Analysis
- max time kernel
19s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 08:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_b276d1659bef6d99190c03b8f7687ac4eb53f7681f852e552253cf89b812c022.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_b276d1659bef6d99190c03b8f7687ac4eb53f7681f852e552253cf89b812c022.exe
Resource
win11ltsc2024-20260911-en
5 signatures
150 seconds
General
- Target jaffacakes118_b276d1659bef6d99190c03b8f7687ac4eb53f7681f852e552253cf89b812c022.exe
- Size 81KB
- Sample260924-kfbemshf86
- SHA256 b276d1659bef6d99190c03b8f7687ac4eb53f7681f852e552253cf89b812c022
- MD5 628653296980a2f81d7a5edbdb85987b
- SHA1 2dec504e9ab1d82e303bc4f7960d081608ee1320
- SHA512 db714c768dc4f8f1e9aad152b8e12d4e226792a36fed784fcbebfbc5696702410714b20b671c87ab7576e39bcb1cfc4c4314dc7e443995078da4b27749a637c8
- SSDEEP 1536:0GN+l2atCFGF7Ec+o9fBLA+DIyRgSr2MTPWS9KBwcvuv2yJ5PZwo2eXDp2N8pU/R:Gl23GtEc+o9fBLA+MyRgSr2MTPWYK+Ut
- TLSH T1CC835B02A65854EFE2BB047D355A6737C4F8E1B1373DEA46E790DA803491BA1FB2910F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1668 scvhosts.exe 3444 scvhosts.exe 4792 scvhosts.exe 5800 scvhosts.exe 4248 scvhosts.exe 5428 scvhosts.exe 4844 scvhosts.exe 5564 scvhosts.exe 2380 scvhosts.exe 3712 scvhosts.exe 5108 scvhosts.exe 4596 scvhosts.exe 4728 scvhosts.exe 3372 scvhosts.exe 5996 scvhosts.exe 4228 scvhosts.exe 5208 scvhosts.exe 1968 scvhosts.exe 2928 scvhosts.exe 2864 scvhosts.exe 3380 scvhosts.exe 2728 scvhosts.exe 1216 scvhosts.exe 5808 scvhosts.exe 2788 scvhosts.exe 3984 scvhosts.exe 3428 scvhosts.exe 1416 scvhosts.exe 4772 scvhosts.exe 3176 scvhosts.exe 5384 scvhosts.exe 456 scvhosts.exe 3460 scvhosts.exe 5768 scvhosts.exe 4840 scvhosts.exe 5068 scvhosts.exe 4184 scvhosts.exe 2408 scvhosts.exe 5352 scvhosts.exe 3304 scvhosts.exe 2500 scvhosts.exe 4004 scvhosts.exe 3988 scvhosts.exe 1712 scvhosts.exe 1560 scvhosts.exe 4964 scvhosts.exe 2108 scvhosts.exe 2288 scvhosts.exe 1852 scvhosts.exe 3464 scvhosts.exe 3716 scvhosts.exe 5680 scvhosts.exe 2824 scvhosts.exe 540 scvhosts.exe 1208 scvhosts.exe 2884 scvhosts.exe 3252 scvhosts.exe 5712 scvhosts.exe 976 scvhosts.exe 5496 scvhosts.exe 4080 scvhosts.exe 3520 scvhosts.exe 6092 scvhosts.exe 3688 scvhosts.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe File opened for modification C:\Windows\SysWOW64\rwtrisfg32.dll scvhosts.exe File created C:\Windows\SysWOW64\scvhosts.exe scvhosts.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_b276d1659bef6d99190c03b8f7687ac4eb53f7681f852e552253cf89b812c022.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhosts.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6020 wrote to memory of 1668 6020 jaffacakes118_b276d1659bef6d99190c03b8f7687ac4eb53f7681f852e552253cf89b812c022.exe 88 PID 1668 wrote to memory of 3444 1668 scvhosts.exe 89 PID 3444 wrote to memory of 4792 3444 scvhosts.exe 90 PID 4792 wrote to memory of 5800 4792 scvhosts.exe 91 PID 5800 wrote to memory of 4248 5800 scvhosts.exe 92 PID 4248 wrote to memory of 5428 4248 scvhosts.exe 93 PID 5428 wrote to memory of 4844 5428 scvhosts.exe 94 PID 4844 wrote to memory of 5564 4844 scvhosts.exe 95 PID 5564 wrote to memory of 2380 5564 scvhosts.exe 96 PID 2380 wrote to memory of 3712 2380 scvhosts.exe 97 PID 3712 wrote to memory of 5108 3712 scvhosts.exe 98 PID 5108 wrote to memory of 4596 5108 scvhosts.exe 99 PID 4596 wrote to memory of 4728 4596 scvhosts.exe 100 PID 4728 wrote to memory of 3372 4728 scvhosts.exe 101 PID 3372 wrote to memory of 5996 3372 scvhosts.exe 102 PID 5996 wrote to memory of 4228 5996 scvhosts.exe 103 PID 4228 wrote to memory of 5208 4228 scvhosts.exe 104 PID 5208 wrote to memory of 1968 5208 scvhosts.exe 105 PID 1968 wrote to memory of 2928 1968 scvhosts.exe 106 PID 2928 wrote to memory of 2864 2928 scvhosts.exe 107 PID 2864 wrote to memory of 3380 2864 scvhosts.exe 108 PID 3380 wrote to memory of 2728 3380 scvhosts.exe 109 PID 2728 wrote to memory of 1216 2728 scvhosts.exe 110 PID 1216 wrote to memory of 5808 1216 scvhosts.exe 111 PID 5808 wrote to memory of 2788 5808 scvhosts.exe 112 PID 2788 wrote to memory of 3984 2788 scvhosts.exe 113 PID 3984 wrote to memory of 3428 3984 scvhosts.exe 114 PID 3428 wrote to memory of 1416 3428 scvhosts.exe 115 PID 1416 wrote to memory of 4772 1416 scvhosts.exe 116 PID 4772 wrote to memory of 3176 4772 scvhosts.exe 117 PID 3176 wrote to memory of 5384 3176 scvhosts.exe 118 PID 5384 wrote to memory of 456 5384 scvhosts.exe 119 PID 456 wrote to memory of 3460 456 scvhosts.exe 120 PID 3460 wrote to memory of 5768 3460 scvhosts.exe 121 PID 5768 wrote to memory of 4840 5768 scvhosts.exe 122 PID 4840 wrote to memory of 5068 4840 scvhosts.exe 123 PID 5068 wrote to memory of 4184 5068 scvhosts.exe 124 PID 4184 wrote to memory of 2408 4184 scvhosts.exe 125 PID 2408 wrote to memory of 5352 2408 scvhosts.exe 126 PID 5352 wrote to memory of 3304 5352 scvhosts.exe 127 PID 3304 wrote to memory of 2500 3304 scvhosts.exe 128 PID 2500 wrote to memory of 4004 2500 scvhosts.exe 129 PID 4004 wrote to memory of 3988 4004 scvhosts.exe 130 PID 3988 wrote to memory of 1712 3988 scvhosts.exe 131 PID 1712 wrote to memory of 1560 1712 scvhosts.exe 132 PID 1560 wrote to memory of 4964 1560 scvhosts.exe 133 PID 4964 wrote to memory of 2108 4964 scvhosts.exe 134 PID 2108 wrote to memory of 2288 2108 scvhosts.exe 135 PID 2288 wrote to memory of 1852 2288 scvhosts.exe 136 PID 1852 wrote to memory of 3464 1852 scvhosts.exe 137 PID 3464 wrote to memory of 3716 3464 scvhosts.exe 138 PID 3716 wrote to memory of 5680 3716 scvhosts.exe 139 PID 5680 wrote to memory of 2824 5680 scvhosts.exe 140 PID 2824 wrote to memory of 540 2824 scvhosts.exe 141 PID 540 wrote to memory of 1208 540 scvhosts.exe 142 PID 1208 wrote to memory of 2884 1208 scvhosts.exe 143 PID 2884 wrote to memory of 3252 2884 scvhosts.exe 144 PID 3252 wrote to memory of 5712 3252 scvhosts.exe 145 PID 5712 wrote to memory of 976 5712 scvhosts.exe 146 PID 976 wrote to memory of 5496 976 scvhosts.exe 147 PID 5496 wrote to memory of 4080 5496 scvhosts.exe 148 PID 4080 wrote to memory of 3520 4080 scvhosts.exe 149 PID 3520 wrote to memory of 6092 3520 scvhosts.exe 150 PID 6092 wrote to memory of 3688 6092 scvhosts.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b276d1659bef6d99190c03b8f7687ac4eb53f7681f852e552253cf89b812c022.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b276d1659bef6d99190c03b8f7687ac4eb53f7681f852e552253cf89b812c022.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system322⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system323⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system324⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system325⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system326⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system327⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system328⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system329⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3210⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3211⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3212⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3213⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3214⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3215⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3216⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3217⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3218⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3219⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3220⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3221⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3222⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3223⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3224⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3225⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3226⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3227⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3228⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3229⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3230⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3231⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3232⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3233⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3234⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3235⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3236⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3237⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3238⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3239⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3240⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3241⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3242⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3243⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3244⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3245⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3246⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3247⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3248⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3249⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3250⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3251⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3252⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3253⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3254⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3255⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3256⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3257⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3258⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3259⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3260⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3261⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3262⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3263⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3264⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3265⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3688 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3266⤵
- System Location Discovery: System Language Discovery
PID:3052 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3267⤵PID:4240
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3268⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1404 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3269⤵
- System Location Discovery: System Language Discovery
PID:2776 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3270⤵
- Drops file in System32 directory
PID:4416 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3271⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2116 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3272⤵
- System Location Discovery: System Language Discovery
PID:4388 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3273⤵
- System Location Discovery: System Language Discovery
PID:5816 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3274⤵PID:2148
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3275⤵PID:4888
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3276⤵PID:3020
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3277⤵PID:4624
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3278⤵PID:5828
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3279⤵
- Drops file in System32 directory
PID:5212 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3280⤵PID:4168
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3281⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3148 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3282⤵PID:5764
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3283⤵PID:5964
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3284⤵
- System Location Discovery: System Language Discovery
PID:436 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3285⤵
- System Location Discovery: System Language Discovery
PID:4396 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3286⤵
- Drops file in System32 directory
PID:260 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3287⤵
- Drops file in System32 directory
PID:2896 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3288⤵PID:4548
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3289⤵
- System Location Discovery: System Language Discovery
PID:3992 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3290⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3880 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3291⤵
- Drops file in System32 directory
PID:420 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3292⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4984 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3293⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3316 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3294⤵PID:3700
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3295⤵PID:3980
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3296⤵PID:5112
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3297⤵
- System Location Discovery: System Language Discovery
PID:4588 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3298⤵
- Drops file in System32 directory
PID:5688 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system3299⤵
- System Location Discovery: System Language Discovery
PID:1456 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32100⤵
- Drops file in System32 directory
PID:3756 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32101⤵
- Drops file in System32 directory
PID:3592 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32102⤵
- Drops file in System32 directory
PID:2308 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32103⤵
- Drops file in System32 directory
PID:5000 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32104⤵PID:4048
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32105⤵PID:5400
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32106⤵
- System Location Discovery: System Language Discovery
PID:1400 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32107⤵
- Drops file in System32 directory
PID:4752 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32108⤵
- Drops file in System32 directory
PID:936 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32109⤵PID:3420
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32110⤵PID:2832
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32111⤵PID:1184
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32112⤵
- System Location Discovery: System Language Discovery
PID:4404 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32113⤵PID:2628
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32114⤵PID:3140
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32115⤵PID:688
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32116⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1832 -
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32117⤵PID:4560
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32118⤵PID:4176
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32119⤵PID:2696
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32120⤵PID:2344
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32121⤵PID:2184
-
C:\Windows\SysWOW64\scvhosts.exe"C:\Windows\system32\scvhosts.exe" MLT C:\Windows\system32122⤵
- System Location Discovery: System Language Discovery
PID:3152
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-