Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 03:24
Behavioral task
behavioral1
Sample
99964aa7fc130f8e0bedb24c603af3d0N.exe
Resource
win7-20240729-en
General
-
Target
99964aa7fc130f8e0bedb24c603af3d0N.exe
-
Size
402KB
-
MD5
99964aa7fc130f8e0bedb24c603af3d0
-
SHA1
7bdc9de6eafe2843de19a76ad527474361779584
-
SHA256
d8e8d01692ffb54d12f83a0124c3c98b8884bc15a6d1abdab0b1c9e6b03f5bde
-
SHA512
5b201a455e8028f264ef7be222a0426618343c4c4bd571d57c147d341737d2fa93e5e530e5f1947d513a7e3095b765544d0a55086d7113fae94f8b03f9cbca95
-
SSDEEP
6144:C4MYvqF+2KNBjVnP6oo3CYslL6+SL8g92S0+GlajBZDwcrdzYA0JxIkYofiB:CrYrJl6LCY2kt2SX5jMWYVbV6B
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation G5WIY.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation HPRE3.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation JH294.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 8530K.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 36X89.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 1HL40.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 25VTH.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation LG9OZ.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 54949.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation CY0C6.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 0CUO1.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 59JOG.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation WKHKP.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 46Z4Q.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 8HR84.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation M7OUE.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation KD722.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 533C9.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation T8U07.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation HIIKO.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 8S1U2.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation A58R8.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 97324.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 91WR5.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation L022Z.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation JY9F5.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation Q79M8.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 76203.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation SA4UC.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 2889G.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 80FNR.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 6X296.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation FI204.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation PDR3K.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 4O0F2.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation Z4IC4.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 246SD.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation J105L.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 28867.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 6YZTZ.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 9C34U.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 4WYBS.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 6K3EG.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation M0W2H.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation D78EQ.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 822ZB.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation U10V5.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation D4Z9Q.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation N2N8C.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation VKMF7.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation V0568.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 73H9T.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation U262G.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 653RK.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 47ZA5.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation FG102.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation HI7VH.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation FB6T2.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 921I4.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation D00CH.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 367FV.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation V8O50.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 62W0H.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation V74N6.exe -
