Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 16:01
Static task
static1
Behavioral task
behavioral1
Sample
1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe
Resource
win7-20240708-en
General
-
Target
1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe
-
Size
2.7MB
-
MD5
d59e9bb6f95ae207a53f23ed26248580
-
SHA1
00fe8a9e553df61b5ed54eb2408bc846bd739513
-
SHA256
1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882
-
SHA512
db02a5393629dde88ff6848a848f0160b13b9dd7b2c5dc580a1d3474cffd0243d263b7a8558a42212791e2d4c3a2ca6a0da911d91742e6a82fb891d47f275296
-
SSDEEP
49152:p282dv9JzLmV91XzYRGfYJPtqpigqCxRJM:of+t0RGetqplVx
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7z.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7z.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7z.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7z.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7z.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7z.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7z.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7z.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7z.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7z.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7z.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7z.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7z.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe File opened for modification C:\Program Files\7-Zip\7z.exe 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe -
Program crash 64 IoCs
pid pid_target Process procid_target 13252 9032 WerFault.exe 442 13548 5604 WerFault.exe 224 12936 5688 WerFault.exe 229 14144 5588 WerFault.exe 223 13088 5588 WerFault.exe 223 14064 5688 WerFault.exe 229 12048 5604 WerFault.exe 224 13280 9032 WerFault.exe 442 432 6536 WerFault.exe 288 1564 6504 WerFault.exe 286 13496 7004 WerFault.exe 317 4980 6668 WerFault.exe 296 14196 13084 WerFault.exe 637 13096 14136 WerFault.exe 633 12724 7004 WerFault.exe 317 4816 1820 WerFault.exe 89 15124 9864 WerFault.exe 487 4856 10136 WerFault.exe 504 13140 9752 WerFault.exe 480 15324 9720 WerFault.exe 478 13084 9752 WerFault.exe 480 12072 10136 WerFault.exe 504 14436 6844 WerFault.exe 307 12268 9864 WerFault.exe 487 12932 7728 WerFault.exe 362 12704 7584 WerFault.exe 353 15072 4276 WerFault.exe 766 10200 12168 WerFault.exe 776 7180 5064 WerFault.exe 85 10512 10276 WerFault.exe 513 14900 11536 Process not Found 592 5012 2700 Process not Found 103 8496 1548 Process not Found 179 10500 5704 Process not Found 230 7884 9112 Process not Found 447 14644 5896 Process not Found 242 4904 6796 Process not Found 304 2932 10324 Process not Found 516 9168 6812 Process not Found 305 9108 1548 Process not Found 179 14320 3496 Process not Found 809 8124 6796 Process not Found 304 14212 13676 Process not Found 815 11796 12748 Process not Found 724 13484 392 Process not Found 728 2648 4124 Process not Found 731 9492 12748 Process not Found 724 7164 4772 Process not Found 737 14900 14056 Process not Found 739 11616 4892 Process not Found 746 3692 8920 Process not Found 435 11524 5556 Process not Found 221 10464 4772 Process not Found 737 10148 5928 Process not Found 244 7260 13724 Process not Found 960 1052 5556 Process not Found 221 10224 12608 Process not Found 962 6804 14064 Process not Found 995 7684 1672 Process not Found 1007 14308 7264 Process not Found 1534 12848 2784 Process not Found 1528 392 14168 Process not Found 1543 11580 12084 Process not Found 722 9188 13884 Process not Found 720 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 736 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 736 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 5064 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 5064 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 4472 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 4472 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 3616 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 3616 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 1300 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 1300 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 1820 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 1820 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 3060 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 3060 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 1516 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 1516 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 3084 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 3084 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 2908 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 2908 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 3608 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 3608 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 3748 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 3748 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 4932 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 4932 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 4856 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 4856 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 4376 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 4376 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 2312 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 2312 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 2300 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 2300 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 1056 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 1056 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 2700 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 2700 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 2916 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 2916 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 1012 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 1012 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 3432 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 3432 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 708 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 708 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 4860 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 4860 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 232 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 232 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 2936 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 2936 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 3464 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 3464 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 3264 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 3264 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 4104 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 4104 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 4996 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 4996 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 216 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 216 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 1268 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 1268 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 736 wrote to memory of 5064 736 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 85 PID 736 wrote to memory of 5064 736 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 85 PID 736 wrote to memory of 5064 736 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 85 PID 5064 wrote to memory of 4472 5064 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 86 PID 5064 wrote to memory of 4472 5064 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 86 PID 5064 wrote to memory of 4472 5064 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 86 PID 4472 wrote to memory of 3616 4472 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 87 PID 4472 wrote to memory of 3616 4472 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 87 PID 4472 wrote to memory of 3616 4472 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 87 PID 3616 wrote to memory of 1300 3616 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 88 PID 3616 wrote to memory of 1300 3616 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 88 PID 3616 wrote to memory of 1300 3616 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 88 PID 1300 wrote to memory of 1820 1300 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 89 PID 1300 wrote to memory of 1820 1300 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 89 PID 1300 wrote to memory of 1820 1300 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 89 PID 1820 wrote to memory of 3060 1820 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 90 PID 1820 wrote to memory of 3060 1820 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 90 PID 1820 wrote to memory of 3060 1820 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 90 PID 3060 wrote to memory of 1516 3060 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 91 PID 3060 wrote to memory of 1516 3060 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 91 PID 3060 wrote to memory of 1516 3060 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 91 PID 1516 wrote to memory of 3084 1516 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 92 PID 1516 wrote to memory of 3084 1516 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 92 PID 1516 wrote to memory of 3084 1516 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 92 PID 3084 wrote to memory of 2908 3084 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 93 PID 3084 wrote to memory of 2908 3084 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 93 PID 3084 wrote to memory of 2908 3084 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 93 PID 2908 wrote to memory of 3608 2908 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 94 PID 2908 wrote to memory of 3608 2908 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 94 PID 2908 wrote to memory of 3608 2908 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 94 PID 3608 wrote to memory of 3748 3608 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 95 PID 3608 wrote to memory of 3748 3608 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 95 PID 3608 wrote to memory of 3748 3608 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 