Overview
overview
10Static
static
10Key Generator.exe
windows10-2004-x64
7Key Generator.exe
windows11-21h2-x64
7BitcoinGenerator.exe
windows10-2004-x64
10BitcoinGenerator.exe
windows11-21h2-x64
10LoL Hack &...ks.exe
windows10-2004-x64
10LoL Hack &...ks.exe
windows11-21h2-x64
10Welrast_64.exe
windows10-2004-x64
7Welrast_64.exe
windows11-21h2-x64
7Analysis
- max time kernel
310s - max time network
907s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system - submitted
07/10/2025, 19:41
Behavioral task
behavioral1
Sample
Key Generator.exe
Resource
win10v2004-20250610-en
Behavioral task
behavioral2
Sample
Key Generator.exe
Resource
win11-20250619-en
Behavioral task
behavioral3
Sample
BitcoinGenerator.exe
Resource
win10v2004-20250610-en
Behavioral task
behavioral4
Sample
BitcoinGenerator.exe
Resource
win11-20250619-en
Behavioral task
behavioral5
Sample
LoL Hack & Cheat Map Hacks/LoL Hack & Cheat Map Hacks.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral6
Sample
LoL Hack & Cheat Map Hacks/LoL Hack & Cheat Map Hacks.exe
Resource
win11-20250619-en
Behavioral task
behavioral7
Sample
Welrast_64.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
Welrast_64.exe
Resource
win11-20250610-en
General
- Target Key Generator.exe
- Size 31.1MB
- Sample251007-yd535askz3
- SHA256 52ef16c62ea7ef46c2187a08cf618d989a514bdab8e452777fc76f57d45ba033
- MD5 7331003634b9ba117fdc644911c1983f
- SHA1 23a86779b0c77991f21ad93595209e2c502296af
- SHA512 cd6ebe9f2763662adb896b38d089f7d9c936acbf22c291ed83c7691b1bfbb07dd4e0387dbe84e1f302c74b23bb94e7e00843bf86040bb4ab3e2e69133472961b
- SSDEEP 49152:fkZQiO0OSf4t9KVsC2kd+z/kHcPO6FVSOzdtoe3bxqsfrFuWrFuYTX8uTMdCn69e:fkZQb
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe svchost.exe - Executes dropped EXE 64 IoCs
pid Process 3348 Server.exe 396 Server.exe 4464 Server.exe 4316 Server.exe 5092 svchost.exe 5396 Server.exe 2824 Server.exe 1036 Server.exe 1968 Server.exe 2416 svchost.exe 904 Server.exe 4692 Server.exe 928 Server.exe 2552 Server.exe 3144 Server.exe 1976 Server.exe 3148 Server.exe 5804 Server.exe 1424 Server.exe 228 Server.exe 4660 Server.exe 1724 Server.exe 1620 Server.exe 5728 Server.exe 6140 Server.exe 4116 Server.exe 4716 Server.exe 2056 Server.exe 5248 Server.exe 2484 Server.exe 4756 Server.exe 5080 Server.exe 3460 Server.exe 5980 Server.exe 4936 Server.exe 1240 Server.exe 2840 Server.exe 2412 Server.exe 3364 Server.exe 1892 Server.exe 4616 Server.exe 1028 Server.exe 1652 Server.exe 2312 Server.exe 2848 Server.exe 408 Server.exe 3632 Server.exe 2936 Server.exe 5140 Server.exe 980 Server.exe 3848 Server.exe 2332 Server.exe 4788 Server.exe 2768 Server.exe 2328 Server.exe 5728 Server.exe 5440 Server.exe 2572 Server.exe 4704 Server.exe 4292 Server.exe 3660 Server.exe 4860 Server.exe 5720 Server.exe 2420 Server.exe - Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe" Key Generator.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key Generator.exe - Suspicious behavior: GetForegroundWindowSpam 4 IoCs
pid Process 3348 Server.exe 4464 Server.exe 4316 Server.exe 5092 svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe Token: SeIncBasePriorityPrivilege 5092 svchost.exe Token: 33 5092 svchost.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4684 Key Generator.exe 3656 Key Generator.exe 3960 Key Generator.exe 4880 Key Generator.exe 3436 Key Generator.exe 1752 Key Generator.exe 4984 Key Generator.exe 2976 Key Generator.exe 5220 Key Generator.exe 4680 Key Generator.exe 3844 Key Generator.exe 5908 Key Generator.exe 1060 Key Generator.exe 4760 Key Generator.exe 2760 Key Generator.exe 656 Key Generator.exe 792 Key Generator.exe 3020 Key Generator.exe 1980 Key Generator.exe 2020 Key Generator.exe 5324 Key Generator.exe 5616 Key Generator.exe 6052 Key Generator.exe 3140 Key Generator.exe 232 Key Generator.exe 1508 Key Generator.exe 3392 Key Generator.exe 5528 Key Generator.exe 732 Key Generator.exe 3068 Key Generator.exe 5072 Key Generator.exe 3852 Key Generator.exe 5832 Key Generator.exe 4932 Key Generator.exe 4480 Key Generator.exe 568 Key Generator.exe 4640 Key Generator.exe 3972 Key Generator.exe 5956 Key Generator.exe 5240 Key Generator.exe 5964 Key Generator.exe 1060 Key Generator.exe 704 Key Generator.exe 3524 Key Generator.exe 4612 Key Generator.exe 5320 Key Generator.exe 4852 Key Generator.exe 2168 Key Generator.exe 4920 Key Generator.exe 5064 Key Generator.exe 5588 Key Generator.exe 2804 Key Generator.exe 3992 Key Generator.exe 3168 Key Generator.exe 908 Key Generator.exe 2108 Key Generator.exe 3392 Key Generator.exe 4716 Key Generator.exe 5300 Key Generator.exe 2628 Key Generator.exe 5112 Key Generator.exe 4756 Key Generator.exe 5040 Key Generator.exe 2400 Key Generator.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4684 wrote to memory of 3348 4684 Key Generator.exe 78 PID 4684 wrote to memory of 3348 4684 Key Generator.exe 78 PID 4684 wrote to memory of 3348 4684 Key Generator.exe 78 PID 4684 wrote to memory of 3656 4684 Key Generator.exe 80 PID 4684 wrote to memory of 3656 4684 Key Generator.exe 80 PID 4684 wrote to memory of 3656 4684 Key Generator.exe 80 PID 3656 wrote to memory of 396 3656 Key Generator.exe 82 PID 3656 wrote to memory of 396 3656 Key Generator.exe 82 PID 3656 wrote to memory of 396 3656 Key Generator.exe 82 PID 3656 wrote to memory of 3960 3656 Key Generator.exe 83 PID 3656 wrote to memory of 3960 3656 Key Generator.exe 83 PID 3656 wrote to memory of 3960 3656 Key Generator.exe 83 PID 3960 wrote to memory of 4464 3960 Key Generator.exe 84 PID 3960 wrote to memory of 4464 3960 Key Generator.exe 84 PID 3960 wrote to memory of 4464 3960 Key Generator.exe 84 PID 3960 wrote to memory of 4880 3960 Key Generator.exe 85 PID 3960 wrote to memory of 4880 3960 Key Generator.exe 85 PID 3960 wrote to memory of 4880 3960 Key Generator.exe 85 PID 4880 wrote to memory of 4316 4880 Key Generator.exe 86 PID 4880 wrote to memory of 4316 4880 Key Generator.exe 86 PID 4880 wrote to memory of 4316 4880 Key Generator.exe 86 PID 4880 wrote to memory of 3436 4880 Key Generator.exe 87 PID 4880 wrote to memory of 3436 4880 Key Generator.exe 87 PID 4880 wrote to memory of 3436 4880 Key Generator.exe 87 PID 3348 wrote to memory of 5092 3348 Server.exe 88 PID 3348 wrote to memory of 5092 3348 Server.exe 88 PID 3348 wrote to memory of 5092 3348 Server.exe 88 PID 3436 wrote to memory of 5396 3436 Key Generator.exe 89 PID 3436 wrote to memory of 5396 3436 Key Generator.exe 89 PID 3436 wrote to memory of 5396 3436 Key Generator.exe 89 PID 3436 wrote to memory of 1752 3436 Key Generator.exe 90 PID 3436 wrote to memory of 1752 3436 Key Generator.exe 90 PID 3436 wrote to memory of 1752 3436 Key Generator.exe 90 PID 1752 wrote to memory of 2824 1752 Key Generator.exe 91 PID 1752 wrote to memory of 2824 1752 Key Generator.exe 91 PID 1752 wrote to memory of 2824 1752 Key Generator.exe 91 PID 1752 wrote to memory of 4984 1752 Key Generator.exe 92 PID 1752 wrote to memory of 4984 1752 Key Generator.exe 92 PID 1752 wrote to memory of 4984 1752 Key Generator.exe 92 PID 4984 wrote to memory of 1036 4984 Key Generator.exe 93 PID 4984 wrote to memory of 1036 4984 Key Generator.exe 93 PID 4984 wrote to memory of 1036 4984 Key Generator.exe 93 PID 4984 wrote to memory of 2976 4984 Key Generator.exe 94 PID 4984 wrote to memory of 2976 4984 Key Generator.exe 94 PID 4984 wrote to memory of 2976 4984 Key Generator.exe 94 PID 2976 wrote to memory of 1968 2976 Key Generator.exe 95 PID 2976 wrote to memory of 1968 2976 Key Generator.exe 95 PID 2976 wrote to memory of 1968 2976 Key Generator.exe 95 PID 2976 wrote to memory of 5220 2976 Key Generator.exe 96 PID 2976 wrote to memory of 5220 2976 Key Generator.exe 96 PID 2976 wrote to memory of 5220 2976 Key Generator.exe 96 PID 4448 wrote to memory of 2416 4448 cmd.exe 99 PID 4448 wrote to memory of 2416 4448 cmd.exe 99 PID 4448 wrote to memory of 2416 4448 cmd.exe 99 PID 5220 wrote to memory of 904 5220 Key Generator.exe 100 PID 5220 wrote to memory of 904 5220 Key Generator.exe 100 PID 5220 wrote to memory of 904 5220 Key Generator.exe 100 PID 5220 wrote to memory of 4680 5220 Key Generator.exe 101 PID 5220 wrote to memory of 4680 5220 Key Generator.exe 101 PID 5220 wrote to memory of 4680 5220 Key Generator.exe 101 PID 4680 wrote to memory of 4692 4680 Key Generator.exe 102 PID 4680 wrote to memory of 4692 4680 Key Generator.exe 102 PID 4680 wrote to memory of 4692 4680 Key Generator.exe 102 PID 4680 wrote to memory of 3844 4680 Key Generator.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5092
-
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"3⤵
- Executes dropped EXE
PID:396
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"3⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:4464
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"4⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:4316
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"6⤵
- Executes dropped EXE
PID:5396
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"6⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"7⤵
- Executes dropped EXE
PID:2824
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"7⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"8⤵
- Executes dropped EXE
PID:1036
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1968
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"9⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"10⤵
- Executes dropped EXE
PID:904
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"10⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"11⤵
- Executes dropped EXE
PID:4692
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"11⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"12⤵
- Executes dropped EXE
PID:928
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5908 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"13⤵
- Executes dropped EXE
PID:2552
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"13⤵
- Suspicious use of SetWindowsHookEx
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"14⤵
- Executes dropped EXE
PID:3144
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"15⤵
- Executes dropped EXE
PID:1976
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"15⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"16⤵
- Executes dropped EXE
PID:3148
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"16⤵
- Suspicious use of SetWindowsHookEx
PID:656 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"17⤵
- Executes dropped EXE
PID:5804
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"17⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:792 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"18⤵
- Executes dropped EXE
PID:1424
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"18⤵
- Suspicious use of SetWindowsHookEx
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"19⤵
- Executes dropped EXE
PID:228