Executes dropped EXE 64 IoCs
pid Process 4548 0SY1G.exe 4916 P738S.exe 5100 653RK.exe 2776 7558L.exe 2456 F3LBE.exe 2276 G5WIY.exe 2244 A4S5C.exe 2196 2XU0D.exe 1036 79YK6.exe 1716 0486L.exe 5068 A43M9.exe 3584 1M183.exe 880 51A8W.exe 4980 1GRW9.exe 3220 5414H.exe 1184 828XN.exe 3144 7U295.exe 4088 ML3NY.exe 2236 4CER5.exe 2444 9C34U.exe 4868 9S52G.exe 4880 AR45V.exe 1460 KD722.exe 4596 5S94R.exe 3240 60095.exe 2272 2IXSD.exe 1552 QXX30.exe 3760 X833S.exe 2936 6W5NC.exe 4808 62Y29.exe 4452 0RGCL.exe 4464 533C9.exe 972 25VTH.exe 2448 Q9J45.exe 3676 U10V5.exe 5100 2I090.exe 3556 R98MT.exe 3320 A30D5.exe 3568 1FAW4.exe 1460 80FNR.exe 3476 36YN6.exe 2940 78D0M.exe 1168 JWU1U.exe 3284 47ZA5.exe 1664 SU434.exe 4100 921I4.exe 4364 HIIKO.exe 3276 3OCV7.exe 3412 A4NBZ.exe 4584 GUAKT.exe 3768 130VA.exe 4740 JY9F5.exe 2088 52700.exe 1936 KHM9R.exe 4880 0191E.exe 4264 LG9OZ.exe 5092 141G0.exe 3896 QTEI0.exe 3968 630TE.exe 1604 D4Z9Q.exe 3688 V2BZR.exe 3180 VWDR8.exe 4108 Z4IC4.exe 3584 HPRE3.exe -
resource yara_rule behavioral2/memory/4312-0-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x000900000002346b-5.dat upx behavioral2/memory/4312-10-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234cf-17.dat upx behavioral2/memory/4916-19-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/memory/4548-21-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00080000000234cc-28.dat upx behavioral2/memory/5100-30-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/memory/4916-32-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234d0-39.dat upx behavioral2/memory/5100-42-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x0002000000022a83-50.dat upx behavioral2/memory/2776-52-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x0003000000022a80-59.dat upx behavioral2/memory/2456-62-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x000e000000023426-69.dat upx behavioral2/memory/2276-72-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/memory/2196-81-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234d1-80.dat upx behavioral2/memory/2244-83-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x000a000000023423-90.dat upx behavioral2/memory/1036-92-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/memory/2196-94-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234d3-101.dat upx behavioral2/memory/1036-102-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234d4-111.dat upx behavioral2/memory/1716-113-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234d5-121.dat upx behavioral2/memory/5068-124-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/memory/3584-122-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x000900000002341e-131.dat upx behavioral2/memory/3584-134-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x0009000000023421-142.dat upx behavioral2/memory/880-144-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234d6-152.dat upx behavioral2/memory/4980-154-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234d7-161.dat upx behavioral2/memory/3220-164-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234d8-171.dat upx behavioral2/memory/1184-175-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/memory/3144-173-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234d9-182.dat upx behavioral2/memory/3144-185-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234da-192.dat upx behavioral2/memory/4088-196-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/memory/2236-194-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234db-204.dat upx behavioral2/memory/2236-206-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234dc-214.dat upx behavioral2/memory/2444-215-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234dd-222.dat upx behavioral2/memory/4868-224-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234df-231.dat upx behavioral2/memory/4880-234-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234e0-241.dat upx behavioral2/memory/1460-244-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/memory/3240-253-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/memory/4596-255-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234e1-252.dat upx behavioral2/files/0x00070000000234e2-262.dat upx behavioral2/memory/3240-265-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234e3-273.dat upx behavioral2/memory/2272-275-0x0000000000400000-0x0000000000539000-memory.dmp upx behavioral2/files/0x00070000000234e4-283.dat upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52P28.