sysqemnfkdv.exe
- %TEMP%\Sysqemnqwzg.exe
- %TEMP%\Sysqemkwrsp.exe
- %TEMP%\Sysqemzqela.exe
- %TEMP%\Sysqemrgqsp.exe
- %TEMP%\Sysqemmznub.exe
- %TEMP%\Sysqemoxjru.exe
- %TEMP%\Sysqemwrspp.exe
- %TEMP%\Sysqemetiim.exe
- %TEMP%\Sysqemnjjid.exe
- %TEMP%\Sysqemqinjd.exe
- %TEMP%\Sysqemizjtq.exe
- %TEMP%\Sysqemtkjre.exe
- %TEMP%\Sysqemdwttu.exe
- %TEMP%\Sysqemrcwpi.exe
- %TEMP%\Sysqempguam.exe
- %TEMP%\Sysqemnwtjj.exe
- %TEMP%\Sysqematclh.exe
- %TEMP%\Sysqemzqoww.exe
- %TEMP%\Sysqemrrxbv.exe
- %TEMP%\Sysqemzhoqd.exe
- %TEMP%\Sysqemmjeqm.exe
- %TEMP%\Sysqemfxmcf.exe
- %TEMP%\Sysqemzgumn.exe
- %TEMP%\Sysqemkcfui.exe
- %TEMP%\Sysqemgcvxb.exe
- %TEMP%\Sysqempuvvs.exe
- %TEMP%\Sysqemchoje.exe
- %TEMP%\Sysqemhxbkv.exe
- %TEMP%\Sysqemawtrq.exe
- %TEMP%\Sysqemqfopr.exe
- %TEMP%\Sysqempjxju.exe
- %TEMP%\Sysqemcbwok.exe
- %TEMP%\Sysqemsgggc.exe
- %TEMP%\Sysqemhrsvh.exe
- %TEMP%\Sysqemcabkj.exe
- %TEMP%\Sysqemsjxpv.exe
- %TEMP%\Sysqemdhwmv.exe
- %TEMP%\Sysqemnzjiz.exe
- %TEMP%\Sysqembtfvj.exe
- %TEMP%\Sysqemvffbe.exe
- %TEMP%\Sysqamqqvaqqd.exe
- %TEMP%\Sysqemanlvt.exe
- %TEMP%\Sysqemqhfyd.exe
- %TEMP%\Sysqemiasti.exe
- %TEMP%\Sysqemanyzu.exe
- %TEMP%\Sysqemqvybf.exe
- %TEMP%\Sysqemfeuhs.exe
- %TEMP%\Sysqemmqica.exe
- %TEMP%\Sysqemhaukh.exe
- %TEMP%\Sysqemboiyt.exe
- %TEMP%\Sysqemuydrw.exe
- %TEMP%\Sysqembqqgv.exe
- %TEMP%\Sysqembmmwx.exe
- %TEMP%\Sysqemwylzw.exe
- %TEMP%\Sysqemrqlju.exe
- %TEMP%\Sysqemqfkmr.exe
- %TEMP%\Sysqemrmpts.exe
- %TEMP%\Sysqemyioso.exe
- %TEMP%\Sysqemjerib.exe
- %TEMP%\Sysqempxkwk.exe
- %TEMP%\Sysqemeudzo.exe
- %TEMP%\Sysqemwbjyd.exe
- %TEMP%\Sysqemxbzxs.exe
- %TEMP%\Sysqempamid.exe
- %TEMP%\Sysqemeyrpi.exe
- %TEMP%\Sysqemesvrm.exe
- %TEMP%\Sysqempoznt.exe
- %TEMP%\Sysqemthvou.exe
- %TEMP%\Sysqempjrta.exe
- %TEMP%\Sysqemuawtx.exe
