80c2e1f29d6a3fba105c4a57cb3b15687d7ea6bf0e70aef371520039e05ba722

Analysis

max time kernel
149s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Scan00102207.exe
Size

1.3MB
MD5

54d7d3c1b92c9034542d9b2ea513aee7
SHA1

87ba9b8bc1ddde0f68fe2f4f59fef1242f96ed4c
SHA256

6610fa5fa05c6918011ca2ea766eb3062869086dc66713e1d259ac7c4efc4550
SHA512

3821c880199e85a9607914f0d5e062eccac34ca0094b2e2f40fab2a4782bf55c8b9f2afd31d6b8c08898fa4030a80e88a81119966ea79d41ba316d4a3b6449f7
SSDEEP

24576:tqDEvCTbMWu7rQYlBQcBiT6rprG8aAt7k73s2Xc5fQTkK:tTvC/MTQYxsWR7aAtq3+NQY

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scan00102207.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2068	Scan00102207.exe
2068	Scan00102207.exe
2072	Scan00102207.exe
2072	Scan00102207.exe
2280	Scan00102207.exe
2280	Scan00102207.exe
2832	Scan00102207.exe
2832	Scan00102207.exe
2364	Scan00102207.exe
2364	Scan00102207.exe
2920	Scan00102207.exe
2920	Scan00102207.exe
2608	Scan00102207.exe
2608	Scan00102207.exe
2660	Scan00102207.exe
2660	Scan00102207.exe
1656	Scan00102207.exe
1656	Scan00102207.exe
1724	Scan00102207.exe
1724	Scan00102207.exe
1852	Scan00102207.exe
1852	Scan00102207.exe
2028	Scan00102207.exe
2028	Scan00102207.exe
112	Scan00102207.exe
112	Scan00102207.exe
2648	Scan00102207.exe
2648	Scan00102207.exe
2064	Scan00102207.exe
2064	Scan00102207.exe
2100	Scan00102207.exe
2100	Scan00102207.exe
2460	Scan00102207.exe
2460	Scan00102207.exe
1464	Scan00102207.exe
1464	Scan00102207.exe
2016	Scan00102207.exe
2016	Scan00102207.exe
896	Scan00102207.exe
896	Scan00102207.exe
1012	Scan00102207.exe
1012	Scan00102207.exe
2564	Scan00102207.exe
2564	Scan00102207.exe
2288	Scan00102207.exe
2288	Scan00102207.exe
1788	Scan00102207.exe
1788	Scan00102207.exe
3008	Scan00102207.exe
3008	Scan00102207.exe
2388	Scan00102207.exe
2388	Scan00102207.exe
2716	Scan00102207.exe
2716	Scan00102207.exe
2808	Scan00102207.exe
2808	Scan00102207.exe
2820	Scan00102207.exe
2820	Scan00102207.exe
2664	Scan00102207.exe
2664	Scan00102207.exe
2572	Scan00102207.exe
2572	Scan00102207.exe
1268	Scan00102207.exe
1268	Scan00102207.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2068	Scan00102207.exe
2068	Scan00102207.exe
2072	Scan00102207.exe
2072	Scan00102207.exe
2280	Scan00102207.exe
2280	Scan00102207.exe
2832	Scan00102207.exe
2832	Scan00102207.exe
2364	Scan00102207.exe
2364	Scan00102207.exe
2920	Scan00102207.exe
2920	Scan00102207.exe
2608	Scan00102207.exe