95 PID 3748 wrote to memory of 4932 3748 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 96 PID 3748 wrote to memory of 4932 3748 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 96 PID 3748 wrote to memory of 4932 3748 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 96 PID 4932 wrote to memory of 4856 4932 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 97 PID 4932 wrote to memory of 4856 4932 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 97 PID 4932 wrote to memory of 4856 4932 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 97 PID 4856 wrote to memory of 4376 4856 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 98 PID 4856 wrote to memory of 4376 4856 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 98 PID 4856 wrote to memory of 4376 4856 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 98 PID 4376 wrote to memory of 2312 4376 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 99 PID 4376 wrote to memory of 2312 4376 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 99 PID 4376 wrote to memory of 2312 4376 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 99 PID 2312 wrote to memory of 2300 2312 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 100 PID 2312 wrote to memory of 2300 2312 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 100 PID 2312 wrote to memory of 2300 2312 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 100 PID 2300 wrote to memory of 1056 2300 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 101 PID 2300 wrote to memory of 1056 2300 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 101 PID 2300 wrote to memory of 1056 2300 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 101 PID 1056 wrote to memory of 2700 1056 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 103 PID 1056 wrote to memory of 2700 1056 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 103 PID 1056 wrote to memory of 2700 1056 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 103 PID 2700 wrote to memory of 2916 2700 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 104 PID 2700 wrote to memory of 2916 2700 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 104 PID 2700 wrote to memory of 2916 2700 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 104 PID 2916 wrote to memory of 1012 2916 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 105 PID 2916 wrote to memory of 1012 2916 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 105 PID 2916 wrote to memory of 1012 2916 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 105 PID 1012 wrote to memory of 3432 1012 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 106 PID 1012 wrote to memory of 3432 1012 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 106 PID 1012 wrote to memory of 3432 1012 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 106 PID 3432 wrote to memory of 708 3432 1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"6⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"7⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"9⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"10⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"11⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"12⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"14⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"15⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"16⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"17⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"18⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"19⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"20⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"21⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"22⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"23⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:708 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"24⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"25⤵
- Suspicious behavior: EnumeratesProcesses
PID:232 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"26⤵
- Suspicious behavior: EnumeratesProcesses
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"27⤵
- Suspicious behavior: EnumeratesProcesses
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"28⤵
- Suspicious behavior: EnumeratesProcesses
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"29⤵
- Suspicious behavior: EnumeratesProcesses
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"30⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"31⤵
- Suspicious behavior: EnumeratesProcesses
PID:216 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"33⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"34⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"35⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"36⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"37⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"38⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"39⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"40⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"41⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"42⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"43⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"44⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"45⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"46⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"47⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"48⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"49⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"50⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"51⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"52⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"53⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"54⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"55⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"56⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"57⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"58⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"59⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"60⤵
- System Location Discovery: System Language Discovery
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"61⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"62⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"63⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"64⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"65⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"66⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"67⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"68⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"69⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"70⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"71⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"72⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"73⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"74⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"75⤵
- System Location Discovery: System Language Discovery
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"76⤵
- System Location Discovery: System Language Discovery
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"77⤵
- System Location Discovery: System Language Discovery
PID:404 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"78⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"79⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"80⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"81⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"82⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"83⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"84⤵
- System Location Discovery: System Language Discovery
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"85⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"86⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"87⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"88⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"89⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"90⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"91⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"92⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"93⤵
- System Location Discovery: System Language Discovery
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"94⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"95⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"96⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"97⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"98⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"99⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"100⤵
- System Location Discovery: System Language Discovery
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"101⤵
- System Location Discovery: System Language Discovery
PID:992 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"102⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"103⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"104⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"105⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"106⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"107⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"108⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"109⤵
- System Location Discovery: System Language Discovery
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"110⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"111⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"112⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"113⤵
- System Location Discovery: System Language Discovery
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"114⤵
- System Location Discovery: System Language Discovery
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"115⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"116⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"117⤵PID:5236
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"118⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"119⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"120⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"121⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"122⤵PID:5316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-