dcf5a9ee29889bc50645eb2cc01e1d0449550d9757e200ae8cd86b175d87ab1e

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2025, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nPI-0043HHMLKK200650010025.exe
Size 1.4MB
Sample250514-e437nsej5x
SHA256 dcf5a9ee29889bc50645eb2cc01e1d0449550d9757e200ae8cd86b175d87ab1e
MD5 4a5d67fe34b298ce86f762300912afc5
SHA1 6fdabea76b9224985c4c7b0a4f3696e19bb15361
SHA512 49ca00aa1aec68a1ffeaf8e5cc06d7cd971bd87e691d4f113b9be26bd87426c8145a8f12189e3a70126d964c949f6e420e83e2da0acd2a58f63f13e87db74c16
SSDEEP 24576:6tb20pkaCqT5TBWgNQ7ar8/KQpXFirz1Bh9/6748cL+uNwaKhUUeH+6A:nVg5tQ7ar8NFU1BqM2zhnl5
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\shrugged.vbs	shrugged.exe

Executes dropped EXE 64 IoCs

pid	Process
4508	shrugged.exe
3108	shrugged.exe
4860	shrugged.exe
4292	shrugged.exe
5836	shrugged.exe
4948	shrugged.exe
2436	shrugged.exe
2844	shrugged.exe
828	shrugged.exe
3368	shrugged.exe
1284	shrugged.exe
2108	shrugged.exe
1376	shrugged.exe
1140	shrugged.exe
5756	shrugged.exe
2588	shrugged.exe
3372	shrugged.exe
3668	shrugged.exe
5740	shrugged.exe
1184	shrugged.exe
728	shrugged.exe
5816	shrugged.exe
940	shrugged.exe
6000	shrugged.exe
1872	shrugged.exe
3480	shrugged.exe
3540	shrugged.exe
5384	shrugged.exe
3060	shrugged.exe
5776	shrugged.exe
3744	shrugged.exe
2056	shrugged.exe
2424	shrugged.exe
4320	shrugged.exe
5728	shrugged.exe
4152	shrugged.exe
324	shrugged.exe
5588	shrugged.exe
2916	shrugged.exe
5760	shrugged.exe
6072	shrugged.exe
4616	shrugged.exe
4624	shrugged.exe
4836	shrugged.exe
4680	shrugged.exe
4124	shrugged.exe
464	shrugged.exe
4532	shrugged.exe
560	shrugged.exe
3112	shrugged.exe
5020	shrugged.exe
2628	shrugged.exe
1284	shrugged.exe
2108	shrugged.exe
1288	shrugged.exe
5276	shrugged.exe
4540	shrugged.exe
1504	shrugged.exe
4952	shrugged.exe
856	shrugged.exe
1544	shrugged.exe
5864	shrugged.exe
3200	shrugged.exe
3648	shrugged.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0006000000022b8b-9.dat	autoit_exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shrugged.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5852 wrote to memory of 4508	5852	nPI-0043HHMLKK200650010025.exe	89
PID 5852 wrote to memory of 4508	5852	nPI-0043HHMLKK200650010025.exe	89
PID 5852 wrote to memory of 4508	5852	nPI-0043HHMLKK200650010025.exe	89
PID 4508 wrote to memory of 3108	4508	shrugged.exe	90
PID 4508 wrote to memory of 3108	4508	shrugged.exe	90
PID 4508 wrote to memory of 3108	4508	shrugged.exe	90
PID 3108 wrote to memory of 4860	3108	shrugged.exe	93
PID 3108 wrote to memory of 4860	3108	shrugged.exe	93
PID 3108 wrote to memory of 4860	3108	shrugged.exe	93
PID 4860 wrote to memory of 4292	4860	shrugged.exe	95
PID 4860 wrote to memory of 4292	4860	shrugged.exe	95
PID 4860 wrote to memory of 4292	4860	shrugged.exe	95