2608	Scan00102207.exe
2660	Scan00102207.exe
2660	Scan00102207.exe
1656	Scan00102207.exe
1656	Scan00102207.exe
1724	Scan00102207.exe
1724	Scan00102207.exe
1852	Scan00102207.exe
1852	Scan00102207.exe
2028	Scan00102207.exe
2028	Scan00102207.exe
112	Scan00102207.exe
112	Scan00102207.exe
2648	Scan00102207.exe
2648	Scan00102207.exe
2064	Scan00102207.exe
2064	Scan00102207.exe
2100	Scan00102207.exe
2100	Scan00102207.exe
2460	Scan00102207.exe
2460	Scan00102207.exe
1464	Scan00102207.exe
1464	Scan00102207.exe
2016	Scan00102207.exe
2016	Scan00102207.exe
896	Scan00102207.exe
896	Scan00102207.exe
1012	Scan00102207.exe
1012	Scan00102207.exe
2564	Scan00102207.exe
2564	Scan00102207.exe
2288	Scan00102207.exe
2288	Scan00102207.exe
1788	Scan00102207.exe
1788	Scan00102207.exe
3008	Scan00102207.exe
3008	Scan00102207.exe
2388	Scan00102207.exe
2388	Scan00102207.exe
2716	Scan00102207.exe
2716	Scan00102207.exe
2808	Scan00102207.exe
2808	Scan00102207.exe
2820	Scan00102207.exe
2820	Scan00102207.exe
2664	Scan00102207.exe
2664	Scan00102207.exe
2572	Scan00102207.exe
2572	Scan00102207.exe
1268	Scan00102207.exe
1268	Scan00102207.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2072	2068	Scan00102207.exe	30
PID 2068 wrote to memory of 2072	2068	Scan00102207.exe	30
PID 2068 wrote to memory of 2072	2068	Scan00102207.exe	30
PID 2068 wrote to memory of 2072	2068	Scan00102207.exe	30
PID 2072 wrote to memory of 2280	2072	Scan00102207.exe	31
PID 2072 wrote to memory of 2280	2072	Scan00102207.exe	31
PID 2072 wrote to memory of 2280	2072	Scan00102207.exe	31
PID 2072 wrote to memory of 2280	2072	Scan00102207.exe	31
PID 2280 wrote to memory of 2832	2280	Scan00102207.exe	33
PID 2280 wrote to memory of 2832	2280	Scan00102207.exe	33
PID 2280 wrote to memory of 2832	2280	Scan00102207.exe	33
PID 2280 wrote to memory of 2832	2280	Scan00102207.exe	33
PID 2832 wrote to memory of 2364	2832	Scan00102207.exe	34
PID 2832 wrote to memory of 2364	2832	Scan00102207.exe	34
PID 2832 wrote to memory of 2364	2832	Scan00102207.exe	34
PID 2832 wrote to memory of 2364	2832	Scan00102207.exe	34
PID 2364 wrote to memory of 2920	2364	Scan00102207.exe	35
PID 2364 wrote to memory of 2920	2364	Scan00102207.exe	35
PID 2364 wrote to memory of 2920	2364	Scan00102207.exe	35
PID 2364 wrote to memory of 2920	2364	Scan00102207.exe	35
PID 2920 wrote to memory of 2608	2920	Scan00102207.exe	36
PID 2920 wrote to memory of 2608	2920	Scan00102207.exe	36
PID 2920 wrote to memory of 2608	2920	Scan00102207.exe	36
PID 2920 wrote to memory of 2608	2920	Scan00102207.exe	36
PID 2608 wrote to memory of 2660	2608	Scan00102207.exe	37
PID 2608 wrote to memory of 2660	2608	Scan00102207.exe	37
PID 2608 wrote to memory of 2660	2608	Scan00102207.exe	37
PID 2608 wrote to memory of 2660	2608	Scan00102207.exe	37
PID 2660 wrote to memory of 1656	2660	Scan00102207.exe	38
PID 2660 wrote to memory of 1656	2660	Scan00102207.exe	38
PID 2660 wrote to memory of 1656	2660	Scan00102207.exe	38
PID 2660 wrote to memory of 1656	2660	Scan00102207.exe	38
PID 1656 wrote to memory of 1724	1656	Scan00102207.exe	39
PID 1656 wrote to memory of 1724	1656	Scan00102207.exe	39
PID 1656 wrote to memory of 1724	1656	Scan00102207.exe	39
PID 1656 wrote to memory of 1724	1656	Scan00102207.exe	39
PID 1724 wrote to memory of 1852	1724	Scan00102207.exe	40
PID 1724 wrote to memory of 1852	1724	Scan00102207.exe	40
PID 1724 wrote to memory of 1852	1724	Scan00102207.exe	40
PID 1724 wrote to memory of 1852	1724	Scan00102207.exe	40
PID 1852 wrote to memory of 2028	1852	Scan00102207.exe	41
PID 1852 wrote to memory of 2028	1852	Scan00102207.exe	41
PID 1852 wrote to memory of 2028	1852	Scan00102207.exe	41
PID 1852 wrote to memory of 2028	1852	Scan00102207.exe	41
PID 2028 wrote to memory of 112	2028	Scan00102207.exe	42
PID 2028 wrote to memory of 112	2028	Scan00102207.exe	42
PID 2028 wrote to memory of 112	2028	Scan00102207.exe	42
PID 2028 wrote to memory of 112	2028	Scan00102207.exe	42
PID 112 wrote to memory of 2648	112	Scan00102207.exe	43
PID 112 wrote to memory of 2648	112	Scan00102207.exe	43
PID 112 wrote to memory of 2648	112	Scan00102207.exe	43
PID 112 wrote to memory of 2648	112	Scan00102207.exe	43
PID 2648 wrote to memory of 2064	2648	Scan00102207.exe	44
PID 2648 wrote to memory of 2064	2648	Scan00102207.exe	44
PID 2648 wrote to memory of 2064	2648	Scan00102207.exe	44
PID 2648 wrote to memory of 2064	2648	Scan00102207.exe	44
PID 2064 wrote to memory of 2100	2064	Scan00102207.exe	45
PID 2064 wrote to memory of 2100	2064	Scan00102207.exe	45
PID 2064 wrote to memory of 2100	2064	Scan00102207.exe	45
PID 2064 wrote to memory of 2100	2064	Scan00102207.exe	45
PID 2100 wrote to memory of 2460	2100	Scan00102207.exe	46
PID 2100 wrote to memory of 2460	2100	Scan00102207.exe	46
PID 2100 wrote to memory of 2460	2100	Scan00102207.exe	46
PID 2100 wrote to memory of 2460	2100	Scan00102207.exe	46