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"19⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"20⤵
- Executes dropped EXE
PID:4660
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"20⤵
- Suspicious use of SetWindowsHookEx
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"21⤵
- Executes dropped EXE
PID:1724
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"21⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"22⤵
- Executes dropped EXE
PID:1620
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"22⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"23⤵
- Executes dropped EXE
PID:5728
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"23⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6052 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"24⤵
- Executes dropped EXE
PID:6140
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"24⤵
- Suspicious use of SetWindowsHookEx
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"25⤵
- Executes dropped EXE
PID:4116
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"25⤵
- Suspicious use of SetWindowsHookEx
PID:232 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4716
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"26⤵
- Suspicious use of SetWindowsHookEx
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2056
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"27⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"28⤵
- Executes dropped EXE
PID:5248
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"28⤵
- Suspicious use of SetWindowsHookEx
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2484
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"29⤵
- Suspicious use of SetWindowsHookEx
PID:732 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"30⤵
- Executes dropped EXE
PID:4756
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"30⤵
- Suspicious use of SetWindowsHookEx
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5080
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"31⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"32⤵
- Executes dropped EXE
PID:3460
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"32⤵
- Suspicious use of SetWindowsHookEx
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5980
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"33⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"34⤵
- Executes dropped EXE
PID:4936
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"34⤵
- Suspicious use of SetWindowsHookEx
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"35⤵
- Executes dropped EXE
PID:1240
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"35⤵
- Suspicious use of SetWindowsHookEx
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"36⤵
- Executes dropped EXE
PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"36⤵
- Suspicious use of SetWindowsHookEx
PID:568 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"37⤵
- Executes dropped EXE
PID:2412
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"37⤵
- Suspicious use of SetWindowsHookEx
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"38⤵
- Executes dropped EXE
PID:3364
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"38⤵
- Suspicious use of SetWindowsHookEx
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"39⤵
- Executes dropped EXE
PID:1892
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"39⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"40⤵
- Executes dropped EXE
PID:4616
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"40⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"41⤵
- Executes dropped EXE
PID:1028
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"41⤵
- Suspicious use of SetWindowsHookEx
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"42⤵
- Executes dropped EXE
PID:1652
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"42⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"43⤵
- Executes dropped EXE
PID:2312
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"43⤵
- Suspicious use of SetWindowsHookEx
PID:704 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"44⤵
- Executes dropped EXE
PID:2848
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"44⤵
- Suspicious use of SetWindowsHookEx
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"45⤵
- Executes dropped EXE
PID:408
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"45⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3632
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"46⤵
- Suspicious use of SetWindowsHookEx
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"47⤵
- Executes dropped EXE
PID:2936
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"47⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5140
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"48⤵
- Suspicious use of SetWindowsHookEx
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:980
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"49⤵
- Suspicious use of SetWindowsHookEx
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"50⤵
- Executes dropped EXE
PID:3848
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"50⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"51⤵
- Executes dropped EXE
PID:2332
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"51⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"52⤵
- Executes dropped EXE
PID:4788
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"52⤵
- Suspicious use of SetWindowsHookEx
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"53⤵
- Executes dropped EXE
PID:2768
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"53⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2328
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"54⤵
- Suspicious use of SetWindowsHookEx
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"55⤵
- Executes dropped EXE
PID:5728
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"55⤵
- Suspicious use of SetWindowsHookEx
PID:908 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"56⤵
- Executes dropped EXE
PID:5440
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"56⤵
- Suspicious use of SetWindowsHookEx
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"57⤵
- Executes dropped EXE
PID:2572
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"57⤵
- Suspicious use of SetWindowsHookEx
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"58⤵
- Executes dropped EXE
PID:4704
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"58⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4292
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"59⤵
- Suspicious use of SetWindowsHookEx
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"60⤵
- Executes dropped EXE
PID:3660
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"60⤵
- Suspicious use of SetWindowsHookEx
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"61⤵
- Executes dropped EXE
PID:4860
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"61⤵
- Suspicious use of SetWindowsHookEx
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5720
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"62⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"63⤵
- Executes dropped EXE
PID:2420
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"63⤵
- Suspicious use of SetWindowsHookEx
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"64⤵
- System Location Discovery: System Language Discovery
PID:5376
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"64⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"65⤵
- System Location Discovery: System Language Discovery
PID:5484
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"65⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"66⤵PID:568
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"66⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"67⤵PID:5192
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"67⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"68⤵PID:3164
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"68⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"69⤵
- System Location Discovery: System Language Discovery
PID:4092
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"69⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"70⤵PID:1968
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"70⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"71⤵PID:3404
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"71⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"72⤵
- System Location Discovery: System Language Discovery
PID:5460
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"72⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"73⤵PID:3880
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"73⤵
- Adds Run key to start application
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"74⤵
- System Location Discovery: System Language Discovery
PID:400
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"74⤵
- Adds Run key to start application
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"75⤵PID:4824
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"75⤵
- Adds Run key to start application
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"76⤵PID:3304
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"76⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"77⤵PID:1976
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"77⤵
- Adds Run key to start application
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"78⤵PID:2936
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"78⤵
- Adds Run key to start application
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"79⤵PID:5652
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"79⤵
- Adds Run key to start application
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"80⤵PID:924
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"80⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"81⤵PID:5532
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"81⤵
- Adds Run key to start application
PID:228 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"82⤵PID:6012
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"82⤵
- System Location Discovery: System Language Discovery
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"83⤵PID:1704
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"83⤵
- System Location Discovery: System Language Discovery
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"84⤵PID:2792
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"84⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"85⤵PID:1228
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"85⤵
- Adds Run key to start application
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"86⤵PID:1812
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"86⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"87⤵PID:2724
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"87⤵
- Adds Run key to start application
PID:732 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"88⤵PID:3960
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"88⤵
- Adds Run key to start application
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"89⤵PID:6048
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"89⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"90⤵
- System Location Discovery: System Language Discovery
PID:5380
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"90⤵
- Adds Run key to start application
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"91⤵PID:396
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"91⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"92⤵PID:1388
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"92⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"93⤵
- System Location Discovery: System Language Discovery
PID:2976
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"93⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"94⤵PID:2968
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"94⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"95⤵PID:5196
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"95⤵
- System Location Discovery: System Language Discovery
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"96⤵
- System Location Discovery: System Language Discovery
PID:4892
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"96⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"97⤵PID:3996
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"97⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"98⤵PID:2172
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"98⤵
- Adds Run key to start application
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"99⤵PID:4632
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"99⤵
- Adds Run key to start application
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"100⤵PID:5280
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"100⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"101⤵PID:1992
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"101⤵
- Adds Run key to start application
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"102⤵PID:1372
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"102⤵
- Adds Run key to start application
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"103⤵PID:3152
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"103⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"104⤵PID:4112
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"104⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"105⤵
- System Location Discovery: System Language Discovery
PID:5264
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"105⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:892 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"106⤵PID:1436
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"106⤵
- Adds Run key to start application
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"107⤵PID:1200
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"107⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"108⤵PID:4916
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"108⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"109⤵PID:5516
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"109⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"110⤵PID:4660
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"110⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"111⤵PID:5452
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"111⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"112⤵PID:2356
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"112⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"113⤵
- System Location Discovery: System Language Discovery
PID:2028
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"113⤵
- Adds Run key to start application
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"114⤵PID:3900
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"114⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"115⤵PID:4788
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"115⤵
- Adds Run key to start application
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"116⤵
- System Location Discovery: System Language Discovery
PID:5024
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"116⤵
- Adds Run key to start application
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"117⤵PID:1300
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"117⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"118⤵PID:2656
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"118⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"119⤵PID:1044
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"119⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"120⤵PID:5832
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"120⤵
- Adds Run key to start application
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"121⤵
- System Location Discovery: System Language Discovery
PID:2624
-
-
C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"121⤵
- Adds Run key to start application
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"122⤵PID:6048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-