Overview
overview
10Static
static
3-°¦n+¦++.exe
windows7-x64
1PC远控测试-.exe
windows7-x64
3vip文件�...��.exe
windows7-x64
10菲律宾�...P4.exe
windows7-x64
6远程控�...2).exe
windows7-x64
3远程控�...2).exe
windows7-x64
3远程控�...�-.exe
windows7-x64
3远程控�...�-.exe
windows7-x64
3钱包收�...2).exe
windows7-x64
3钱包收�...�-.exe
windows7-x64
3Analysis
-
max time kernel
30s -
max time network
25s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 21:25
Behavioral task
behavioral1
Sample
-°¦n+¦++.exe
Resource
win7-20241010-en
windows7-x64
0 signatures
30 seconds
Behavioral task
behavioral2
Sample
PC远控测试-.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
30 seconds
Behavioral task
behavioral3
Sample
vip文件捆绑器.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
30 seconds
Behavioral task
behavioral4
Sample
菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe
Resource
win7-20241010-en
windows7-x64
5 signatures
30 seconds
Behavioral task
behavioral5
Sample
远程控制 测试- (2).exe
Resource
win7-20240903-en
windows7-x64
2 signatures
30 seconds
Behavioral task
behavioral6
Sample
远程控制 测试- (2).exe
Resource
win7-20240903-en
windows7-x64
2 signatures
30 seconds
Behavioral task
behavioral7
Sample
远程控制 测试-.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
30 seconds
Behavioral task
behavioral8
Sample
远程控制 测试-.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
30 seconds
Behavioral task
behavioral9
Sample
钱包收款地址强制更改器- (2).exe
Resource
win7-20241010-en
windows7-x64
2 signatures
30 seconds
Behavioral task
behavioral10
Sample
钱包收款地址强制更改器-.exe
Resource
win7-20240729-en
windows7-x64
3 signatures
30 seconds
General
-
Target
菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe
-
Size
340KB
-
MD5
f2b6aae38b2a7d7eccd29f0293420d72
-
SHA1
da9209e98438a66c6453010f65e2b5c427382963
-
SHA256
db0c34fd60009271f420ab7adaf04d4476d7939892b217930fffcb9757be60e2
-
SHA512
d3c49e2d6fb731c747144e1bb301f390aeb34b1e399c841bc76287519d6ad13cb34e4a3ae24986b0f43e94c31d40e357d51d360a436b7651a4d539c8fad99951
-
SSDEEP
6144:uAtrKrjDnYCADp9VekbJ2tPJKA1jImwa6mcF:DmYpDFbJ2s0jIxmc
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\getip = "C:\\Users\\Admin\\AppData\\Local\\Temp\\??????????????????.MP4.exe" 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cdefgh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\??????????????????.MP4.exe" 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe -
System Location Discovery: System Language Discovery 1 TTPs 31 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe Token: SeDebugPrivilege 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2900 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 31 PID 2196 wrote to memory of 2900 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 31 PID 2196 wrote to memory of 2900 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 31 PID 2196 wrote to memory of 2900 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 31 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2940 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 32 PID 2196 wrote to memory of 2940 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 32 PID 2196 wrote to memory of 2940 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 32 PID 2196 wrote to memory of 2940 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 32 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2708 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 33 PID 2196 wrote to memory of 2708 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 33 PID 2196 wrote to memory of 2708 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 33 PID 2196 wrote to memory of 2708 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 33 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2976 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 34 PID 2196 wrote to memory of 2976 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 34 PID 2196 wrote to memory of 2976 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 34 PID 2196 wrote to memory of 2976 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 34 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2912 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 35 PID 2196 wrote to memory of 2912 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 35 PID 2196 wrote to memory of 2912 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 35 PID 2196 wrote to memory of 2912 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 35 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2740 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 36 PID 2196 wrote to memory of 2740 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 36 PID 2196 wrote to memory of 2740 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 36 PID 2196 wrote to memory of 2740 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 36 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2500 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 37 PID 2196 wrote to memory of 2500 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 37 PID 2196 wrote to memory of 2500 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 37 PID 2196 wrote to memory of 2500 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 37 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2848 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 38 PID 2196 wrote to memory of 2848 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 38 PID 2196 wrote to memory of 2848 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 38 PID 2196 wrote to memory of 2848 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 38 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 828 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 39 PID 2196 wrote to memory of 828 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 39 PID 2196 wrote to memory of 828 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 39 PID 2196 wrote to memory of 828 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 39 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2780 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 30 PID 2196 wrote to memory of 2228 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 40 PID 2196 wrote to memory of 2228 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 40 PID 2196 wrote to memory of 2228 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 40 PID 2196 wrote to memory of 2228 2196 菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe"C:\Users\Admin\AppData\Local\Temp\菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\notepad.exenotepad.exe2⤵
- System Location Discovery: System Language Discovery
PID:2780
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:2900
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:2940
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:2708
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:2976
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:2912
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:2740
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:2500
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:2848
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:828
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:2228
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:2264
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:2360
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:2044
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:1576
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:3016
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:1928
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:1812
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:1704
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:1488
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:2860
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:1064
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:2468
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:396
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:880
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:2476
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:1632
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:904
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:1352
-
-
C:\Windows\SysWOW64\NOTEPAD.EXENOTEPAD.EXE2⤵
- System Location Discovery: System Language Discovery
PID:2188
-