Analysis
-
max time kernel
10s -
max time network
79s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 04:26
Static task
static1
Behavioral task
behavioral1
Sample
SynapseLauncher.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
SynapseLauncher.exe
Resource
win10v2004-20241007-en
General
-
Target
SynapseLauncher.exe
-
Size
5.9MB
-
MD5
fd4ea3585448472b443503ec970ec3f3
-
SHA1
5822fdc8913c5ae1c0ae2777b1050b438270d922
-
SHA256
fc554402002c2509efb469928ffd5bf6bee6ad34f0129f990ca0e1faaff096fa
-
SHA512
cbcf0c51a3750510149f8a3ea01d58b4f686bcfcb9d00208372e46a1c11aa46da78cdfe96e94ede39fc9458beeeae4630125f1d76a8a8d14a73a42bc6193c18f
-
SSDEEP
98304:jCNZyVD6R2yfQDGxgFcBTjKu5UTQycauuvyBbss92nPo3MzIQNSM9Z20J9:aZynyYDYTjh5UTQIuws92nZfQ50J
Malware Config
Extracted
orcus
another-contains.gl.at.ply.gg
a4927b8f548743b9aa2a78ed5eea56e6
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
12/23/2024 01:16:48
-
plugins
AgEAAA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Signatures
-
Orcus family
-
Executes dropped EXE 46 IoCs
pid Process 1480 synpa.exe 2888 synpa.exe 2096 synpa.exe 1376 synpa.exe 2604 synpa.exe 2732 synpa.exe 2024 synpa.exe 3044 synpa.exe 3036 AudioDriver.exe 2836 synpa.exe 2704 synpa.exe 1588 synpa.exe 2460 synpa.exe 1204 synpa.exe 2124 synpa.exe 1900 synpa.exe 2084 synpa.exe 1840 synpa.exe 2712 synpa.exe 860 synpa.exe 1664 synpa.exe 2028 synpa.exe 1716 synpa.exe 2148 synpa.exe 2416 synpa.exe 2876 synpa.exe 2672 synpa.exe 1936 synpa.exe 2924 synpa.exe 2892 synpa.exe 2120 synpa.exe 2528 synpa.exe 2292 synpa.exe 980 synpa.exe 2424 synpa.exe 1476 synpa.exe 1372 synpa.exe 332 synpa.exe 1604 synpa.exe 2176 synpa.exe 2860 synpa.exe 2824 synpa.exe 2092 synpa.exe 2408 synpa.exe 692 synpa.exe 2024 synpa.exe -
Loads dropped DLL 46 IoCs
pid Process 2936 SynapseLauncher.exe 2472 SynapseLauncher.exe 2900 SynapseLauncher.exe 3020 SynapseLauncher.exe 2804 SynapseLauncher.exe 2648 SynapseLauncher.exe 1744 SynapseLauncher.exe 1708 SynapseLauncher.exe 1480 synpa.exe 1532 SynapseLauncher.exe 2848 SynapseLauncher.exe 2528 SynapseLauncher.exe 1932 SynapseLauncher.exe 2292 SynapseLauncher.exe 2228 SynapseLauncher.exe 2276 SynapseLauncher.exe 1592 SynapseLauncher.exe 1556 SynapseLauncher.exe 900 SynapseLauncher.exe 2724 SynapseLauncher.exe 1836 SynapseLauncher.exe 2364 SynapseLauncher.exe 1060 SynapseLauncher.exe 884 SynapseLauncher.exe 1120 SynapseLauncher.exe 1608 SynapseLauncher.exe 2236 SynapseLauncher.exe 3000 SynapseLauncher.exe 1692 SynapseLauncher.exe 1708 SynapseLauncher.exe 2372 SynapseLauncher.exe 3060 SynapseLauncher.exe 3044 SynapseLauncher.exe 2464 SynapseLauncher.exe 2404 SynapseLauncher.exe 2160 SynapseLauncher.exe 2324 SynapseLauncher.exe 524 SynapseLauncher.exe 1552 SynapseLauncher.exe 2032 SynapseLauncher.exe 1608 SynapseLauncher.exe 2904 SynapseLauncher.exe 2764 SynapseLauncher.exe 1624 SynapseLauncher.exe 2128 SynapseLauncher.exe 2848 SynapseLauncher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AudioDriver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language synpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SynapseLauncher.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3036 AudioDriver.exe 3036 AudioDriver.exe 3036 AudioDriver.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3036 AudioDriver.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2472 2936 SynapseLauncher.exe 30 PID 2936 wrote to memory of 2472 2936 SynapseLauncher.exe 30 PID 2936 wrote to memory of 2472 2936 SynapseLauncher.exe 30 PID 2936 wrote to memory of 2472 2936 SynapseLauncher.exe 30 PID 2936 wrote to memory of 2472 2936 SynapseLauncher.exe 30 PID 2936 wrote to memory of 2472 2936 SynapseLauncher.exe 30 PID 2936 wrote to memory of 2472 2936 SynapseLauncher.exe 30 PID 2936 wrote to memory of 1480 2936 SynapseLauncher.exe 31 PID 2936 wrote to memory of 1480 2936 SynapseLauncher.exe 31 PID 2936 wrote to memory of 1480 2936 SynapseLauncher.exe 31 PID 2936 wrote to memory of 1480 2936 SynapseLauncher.exe 31 PID 2936 wrote to memory of 1480 2936 SynapseLauncher.exe 31 PID 2936 wrote to memory of 1480 2936 SynapseLauncher.exe 31 PID 2936 wrote to memory of 1480 2936 SynapseLauncher.exe 31 PID 2472 wrote to memory of 2900 2472 SynapseLauncher.exe 32 PID 2472 wrote to memory of 2900 2472 SynapseLauncher.exe 32 PID 2472 wrote to memory of 2900 2472 SynapseLauncher.exe 32 PID 2472 wrote to memory of 2900 2472 SynapseLauncher.exe 32 PID 2472 wrote to memory of 2900 2472 SynapseLauncher.exe 32 PID 2472 wrote to memory of 2900 2472 SynapseLauncher.exe 32 PID 2472 wrote to memory of 2900 2472 SynapseLauncher.exe 32 PID 2472 wrote to memory of 2888 2472 SynapseLauncher.exe 33 PID 2472 wrote to memory of 2888 2472 SynapseLauncher.exe 33 PID 2472 wrote to memory of 2888 2472 SynapseLauncher.exe 33 PID 2472 wrote to memory of 2888 2472 SynapseLauncher.exe 33 PID 2472 wrote to memory of 2888 2472 SynapseLauncher.exe 33 PID 2472 wrote to memory of 2888 2472 SynapseLauncher.exe 33 PID 2472 wrote to memory of 2888 2472 SynapseLauncher.exe 33 PID 2900 wrote to memory of 3020 2900 SynapseLauncher.exe 34 PID 2900 wrote to memory of 3020 2900 SynapseLauncher.exe 34 PID 2900 wrote to memory of 3020 2900 SynapseLauncher.exe 34 PID 2900 wrote to memory of 3020 2900 SynapseLauncher.exe 34 PID 2900 wrote to memory of 3020 2900 SynapseLauncher.exe 34 PID 2900 wrote to memory of 3020 2900 SynapseLauncher.exe 34 PID 2900 wrote to memory of 3020 2900 SynapseLauncher.exe 34 PID 2900 wrote to memory of 2096 2900 SynapseLauncher.exe 35 PID 2900 wrote to memory of 2096 2900 SynapseLauncher.exe 35 PID 2900 wrote to memory of 2096 2900 SynapseLauncher.exe 35 PID 2900 wrote to memory of 2096 2900 SynapseLauncher.exe 35 PID 2900 wrote to memory of 2096 2900 SynapseLauncher.exe 35 PID 2900 wrote to memory of 2096 2900 SynapseLauncher.exe 35 PID 2900 wrote to memory of 2096 2900 SynapseLauncher.exe 35 PID 3020 wrote to memory of 2804 3020 SynapseLauncher.exe 36 PID 3020 wrote to memory of 2804 3020 SynapseLauncher.exe 36 PID 3020 wrote to memory of 2804 3020 SynapseLauncher.exe 36 PID 3020 wrote to memory of 2804 3020 SynapseLauncher.exe 36 PID 3020 wrote to memory of 2804 3020 SynapseLauncher.exe 36 PID 3020 wrote to memory of 2804 3020 SynapseLauncher.exe 36 PID 3020 wrote to memory of 2804 3020 SynapseLauncher.exe 36 PID 3020 wrote to memory of 1376 3020 SynapseLauncher.exe 37 PID 3020 wrote to memory of 1376 3020 SynapseLauncher.exe 37 PID 3020 wrote to memory of 1376 3020 SynapseLauncher.exe 37 PID 3020 wrote to memory of 1376 3020 SynapseLauncher.exe 37 PID 3020 wrote to memory of 1376 3020 SynapseLauncher.exe 37 PID 3020 wrote to memory of 1376 3020 SynapseLauncher.exe 37 PID 3020 wrote to memory of 1376 3020 SynapseLauncher.exe 37 PID 2804 wrote to memory of 2648 2804 SynapseLauncher.exe 38 PID 2804 wrote to memory of 2648 2804 SynapseLauncher.exe 38 PID 2804 wrote to memory of 2648 2804 SynapseLauncher.exe 38 PID 2804 wrote to memory of 2648 2804 SynapseLauncher.exe 38 PID 2804 wrote to memory of 2648 2804 SynapseLauncher.exe 38 PID 2804 wrote to memory of 2648 2804 SynapseLauncher.exe 38 PID 2804 wrote to memory of 2648 2804 SynapseLauncher.exe 38 PID 2804 wrote to memory of 2604 2804 SynapseLauncher.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"7⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"8⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"9⤵