C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
"C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
  "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
    "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
      "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        6⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        7⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        9⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        10⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        11⤵
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        12⤵
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        13⤵
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:112
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        14⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        15⤵
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        16⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        17⤵
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        18⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        19⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        20⤵
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        21⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        22⤵
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        23⤵
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        24⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        25⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        26⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        27⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        28⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        29⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        30⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        31⤵
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        32⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        33⤵
        System Location Discovery: System Language Discovery
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        34⤵
        System Location Discovery: System Language Discovery
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        35⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        36⤵
        System Location Discovery: System Language Discovery
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        37⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        38⤵
        System Location Discovery: System Language Discovery
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        39⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        40⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        41⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        42⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        43⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        44⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        45⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        46⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        47⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        48⤵
        System Location Discovery: System Language Discovery
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        49⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        50⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        51⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        52⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        53⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        54⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        55⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        56⤵
        System Location Discovery: System Language Discovery
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        57⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        58⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        59⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        60⤵
        System Location Discovery: System Language Discovery
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        61⤵
        System Location Discovery: System Language Discovery
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        62⤵
        
        PID:676
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        63⤵
        System Location Discovery: System Language Discovery
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        64⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        65⤵
        System Location Discovery: System Language Discovery
        
        PID:780
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        66⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        67⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        68⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        69⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        70⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        71⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        72⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        73⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        75⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        76⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        77⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        78⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        80⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        81⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        83⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        84⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        85⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        86⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        87⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        89⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        90⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        91⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        92⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        93⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        94⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        97⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        99⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        100⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        102⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        104⤵
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        105⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        106⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        107⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        108⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        109⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        110⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        111⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        113⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        114⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        117⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        119⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        120⤵
        System Location Discovery: System Language Discovery
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        121⤵
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        122⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        124⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        125⤵
        System Location Discovery: System Language Discovery
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        126⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        128⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        131⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        133⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        134⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        135⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        136⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        138⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        141⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        143⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        144⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        145⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        147⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        148⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        151⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        152⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        153⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        154⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        155⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        156⤵
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        157⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        158⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        159⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        160⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        161⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        162⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        163⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        164⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        165⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        167⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        168⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        169⤵
        System Location Discovery: System Language Discovery
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        171⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        172⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        173⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        174⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        176⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        177⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        179⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        181⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        182⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        183⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        184⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        185⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        186⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        187⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        188⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        189⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        190⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        191⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        192⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        193⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        194⤵
        System Location Discovery: System Language Discovery
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        195⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        197⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        198⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        199⤵
        System Location Discovery: System Language Discovery
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        200⤵
        System Location Discovery: System Language Discovery
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        202⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        203⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        204⤵
        System Location Discovery: System Language Discovery
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        205⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        206⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        207⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        208⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        209⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        210⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        211⤵
        System Location Discovery: System Language Discovery
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        212⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        213⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        214⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Scan00102207.exe"
        215⤵
        System Location Discovery: System Language Discovery
        
        PID:3816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\autC68A.tmp

Filesize
417KB

MD5
743c7721cae039db88b61e8ec3bb55ac

SHA1
a25b127bef654cd5337a4e356ff607ac047f9c5a

SHA256
bd7d638fe2ded32ec393b8cf43607ddb6984e5346f1690bbed9aaeefe52444d9

SHA512
079318fe0f73815408119b9009bd16a62dced9e9d532fdd0535d6ff1c0eaa2ef1e2f73478a5b0b079e43164b2b9ff51b38e1852490a662fda766a09ba3cee1aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\autC69A.tmp

Filesize
9KB

MD5
dd0b1108529f1cebafb549f579572a56

SHA1
2e919facff6720bc9002ac6b41ff572ae1364e27

SHA256
a6e7e0192b5358843da1145c6ce24e9429af24c74d30a0c36c03adda79754a83

SHA512
ad2435dad9bfe76f588ebb23ac39a604ef2d1cf264c08d267de3889d4e0cba4fd8d558fabbd09d09bde05d52388ea1e42bdecd2af27e4fb8f2c001104722a805

Download Submit
C:\Users\Admin\AppData\Local\Temp\neophobic

Filesize
28KB

MD5
5078da5a6edbf3f2717e3c42f104653a

SHA1
149826b6633e609c981db238ba6f78763f19a8a0

SHA256
2ff0969fd4aa99e24e0de68dc1680419bd1d8ac171ce7642f19fc53ef5c9bf43

SHA512
02c5a0bb8c022c94d501ec9250e80b5d88e44c775bd3cc9ff3cbd2de4bd327d48f3562593b195e87f97f1ebf5bb10bcb40f4334b64513f2fc5c00724de045096

Download Submit
C:\Users\Admin\AppData\Local\Temp\polygamodioecious

Filesize
482KB

MD5
10a0ee411d5dfad40b84ea6cb7c37f5a

SHA1
077f83b6254af8a729fc58315d5fd318122e5f83

SHA256
dae3463a4bc22fa2d45f482b3e1fa1403783b63c880a1da917ed0caa86830979

SHA512
bf4eae7b08be2385ecf8cb8d5b0e58034a6f3492ac07bef1c2245e6dfc8033e4aafbf845a66cbc9ab633930b1912da542d2aaa65a92240a2c125d3bb1683fdbc

Download Submit
memory/2068-11-0x0000000000870000-0x0000000000874000-memory.dmp

Filesize
16KB

Download