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29YD3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D78EQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Q9J45.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47ZA5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51M2O.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6U474.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0486L.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13SG0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language L2V07.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6O20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 073OH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language U7S6P.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8MJI7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60095.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language G222Z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAA11.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HM52M.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language K774P.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DT1DK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLS57.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51A8W.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 921I4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5M9Y.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91WR5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NR4TS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28867.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVKOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB6T2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0RGCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DJUWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B698.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26Y56.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language I0509.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 130VA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PXGD4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4QO2G.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FNU7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D00CH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language I4YVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76JZ6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25VTH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0NZTU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NKRA5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0LX11.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FM0KW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43QZ5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62W0H.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOMW9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LD722.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDQR0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SD9CP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2IXSD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language R7L6K.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14OQ7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0PZ0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E0MW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3SXWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language R5S55.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 367FV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 653RK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7U295.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KD722.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52700.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4312 99964aa7fc130f8e0bedb24c603af3d0N.exe 4312 99964aa7fc130f8e0bedb24c603af3d0N.exe 4548 0SY1G.exe 4548 0SY1G.exe 4916 P738S.exe 4916 P738S.exe 5100 653RK.exe 5100 653RK.exe 2776 7558L.exe 2776 7558L.exe 2456 F3LBE.exe 2456 F3LBE.exe 2276 G5WIY.exe 2276 G5WIY.exe 2244 A4S5C.exe 2244 A4S5C.exe 2196 2XU0D.exe 2196 2XU0D.exe 1036 79YK6.exe 1036 79YK6.exe 1716 0486L.exe 1716 0486L.exe 5068 A43M9.exe 5068 A43M9.exe 3584 1M183.exe 3584 1M183.exe 880 51A8W.exe 880 51A8W.exe 4980 1GRW9.exe 4980 1GRW9.exe 3220 5414H.exe 3220 5414H.exe 1184 828XN.exe 1184 828XN.exe 3144 7U295.exe 3144 7U295.exe 4088 ML3NY.exe 4088 ML3NY.exe 2236 4CER5.exe 2236 4CER5.exe 2444 9C34U.exe 2444 9C34U.exe 4868 9S52G.exe 4868 9S52G.exe 4880 AR45V.exe 4880 AR45V.exe 1460 KD722.exe 1460 KD722.exe 4596 5S94R.exe 4596 5S94R.exe 3240 60095.exe 3240 60095.exe 2272 2IXSD.exe 2272 2IXSD.exe 1552 QXX30.exe 1552 QXX30.exe 3760 X833S.exe 3760 X833S.exe 2936 6W5NC.exe 2936 6W5NC.exe 4808 62Y29.exe 4808 62Y29.exe 4452 0RGCL.exe 4452 0RGCL.