PID 4292 wrote to memory of 5836	4292	shrugged.exe	98
PID 4292 wrote to memory of 5836	4292	shrugged.exe	98
PID 4292 wrote to memory of 5836	4292	shrugged.exe	98
PID 5836 wrote to memory of 4948	5836	shrugged.exe	100
PID 5836 wrote to memory of 4948	5836	shrugged.exe	100
PID 5836 wrote to memory of 4948	5836	shrugged.exe	100
PID 4948 wrote to memory of 2436	4948	shrugged.exe	102
PID 4948 wrote to memory of 2436	4948	shrugged.exe	102
PID 4948 wrote to memory of 2436	4948	shrugged.exe	102
PID 2436 wrote to memory of 2844	2436	shrugged.exe	103
PID 2436 wrote to memory of 2844	2436	shrugged.exe	103
PID 2436 wrote to memory of 2844	2436	shrugged.exe	103
PID 2844 wrote to memory of 828	2844	shrugged.exe	104
PID 2844 wrote to memory of 828	2844	shrugged.exe	104
PID 2844 wrote to memory of 828	2844	shrugged.exe	104
PID 828 wrote to memory of 3368	828	shrugged.exe	105
PID 828 wrote to memory of 3368	828	shrugged.exe	105
PID 828 wrote to memory of 3368	828	shrugged.exe	105
PID 3368 wrote to memory of 1284	3368	shrugged.exe	107
PID 3368 wrote to memory of 1284	3368	shrugged.exe	107
PID 3368 wrote to memory of 1284	3368	shrugged.exe	107
PID 1284 wrote to memory of 2108	1284	shrugged.exe	108
PID 1284 wrote to memory of 2108	1284	shrugged.exe	108
PID 1284 wrote to memory of 2108	1284	shrugged.exe	108
PID 2108 wrote to memory of 1376	2108	shrugged.exe	109
PID 2108 wrote to memory of 1376	2108	shrugged.exe	109
PID 2108 wrote to memory of 1376	2108	shrugged.exe	109
PID 1376 wrote to memory of 1140	1376	shrugged.exe	110
PID 1376 wrote to memory of 1140	1376	shrugged.exe	110
PID 1376 wrote to memory of 1140	1376	shrugged.exe	110
PID 1140 wrote to memory of 5756	1140	shrugged.exe	112
PID 1140 wrote to memory of 5756	1140	shrugged.exe	112
PID 1140 wrote to memory of 5756	1140	shrugged.exe	112
PID 5756 wrote to memory of 2588	5756	shrugged.exe	113
PID 5756 wrote to memory of 2588	5756	shrugged.exe	113
PID 5756 wrote to memory of 2588	5756	shrugged.exe	113
PID 2588 wrote to memory of 3372	2588	shrugged.exe	114
PID 2588 wrote to memory of 3372	2588	shrugged.exe	114
PID 2588 wrote to memory of 3372	2588	shrugged.exe	114
PID 3372 wrote to memory of 3668	3372	shrugged.exe	115
PID 3372 wrote to memory of 3668	3372	shrugged.exe	115
PID 3372 wrote to memory of 3668	3372	shrugged.exe	115
PID 3668 wrote to memory of 5740	3668	shrugged.exe	116
PID 3668 wrote to memory of 5740	3668	shrugged.exe	116
PID 3668 wrote to memory of 5740	3668	shrugged.exe	116
PID 5740 wrote to memory of 1184	5740	shrugged.exe	118
PID 5740 wrote to memory of 1184	5740	shrugged.exe	118
PID 5740 wrote to memory of 1184	5740	shrugged.exe	118
PID 1184 wrote to memory of 728	1184	shrugged.exe	119
PID 1184 wrote to memory of 728	1184	shrugged.exe	119
PID 1184 wrote to memory of 728	1184	shrugged.exe	119
PID 728 wrote to memory of 5816	728	shrugged.exe	120