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"10⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"11⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"12⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"14⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"15⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"16⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"17⤵
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"18⤵
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"19⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"20⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"21⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"22⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"23⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:884 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"24⤵
- Loads dropped DLL
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"25⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"26⤵
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"27⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"28⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"29⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"30⤵
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"31⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"32⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"33⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"34⤵
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"35⤵
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"36⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"37⤵
- Loads dropped DLL
PID:524 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"38⤵
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"39⤵
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"40⤵
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"41⤵
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"42⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"43⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"44⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"45⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"46⤵
- System Location Discovery: System Language Discovery
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"47⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"48⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"49⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"50⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"51⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"52⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"53⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"54⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"55⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"56⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"57⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"58⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"59⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"60⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"61⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"62⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"63⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"64⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"65⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"66⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"67⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"68⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"69⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"70⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"71⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"72⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"73⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"74⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"75⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"76⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"77⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"78⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"79⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"80⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"81⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"82⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"83⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"84⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"85⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"86⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"87⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"88⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"89⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"90⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"91⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"92⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"93⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"94⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"95⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"96⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"97⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"98⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"99⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"100⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"101⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"102⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"103⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"104⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"105⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"106⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"107⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"108⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"109⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"110⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"111⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"112⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"113⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"114⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"115⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"116⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"117⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"118⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"119⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"120⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"121⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"122⤵PID:1476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-