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4312 wrote to memory of 4548 4312 99964aa7fc130f8e0bedb24c603af3d0N.exe 86 PID 4312 wrote to memory of 4548 4312 99964aa7fc130f8e0bedb24c603af3d0N.exe 86 PID 4312 wrote to memory of 4548 4312 99964aa7fc130f8e0bedb24c603af3d0N.exe 86 PID 4548 wrote to memory of 4916 4548 0SY1G.exe 87 PID 4548 wrote to memory of 4916 4548 0SY1G.exe 87 PID 4548 wrote to memory of 4916 4548 0SY1G.exe 87 PID 4916 wrote to memory of 5100 4916 P738S.exe 88 PID 4916 wrote to memory of 5100 4916 P738S.exe 88 PID 4916 wrote to memory of 5100 4916 P738S.exe 88 PID 5100 wrote to memory of 2776 5100 653RK.exe 90 PID 5100 wrote to memory of 2776 5100 653RK.exe 90 PID 5100 wrote to memory of 2776 5100 653RK.exe 90 PID 2776 wrote to memory of 2456 2776 7558L.exe 91 PID 2776 wrote to memory of 2456 2776 7558L.exe 91 PID 2776 wrote to memory of 2456 2776 7558L.exe 91 PID 2456 wrote to memory of 2276 2456 F3LBE.exe 92 PID 2456 wrote to memory of 2276 2456 F3LBE.exe 92 PID 2456 wrote to memory of 2276 2456 F3LBE.exe 92 PID 2276 wrote to memory of 2244 2276 G5WIY.exe 93 PID 2276 wrote to memory of 2244 2276 G5WIY.exe 93 PID 2276 wrote to memory of 2244 2276 G5WIY.exe 93 PID 2244 wrote to memory of 2196 2244 A4S5C.exe 94 PID 2244 wrote to memory of 2196 2244 A4S5C.exe 94 PID 2244 wrote to memory of 2196 2244 A4S5C.exe 94 PID 2196 wrote to memory of 1036 2196 2XU0D.exe 95 PID 2196 wrote to memory of 1036 2196 2XU0D.exe 95 PID 2196 wrote to memory of 1036 2196 2XU0D.exe 95 PID 1036 wrote to memory of 1716 1036 79YK6.exe 96 PID 1036 wrote to memory of 1716 1036 79YK6.exe 96 PID 1036 wrote to memory of 1716 1036 79YK6.exe 96 PID 1716 wrote to memory of 5068 1716 0486L.exe 97 PID 1716 wrote to memory of 5068 1716 0486L.exe 97 PID 1716 wrote to memory of 5068 1716 0486L.exe 97 PID 5068 wrote to memory of 3584 5068 A43M9.exe 98 PID 5068 wrote to memory of 3584 5068 A43M9.exe 98 PID 5068 wrote to memory of 3584 5068 A43M9.exe 98 PID 3584 wrote to memory of 880 3584 1M183.exe 99 PID 3584 wrote to memory of 880 3584 1M183.exe 99 PID 3584 wrote to memory of 880 3584 1M183.exe 99 PID 880 wrote to memory of 4980 880 51A8W.exe 100 PID 880 wrote to memory of 4980 880 51A8W.exe 100 PID 880 wrote to memory of 4980 880 51A8W.exe 100 PID 4980 wrote to memory of 3220 4980 1GRW9.exe 101 PID 4980 wrote to memory of 3220 4980 1GRW9.exe 101 PID 4980 wrote to memory of 3220 4980 1GRW9.exe 101 PID 3220 wrote to memory of 1184 3220 5414H.exe 102 PID 3220 wrote to memory of 1184 3220 5414H.exe 102 PID 3220 wrote to memory of 1184 3220 5414H.exe 102 PID 1184 wrote to memory of 3144 1184 828XN.exe 103 PID 1184 wrote to memory of 3144 1184 828XN.exe 103 PID 1184 wrote to memory of 3144 1184 828XN.exe 103 PID 3144 wrote to memory of 4088 3144 7U295.exe 104 PID 3144 wrote to memory of 4088 3144 7U295.exe 104 PID 3144 wrote to memory of 4088 3144 7U295.exe 104 PID 4088 wrote to memory of 2236 4088 ML3NY.exe 105 PID 4088 wrote to memory of 2236 4088 ML3NY.exe 105 PID 4088 wrote to memory of 2236 4088 ML3NY.exe 105 PID 2236 wrote to memory of 2444 2236 4CER5.exe 108 PID 2236 wrote to memory of 2444 2236 4CER5.exe 108 PID 2236 wrote to memory of 2444 2236 4CER5.exe 108 PID 2444 wrote to memory of 4868 2444 9C34U.exe 109 PID 2444 wrote to memory of 4868 2444 9C34U.exe 109 PID 2444 wrote to memory of 4868 2444 9C34U.exe 109 PID 4868 wrote to memory of 4880 4868 9S52G.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\99964aa7fc130f8e0bedb24c603af3d0N.exe"C:\Users\Admin\AppData\Local\Temp\99964aa7fc130f8e0bedb24c603af3d0N.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\0SY1G.exe"C:\Users\Admin\AppData\Local\Temp\0SY1G.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\P738S.exe"C:\Users\Admin\AppData\Local\Temp\P738S.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\653RK.exe"C:\Users\Admin\AppData\Local\Temp\653RK.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\7558L.exe"C:\Users\Admin\AppData\Local\Temp\7558L.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\F3LBE.exe"C:\Users\Admin\AppData\Local\Temp\F3LBE.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\G5WIY.exe"C:\Users\Admin\AppData\Local\Temp\G5WIY.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\A4S5C.exe"C:\Users\Admin\AppData\Local\Temp\A4S5C.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\2XU0D.exe"C:\Users\Admin\AppData\Local\Temp\2XU0D.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\79YK6.exe"C:\Users\Admin\AppData\Local\Temp\79YK6.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\0486L.exe"C:\Users\Admin\AppData\Local\Temp\0486L.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\A43M9.exe"C:\Users\Admin\AppData\Local\Temp\A43M9.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\1M183.exe"C:\Users\Admin\AppData\Local\Temp\1M183.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\51A8W.exe"C:\Users\Admin\AppData\Local\Temp\51A8W.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\1GRW9.exe"C:\Users\Admin\AppData\Local\Temp\1GRW9.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\5414H.exe"C:\Users\Admin\AppData\Local\Temp\5414H.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\828XN.exe"C:\Users\Admin\AppData\Local\Temp\828XN.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\7U295.exe"C:\Users\Admin\AppData\Local\Temp\7U295.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\ML3NY.exe"C:\Users\Admin\AppData\Local\Temp\ML3NY.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\4CER5.exe"C:\Users\Admin\AppData\Local\Temp\4CER5.exe"20⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\9C34U.exe"C:\Users\Admin\AppData\Local\Temp\9C34U.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\9S52G.exe"C:\Users\Admin\AppData\Local\Temp\9S52G.exe"22⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\AR45V.exe"C:\Users\Admin\AppData\Local\Temp\AR45V.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\KD722.exe"C:\Users\Admin\AppData\Local\Temp\KD722.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\5S94R.exe"C:\Users\Admin\AppData\Local\Temp\5S94R.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\60095.exe"C:\Users\Admin\AppData\Local\Temp\60095.exe"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\2IXSD.exe"C:\Users\Admin\AppData\Local\Temp\2IXSD.exe"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\QXX30.exe"C:\Users\Admin\AppData\Local\Temp\QXX30.exe"28⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\X833S.exe"C:\Users\Admin\AppData\Local\Temp\X833S.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\6W5NC.exe"C:\Users\Admin\AppData\Local\Temp\6W5NC.exe"30⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\62Y29.exe"C:\Users\Admin\AppData\Local\Temp\62Y29.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\0RGCL.exe"C:\Users\Admin\AppData\Local\Temp\0RGCL.exe"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\533C9.exe"C:\Users\Admin\AppData\Local\Temp\533C9.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\25VTH.exe"C:\Users\Admin\AppData\Local\Temp\25VTH.exe"34⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:972 -
C:\Users\Admin\AppData\Local\Temp\Q9J45.exe"C:\Users\Admin\AppData\Local\Temp\Q9J45.exe"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\U10V5.exe"C:\Users\Admin\AppData\Local\Temp\U10V5.exe"36⤵
- Checks computer location settings
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\2I090.exe"C:\Users\Admin\AppData\Local\Temp\2I090.exe"37⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\R98MT.exe"C:\Users\Admin\AppData\Local\Temp\R98MT.exe"38⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\A30D5.exe"C:\Users\Admin\AppData\Local\Temp\A30D5.exe"39⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\1FAW4.exe"C:\Users\Admin\AppData\Local\Temp\1FAW4.exe"40⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\80FNR.exe"C:\Users\Admin\AppData\Local\Temp\80FNR.exe"41⤵
- Checks computer location settings
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\36YN6.exe"C:\Users\Admin\AppData\Local\Temp\36YN6.exe"42⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\78D0M.exe"C:\Users\Admin\AppData\Local\Temp\78D0M.exe"43⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\JWU1U.exe"C:\Users\Admin\AppData\Local\Temp\JWU1U.exe"44⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\47ZA5.exe"C:\Users\Admin\AppData\Local\Temp\47ZA5.exe"45⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\SU434.exe"C:\Users\Admin\AppData\Local\Temp\SU434.exe"46⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\921I4.exe"C:\Users\Admin\AppData\Local\Temp\921I4.exe"47⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\HIIKO.exe"C:\Users\Admin\AppData\Local\Temp\HIIKO.exe"48⤵
- Checks computer location settings
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\3OCV7.exe"C:\Users\Admin\AppData\Local\Temp\3OCV7.exe"49⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\A4NBZ.exe"C:\Users\Admin\AppData\Local\Temp\A4NBZ.exe"50⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\GUAKT.exe"C:\Users\Admin\AppData\Local\Temp\GUAKT.exe"51⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\130VA.exe"C:\Users\Admin\AppData\Local\Temp\130VA.exe"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\JY9F5.exe"C:\Users\Admin\AppData\Local\Temp\JY9F5.exe"53⤵
- Checks computer location settings
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\52700.exe"C:\Users\Admin\AppData\Local\Temp\52700.exe"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\KHM9R.exe"C:\Users\Admin\AppData\Local\Temp\KHM9R.exe"55⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\0191E.exe"C:\Users\Admin\AppData\Local\Temp\0191E.exe"56⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\LG9OZ.exe"C:\Users\Admin\AppData\Local\Temp\LG9OZ.exe"57⤵
- Checks computer location settings
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\141G0.exe"C:\Users\Admin\AppData\Local\Temp\141G0.exe"58⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\QTEI0.exe"C:\Users\Admin\AppData\Local\Temp\QTEI0.exe"59⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\630TE.exe"C:\Users\Admin\AppData\Local\Temp\630TE.exe"60⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\D4Z9Q.exe"C:\Users\Admin\AppData\Local\Temp\D4Z9Q.exe"61⤵
- Checks computer location settings
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\V2BZR.exe"C:\Users\Admin\AppData\Local\Temp\V2BZR.exe"62⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\VWDR8.exe"C:\Users\Admin\AppData\Local\Temp\VWDR8.exe"63⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\Z4IC4.exe"C:\Users\Admin\AppData\Local\Temp\Z4IC4.exe"64⤵
- Checks computer location settings
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\HPRE3.exe"C:\Users\Admin\AppData\Local\Temp\HPRE3.exe"65⤵
- Checks computer location settings
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\A0B7V.exe"C:\Users\Admin\AppData\Local\Temp\A0B7V.exe"66⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\246SD.exe"C:\Users\Admin\AppData\Local\Temp\246SD.exe"67⤵
- Checks computer location settings
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\1NLNW.exe"C:\Users\Admin\AppData\Local\Temp\1NLNW.exe"68⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\JH294.exe"C:\Users\Admin\AppData\Local\Temp\JH294.exe"69⤵
- Checks computer location settings
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\CY0C6.exe"C:\Users\Admin\AppData\Local\Temp\CY0C6.exe"70⤵
- Checks computer location settings
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\CO038.exe"C:\Users\Admin\AppData\Local\Temp\CO038.exe"71⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\6OM7I.exe"C:\Users\Admin\AppData\Local\Temp\6OM7I.exe"72⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\4LU3Y.exe"C:\Users\Admin\AppData\Local\Temp\4LU3Y.exe"73⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\J105L.exe"C:\Users\Admin\AppData\Local\Temp\J105L.exe"74⤵
- Checks computer location settings
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\VKMF7.exe"C:\Users\Admin\AppData\Local\Temp\VKMF7.exe"75⤵
- Checks computer location settings
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\8530K.exe"C:\Users\Admin\AppData\Local\Temp\8530K.exe"76⤵
- Checks computer location settings
PID:804 -
C:\Users\Admin\AppData\Local\Temp\A9RPR.exe"C:\Users\Admin\AppData\Local\Temp\A9RPR.exe"77⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\6WT55.exe"C:\Users\Admin\AppData\Local\Temp\6WT55.exe"78⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\53BRQ.exe"C:\Users\Admin\AppData\Local\Temp\53BRQ.exe"79⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\U1ZKG.exe"C:\Users\Admin\AppData\Local\Temp\U1ZKG.exe"80⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\ICLC5.exe"C:\Users\Admin\AppData\Local\Temp\ICLC5.exe"81⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\96BD6.exe"C:\Users\Admin\AppData\Local\Temp\96BD6.exe"82⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\B5M9Y.exe"C:\Users\Admin\AppData\Local\Temp\B5M9Y.exe"83⤵
- System Location Discovery: System Language Discovery
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\8S1U2.exe"C:\Users\Admin\AppData\Local\Temp\8S1U2.exe"84⤵
- Checks computer location settings
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\36X89.exe"C:\Users\Admin\AppData\Local\Temp\36X89.exe"85⤵
- Checks computer location settings
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\271PP.exe"C:\Users\Admin\AppData\Local\Temp\271PP.exe"86⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\FIG4E.exe"C:\Users\Admin\AppData\Local\Temp\FIG4E.exe"87⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\59JOG.exe"C:\Users\Admin\AppData\Local\Temp\59JOG.exe"88⤵
- Checks computer location settings
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\EL6JT.exe"C:\Users\Admin\AppData\Local\Temp\EL6JT.exe"89⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\93Q9D.exe"C:\Users\Admin\AppData\Local\Temp\93Q9D.exe"90⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\0JK1N.exe"C:\Users\Admin\AppData\Local\Temp\0JK1N.exe"91⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\6G0T1.exe"C:\Users\Admin\AppData\Local\Temp\6G0T1.exe"92⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\4L766.exe"C:\Users\Admin\AppData\Local\Temp\4L766.exe"93⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\QVZPZ.exe"C:\Users\Admin\AppData\Local\Temp\QVZPZ.exe"94⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\6ZD39.exe"C:\Users\Admin\AppData\Local\Temp\6ZD39.exe"95⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\SCOMM.exe"C:\Users\Admin\AppData\Local\Temp\SCOMM.exe"96⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\6E0MW.exe"C:\Users\Admin\AppData\Local\Temp\6E0MW.exe"97⤵
- System Location Discovery: System Language Discovery
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\UW814.exe"C:\Users\Admin\AppData\Local\Temp\UW814.exe"98⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\PXGD4.exe"C:\Users\Admin\AppData\Local\Temp\PXGD4.exe"99⤵
- System Location Discovery: System Language Discovery
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\FM0KW.exe"C:\Users\Admin\AppData\Local\Temp\FM0KW.exe"100⤵
- System Location Discovery: System Language Discovery
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\FG102.exe"C:\Users\Admin\AppData\Local\Temp\FG102.exe"101⤵
- Checks computer location settings
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\922FT.exe"C:\Users\Admin\AppData\Local\Temp\922FT.exe"102⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\PICPJ.exe"C:\Users\Admin\AppData\Local\Temp\PICPJ.exe"103⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\054Z0.exe"C:\Users\Admin\AppData\Local\Temp\054Z0.exe"104⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\CI088.exe"C:\Users\Admin\AppData\Local\Temp\CI088.exe"105⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\54397.exe"C:\Users\Admin\AppData\Local\Temp\54397.exe"106⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\FF22I.exe"C:\Users\Admin\AppData\Local\Temp\FF22I.exe"107⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\932ID.exe"C:\Users\Admin\AppData\Local\Temp\932ID.exe"108⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\WKHKP.exe"C:\Users\Admin\AppData\Local\Temp\WKHKP.exe"109⤵
- Checks computer location settings
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\R7L6K.exe"C:\Users\Admin\AppData\Local\Temp\R7L6K.exe"110⤵
- System Location Discovery: System Language Discovery
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\AHG61.exe"C:\Users\Admin\AppData\Local\Temp\AHG61.exe"111⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\64X0U.exe"C:\Users\Admin\AppData\Local\Temp\64X0U.exe"112⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\0NZTU.exe"C:\Users\Admin\AppData\Local\Temp\0NZTU.exe"113⤵
- System Location Discovery: System Language Discovery
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\HI7VH.exe"C:\Users\Admin\AppData\Local\Temp\HI7VH.exe"114⤵
- Checks computer location settings
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\D6O20.exe"C:\Users\Admin\AppData\Local\Temp\D6O20.exe"115⤵
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\5AIC7.exe"C:\Users\Admin\AppData\Local\Temp\5AIC7.exe"116⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\V74N6.exe"C:\Users\Admin\AppData\Local\Temp\V74N6.exe"117⤵
- Checks computer location settings
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\073OH.exe"C:\Users\Admin\AppData\Local\Temp\073OH.exe"118⤵
- System Location Discovery: System Language Discovery
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\22R6H.exe"C:\Users\Admin\AppData\Local\Temp\22R6H.exe"119⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\U7S6P.exe"C:\Users\Admin\AppData\Local\Temp\U7S6P.exe"120⤵
- System Location Discovery: System Language Discovery
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\6X296.exe"C:\Users\Admin\AppData\Local\Temp\6X296.exe"121⤵
- Checks computer location settings
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\O33Q4.exe"C:\Users\Admin\AppData\Local\Temp\O33Q4.exe"122⤵PID:4944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-