C:\Users\Admin\AppData\Local\Temp\nPI-0043HHMLKK200650010025.exe
"C:\Users\Admin\AppData\Local\Temp\nPI-0043HHMLKK200650010025.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
  "C:\Users\Admin\AppData\Local\Temp\nPI-0043HHMLKK200650010025.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
    "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
      "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4860
    - - C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:728
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        24⤵
        Executes dropped EXE
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        25⤵
        Executes dropped EXE
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        27⤵
        Executes dropped EXE
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        28⤵
        Executes dropped EXE
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        30⤵
        Executes dropped EXE
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        31⤵
        Executes dropped EXE
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        33⤵
        Executes dropped EXE
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        34⤵
        Executes dropped EXE
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        35⤵
        Executes dropped EXE
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        39⤵
        Executes dropped EXE
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        41⤵
        Executes dropped EXE
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        42⤵
        Executes dropped EXE
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        43⤵
        Executes dropped EXE
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        45⤵
        Executes dropped EXE
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        46⤵
        Executes dropped EXE
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        50⤵
        Executes dropped EXE
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        51⤵
        Executes dropped EXE
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        52⤵
        Executes dropped EXE
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        54⤵
        Executes dropped EXE
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        57⤵
        Executes dropped EXE
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        58⤵
        Executes dropped EXE
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        59⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        60⤵
        Executes dropped EXE
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        62⤵
        Executes dropped EXE
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        64⤵
        Executes dropped EXE
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        65⤵
        Executes dropped EXE
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        66⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        67⤵
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        69⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        70⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        71⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        72⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        73⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        74⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        75⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        81⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        82⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        83⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        84⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        86⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        87⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        89⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        90⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        91⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        93⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        94⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        95⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        96⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        98⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        99⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        101⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        103⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        104⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        105⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        108⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        109⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        110⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        111⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        112⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        113⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        114⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        116⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        117⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        118⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        119⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        120⤵
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        121⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        122⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        123⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        124⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        125⤵
        System Location Discovery: System Language Discovery
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        126⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        128⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        129⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        130⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        131⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        132⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        133⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        134⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        138⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        139⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        140⤵
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        141⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        142⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        145⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        146⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        147⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        149⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        150⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        151⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        152⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        153⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        154⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        155⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        156⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        159⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        160⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        161⤵
        System Location Discovery: System Language Discovery
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        163⤵
        
        PID:728
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        164⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        165⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        166⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        167⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        168⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        169⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        170⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        171⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        172⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        173⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        175⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        176⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        177⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        178⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        179⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        180⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        183⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        184⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        185⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        186⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        187⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        188⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        189⤵
        System Location Discovery: System Language Discovery
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        190⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        191⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        192⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        193⤵
        System Location Discovery: System Language Discovery
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        194⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        195⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        197⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        198⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        199⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        200⤵
        System Location Discovery: System Language Discovery
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        201⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        202⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        203⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        204⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        205⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        206⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        207⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        208⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        209⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        210⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        211⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        212⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        213⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        214⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        215⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        216⤵
        System Location Discovery: System Language Discovery
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        217⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        218⤵
        System Location Discovery: System Language Discovery
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        219⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        220⤵
        System Location Discovery: System Language Discovery
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        221⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        222⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        223⤵
        System Location Discovery: System Language Discovery
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        225⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        226⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        227⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        228⤵
        System Location Discovery: System Language Discovery
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        229⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        230⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        231⤵
        System Location Discovery: System Language Discovery
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        232⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        233⤵
        System Location Discovery: System Language Discovery
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        234⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        235⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        236⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        237⤵
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        238⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        239⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
        
        "C:\Users\Admin\AppData\Local\Bactris\shrugged.exe"
        240⤵
        
        PID:5068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shrugged.exe

Path C:\Users\Admin\AppData\Local\Bactris\shrugged.exe
Size 1.4MB
SHA256 dcf5a9ee29889bc50645eb2cc01e1d0449550d9757e200ae8cd86b175d87ab1e
MD5 4a5d67fe34b298ce86f762300912afc5
SHA1 6fdabea76b9224985c4c7b0a4f3696e19bb15361
SHA512 49ca00aa1aec68a1ffeaf8e5cc06d7cd971bd87e691d4f113b9be26bd87426c8145a8f12189e3a70126d964c949f6e420e83e2da0acd2a58f63f13e87db74c16
SSDEEP 24576:6tb20pkaCqT5TBWgNQ7ar8/KQpXFirz1Bh9/6748cL+uNwaKhUUeH+6A:nVg5tQ7ar8NFU1BqM2zhnl5
MD5 SHA1 SHA512 SSDEEP

Submit Download

aut6949.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut6949.tmp
Size 549KB
SHA256 9beeba775908d58aa90b4f9525925c2dcc02bc803e0a8878b7cff31c1cd8c398
MD5 b68573833f84e6ffc586fbc42d204c4a
SHA1 dc37b85190f085b66d9e0620a8582358272e4a25
SHA512 3215522c30b45def66f6382196e928da997543f6ebab8280346d6586235a6b039e130c5f09410591055e3b6e2fa1106a8742eccd8b35cd6333c30f989ce7f480
SSDEEP 12288:hZvsBz57deJbm5/kopHSm4BSX5jbVzuLS+FuGWEp:hZvsx1deJi9hSbB0zwSgxWq
MD5 SHA1 SHA512 SSDEEP

Submit Download

fondaco

Path C:\Users\Admin\AppData\Local\Temp\fondaco
Size 643KB
SHA256 4fd065b7ff6165021e6d726e1d50d46a351e9391df20e54a486a148e699b1b39
MD5 5b05db31b700860f9b43d312cc5a0eec
SHA1 f2c87023ad268d5c551eaa56f91e4bdd10dba1e4
SHA512 9e8b8120bb81c64cfc08d7e0e8e0233ba4b565bc98532eeceac670ca5e7171da8cf3e71ed9586e44051e8cd254695c9bc81acb71980bc180a3dfdcf7e65a379d
SSDEEP 12288:bTYO5By8oKdCjDP4QyVLIoiiiih+A2ZdpU+FMCrdP9A2Xluq87o0q2XJ4:4O5By8oKdCjcQU5iiiiwZdpUNCPZ1sX2
MD5 SHA1 SHA512 SSDEEP

Submit Download

fondaco

Path C:\Users\Admin\AppData\Local\Temp\fondaco
Size 320KB
SHA256 493c722cd4a0290c5599556afc9c4cd695e4c6e5e4bace6f3cdab47a8a23ce6f
MD5 ca1dedcadda2f909f3687c6b7e5d30dc
SHA1 dda7c6fadfe3f4e8dd90887423ea13aa7d5f511f
SHA512 613da60c756a2e753389b6e8e25c971c767e1b4760ce9a95912897afb4512e9e066539a48cd0adac9fbb711670ccca6531723592e1fcd91e1d48fc8600005a2a
SSDEEP 6144:bBVT0hML5BVzE8a8ATWpHJ4KdCjhN9tE53CLyVLIaFiiiih7TEvB:bTYO5By8oKdCjDP4QyVLIoiiiih+B
MD5 SHA1 SHA512 SSDEEP

Submit Download

fondaco

Path C:\Users\Admin\AppData\Local\Temp\fondaco
Size 64KB
SHA256 b076ac332dd9d4523e1037fa564608344d7703ab85aa3b7a51d161771b03dfd8
MD5 72d86956a8b02491b22c653303f5f8de
SHA1 1ee01316f3ccf6a1b52e77a037aecb7a7d718087
SHA512 f12c96767e321ceea175deaead789ef9bdd05db084410db86f88e53cde41f4ff2c01fb112d32ece5feea134e60a9fa3325a229561b05eab234236c6c08f30501
SSDEEP 1536:JDW/dGJCOrhmC3V88OfBx/e0hZiaM5BeqPiHuEc:8m1mUVme0hMaM5BeqzEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3108-28-0x0000000001750000-0x0000000001B50000-memory.dmp

Download

memory/4508-18-0x00000000015E0000-0x00000000019E0000-memory.dmp

Download

memory/5852-6-0x0000000001250000-0x0000000001650000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads