7f6832918fed51455a82ad5b5c92e1554bb37277eb4797e46123550a4315e980

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 20:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
virus.exe
Size 22KB
Sample260828-yx89wsshje
SHA256 7f6832918fed51455a82ad5b5c92e1554bb37277eb4797e46123550a4315e980
MD5 8b0f16eefc43ad1addc094b034b1f0c9
SHA1 e43fa32fadf11ac1c341b56a826653a39f05d4cd
SHA512 b74189144ac5306ef7e55a97ed5dc2079edd6e25e9b13fa74ecd7a93b8405f6db062aa45bc2904588fe4ae037fbbe7ca4afc1649d1ebe895077abc10822fec1f
SSDEEP 384:ybCEXMMADQIrUeNFwx9E5xtT6fkCMst8AdxIiv4dK8y8KG8szTO4Am7UnwtzwGln:W1NAUsbxtT6sFst/3IrdlLUwZqnbcuyG
TLSH
T150A2D052D5EA4D36C35E013B595FFA2A4890231BEBA48F5175EC301F0C25BD8AC3A43A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4748-0-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/4748-5-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/4748-7-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5844	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	virus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fsutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 5844	4748	virus.exe	90
PID 5844 wrote to memory of 4312	5844	cmd.exe	91
PID 5844 wrote to memory of 3688	5844	cmd.exe	92
PID 5844 wrote to memory of 1792	5844	cmd.exe	93
PID 5844 wrote to memory of 4160	5844	cmd.exe	94
PID 5844 wrote to memory of 3392	5844	cmd.exe	95
PID 5844 wrote to memory of 4376	5844	cmd.exe	96
PID 5844 wrote to memory of 4552	5844	cmd.exe	97
PID 5844 wrote to memory of 1104	5844	cmd.exe	98
PID 5844 wrote to memory of 604	5844	cmd.exe	99
PID 5844 wrote to memory of 2340	5844	cmd.exe	100
PID 5844 wrote to memory of 4100	5844	cmd.exe	101
PID 5844 wrote to memory of 2500	5844	cmd.exe	102
PID 5844 wrote to memory of 3272	5844	cmd.exe	103
PID 5844 wrote to memory of 4288	5844	cmd.exe	104
PID 5844 wrote to memory of 2028	5844	cmd.exe	105
PID 5844 wrote to memory of 2036	5844	cmd.exe	106
PID 5844 wrote to memory of 2208	5844	cmd.exe	107
PID 5844 wrote to memory of 2664	5844	cmd.exe	108
PID 5844 wrote to memory of 2108	5844	cmd.exe	109
PID 5844 wrote to memory of 5756	5844	cmd.exe	110
PID 5844 wrote to memory of 3476	5844	cmd.exe	111
PID 5844 wrote to memory of 4224	5844	cmd.exe	112
PID 5844 wrote to memory of 3176	5844	cmd.exe	113
PID 5844 wrote to memory of 4164	5844	cmd.exe	114
PID 5844 wrote to memory of 3460	5844	cmd.exe	115
PID 5844 wrote to memory of 2800	5844	cmd.exe	116
PID 5844 wrote to memory of 3296	5844	cmd.exe	117
PID 5844 wrote to memory of 3792	5844	cmd.exe	118
PID 5844 wrote to memory of 2540	5844	cmd.exe	119
PID 5844 wrote to memory of 2752	5844	cmd.exe	120
PID 5844 wrote to memory of 1732	5844	cmd.exe	121
PID 5844 wrote to memory of 264	5844	cmd.exe	122
PID 5844 wrote to memory of 244	5844	cmd.exe	123
PID 5844 wrote to memory of 5932	5844	cmd.exe	124
PID 5844 wrote to memory of 3856	5844	cmd.exe	125
PID 5844 wrote to memory of 4116	5844	cmd.exe	126
PID 5844 wrote to memory of 624	5844	cmd.exe	127
PID 5844 wrote to memory of 3340	5844	cmd.exe	128
PID 5844 wrote to memory of 5016	5844	cmd.exe	129
PID 5844 wrote to memory of 3588	5844	cmd.exe	130
PID 5844 wrote to memory of 5164	5844	cmd.exe	131
PID 5844 wrote to memory of 4752	5844	cmd.exe	132
PID 5844 wrote to memory of 6108	5844	cmd.exe	133
PID 5844 wrote to memory of 4964	5844	cmd.exe	134
PID 5844 wrote to memory of 2964	5844	cmd.exe	135
PID 5844 wrote to memory of 4504	5844	cmd.exe	136
PID 5844 wrote to memory of 5252	5844	cmd.exe	137
PID 5844 wrote to memory of 3440	5844	cmd.exe	138
PID 5844 wrote to memory of 1352	5844	cmd.exe	139
PID 5844 wrote to memory of 5660	5844	cmd.exe	140
PID 5844 wrote to memory of 5880	5844	cmd.exe	141
PID 5844 wrote to memory of 5400	5844	cmd.exe	142
PID 5844 wrote to memory of 4812	5844	cmd.exe	143
PID 5844 wrote to memory of 5488	5844	cmd.exe	144
PID 5844 wrote to memory of 5704	5844	cmd.exe	145
PID 5844 wrote to memory of 3108	5844	cmd.exe	146
PID 5844 wrote to memory of 1168	5844	cmd.exe	147
PID 5844 wrote to memory of 1476	5844	cmd.exe	148
PID 5844 wrote to memory of 3068	5844	cmd.exe	149
PID 5844 wrote to memory of 3064	5844	cmd.exe	150
PID 5844 wrote to memory of 3548	5844	cmd.exe	284
PID 5844 wrote to memory of 3452	5844	cmd.exe	285
PID 5844 wrote to memory of 4916	5844	cmd.exe	286

C:\Users\Admin\AppData\Local\Temp\virus.exe
"C:\Users\Admin\AppData\Local\Temp\virus.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F2D7.tmp\virus.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:4312
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3688
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1792
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4160
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4376
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4552
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:1104
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:604
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4100
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3272
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4288
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2028
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:2036
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2208
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2664
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2108
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5756
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3476
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4224
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3176
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4164
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3460
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3792
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:2540
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2752
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:264
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:244
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5932
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3856
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4116
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:624
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5016
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3588
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5164
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:6108
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4964
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4504
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:5252
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1352
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5660
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5880
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5400
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4812
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5488
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5704
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:3108
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1168
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1476
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3068
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3064
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3548
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3452
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4916
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5424
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1736
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:2820
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5576
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1252
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5536
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3776
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4992
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:4360
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5248
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:4784
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1904
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:2368
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2840
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2944
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4152
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2088
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5208
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1788
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1208
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:3612
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5356
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2244
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5824
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3360
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5624
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4800
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:1984
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3424
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4512
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1244
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:1932
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1004
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2460
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4372
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5952
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:3772
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4300
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2312
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3348
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1060
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:3924
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:3720
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3656
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4632
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2948
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2656
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3376
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4144
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5984
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:5144
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5524
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:6068
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4892
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5492
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5128
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:4204
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5352
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5204
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5788
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4356
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2952
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5836
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1968
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2568
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5948
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2648
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4600
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5288
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5652
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3380
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4620
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4292
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2604
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:4840
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:912
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4444
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4140
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2876
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1712
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4532
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:5792
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5004
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5828
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1928
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:108
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:364
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:2548
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5080
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1236
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5816
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2112
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1504
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:3976
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5380
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4580
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2660
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1204
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:440
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3988
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5736
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2468
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1140
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4684
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5068
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:6120
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:5980
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:3192
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4576
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3108
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1168
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1476
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3068
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5568
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3548
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3452
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4916
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5424
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:5576
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1252
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1572
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4688
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3580
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4656
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2936
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4208
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3860
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3864
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3232
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1832
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1728
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:6140
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2872
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4284
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5544
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1100
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4508
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:2812
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5516
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:4896
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3908
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2620
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:1840
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3804
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4672
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1828
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:2652
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:2080
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3912
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5276
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:2748
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:4736
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1776
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4652
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:4172
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2044
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3412
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4572
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4548
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1720
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3248
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3236
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4436
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:2916
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:4540
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3980
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:3756
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4500
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:6132
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2384
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:4380
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3556
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:4712
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:2868
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3888
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5196
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4696
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4252
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2372
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4312
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3688
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1792
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4160
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:6012
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4552
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1104
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2844
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5748
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4100
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5668
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4564
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4288
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:2332
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5968
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2208
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2664
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5312
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5756
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:616
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4700
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5596
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2992
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3460
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5780
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1756
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1964
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:2540
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5476
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:408
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:264
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:256
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3200
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5456
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5440
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:624
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3984
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5556
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:6036
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5164
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4580
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2660
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1204
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:440
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3988
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:5736
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2468
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1140
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1672
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5400
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5068
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:6120
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:5980
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3192
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4576
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:3108
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1168
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1476
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3068
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5568
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3548
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:3452
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4916
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1480
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3336
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2476
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:6124
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:5680
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4992
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:700
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4784
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1904
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2368
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:2984
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:2944
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5324
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4152
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:5208
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1788
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:3060
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5356
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:5376
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:940
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:3360
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:856
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1884
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1396
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4308
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1288
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2652
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2080
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3912
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5276
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:3172
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4384
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1744
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:3772
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:1524
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4280
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3568
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4536
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:5640
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4368
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4216
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4468
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:5044
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4188
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4124
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:3816
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    PID:4828
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file createnew u5r5h.temp 1┬á073┬á741┬á824
    3⤵
    - Enumerates system info in registry
    PID:4804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

virus.bat

Path C:\Users\Admin\AppData\Local\Temp\F2D7.tmp\virus.bat
Size 169B
SHA256 7dff4da5443c91c3501f1ca5c0602682504bcfb939ed8c085e3a851c70fd5bcd
MD5 e975a330caef3d72693a06c7f6ba3397
SHA1 ff1be593d8082538e1dfbefa55f42dd46761a075
SHA512 967a371d4cdce5adb9af2212e3760cf76d187228320a8d4c18b1d8f942eb9b5f372cde12f2413d28b9c5438911dd7ec2593ce25fa773e5131113becd27173b13
TLSH
T1EEC08003DD140BED1044F679134775B4F0C09161643DE0403012C155F6CD04AD30EF7B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4748-0-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4748-5-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4748-7-0x0000000000400000-0x0000000000410000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads