2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290

Analysis

max time kernel
102s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
Size 2.2MB
Sample260810-req72awsav
SHA256 2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290
MD5 12bc60e6d5110c7cece3ef2ee3caf475
SHA1 bfd109af9266ea76b7385ab6bdba75bb96573c15
SHA512 58bd0316a168dfc727f3bf4a20b32d13571e1f862e46e0634c3d5b70b64c5e022755177bc5b4acfd2ac432bf32e1b9064626a7a2952a30381b60155e63135456
SSDEEP 49152:eXekTDkl5sY22/5j2ysPEG0LWC8cpUcqv7RGyRM/ERZiJ:kLsl5B8CGUz9pUTRTR66i
TLSH
T148B59E11AAC297B2E2B717B045B9FF30937DFF1157B25B9B2390C64D1CA16D04A2B362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe"	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5600	cmd.exe
3768	cmd.exe
3036	cmd.exe
5164	cmd.exe
1332	cmd.exe
5740	cmd.exe
5052	cmd.exe
6800	cmd.exe
3084	cmd.exe
1688	cmd.exe
400	cmd.exe
2488	cmd.exe
6256	cmd.exe
3556	cmd.exe
1484	cmd.exe
3936	cmd.exe
5744	cmd.exe
3600	cmd.exe
5060	cmd.exe
4592	cmd.exe
2376	cmd.exe
1768	cmd.exe
5096	cmd.exe
2796	cmd.exe
1004	cmd.exe
6832	cmd.exe
2796	cmd.exe
5936	cmd.exe
3976	cmd.exe
2892	cmd.exe
5280	cmd.exe
5876	cmd.exe
6900	cmd.exe
1280	cmd.exe
3064	cmd.exe
6964	cmd.exe
1600	cmd.exe
4596	cmd.exe
5320	cmd.exe
4900	cmd.exe
5948	cmd.exe
968	cmd.exe
5212	cmd.exe
2624	cmd.exe
4292	cmd.exe
4456	cmd.exe
1052	cmd.exe
1104	cmd.exe
6776	cmd.exe
6372	cmd.exe
1188	cmd.exe
6020	cmd.exe
6368	cmd.exe
3784	cmd.exe
5080	cmd.exe
5936	cmd.exe
4228	cmd.exe
6028	cmd.exe
3040	cmd.exe
1264	cmd.exe
3524	cmd.exe
3088	cmd.exe
3480	cmd.exe
1868	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4960	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	86
PID 4976 wrote to memory of 4736	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	87
PID 4976 wrote to memory of 4876	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	88
PID 4976 wrote to memory of 4892	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	89
PID 4976 wrote to memory of 4900	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	90
PID 4976 wrote to memory of 6072	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	92
PID 4976 wrote to memory of 2316	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	93
PID 4976 wrote to memory of 1848	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	98
PID 4976 wrote to memory of 3480	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	100
PID 4976 wrote to memory of 1768	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	101
PID 4976 wrote to memory of 3976	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	102
PID 4976 wrote to memory of 2376	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	103
PID 4976 wrote to memory of 5520	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	104
PID 4976 wrote to memory of 4456	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	105
PID 4976 wrote to memory of 3196	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	113
PID 4976 wrote to memory of 2856	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	114
PID 4976 wrote to memory of 400	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	115
PID 4976 wrote to memory of 1240	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	116
PID 4976 wrote to memory of 5372	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	117
PID 4976 wrote to memory of 1332	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	118
PID 4976 wrote to memory of 1104	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	119
PID 4976 wrote to memory of 1956	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	120
PID 4976 wrote to memory of 5164	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	121
PID 4976 wrote to memory of 5556	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	122
PID 4976 wrote to memory of 3216	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	123
PID 4976 wrote to memory of 4388	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	124
PID 4976 wrote to memory of 1688	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	125
PID 4976 wrote to memory of 5760	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	126
PID 4976 wrote to memory of 408	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	127
PID 4976 wrote to memory of 5936	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	128
PID 4976 wrote to memory of 5860	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	129
PID 4976 wrote to memory of 2624	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	130
PID 4976 wrote to memory of 4348	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	131
PID 4976 wrote to memory of 1924	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	132
PID 4976 wrote to memory of 5432	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	133
PID 4976 wrote to memory of 1004	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	134
PID 4976 wrote to memory of 5060	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	135
PID 4976 wrote to memory of 4440	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	136
PID 4976 wrote to memory of 5044	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	137
PID 4976 wrote to memory of 5180	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	138
PID 4976 wrote to memory of 5448	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	139
PID 4976 wrote to memory of 5428	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	140
PID 4976 wrote to memory of 5088	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	141
PID 4976 wrote to memory of 5144	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	142
PID 4976 wrote to memory of 2848	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	143
PID 4976 wrote to memory of 5080	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	144
PID 4976 wrote to memory of 5136	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	145
PID 4976 wrote to memory of 4972	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	146
PID 4976 wrote to memory of 2892	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	147
PID 4976 wrote to memory of 5948	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	183
PID 4976 wrote to memory of 1280	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	184
PID 4976 wrote to memory of 3036	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	187
PID 4976 wrote to memory of 2072	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	188
PID 4976 wrote to memory of 5680	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	189
PID 4976 wrote to memory of 3600	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	190
PID 4976 wrote to memory of 5744	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	191
PID 4976 wrote to memory of 5280	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	192
PID 4976 wrote to memory of 2796	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	193
PID 4976 wrote to memory of 3748	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	194
PID 4976 wrote to memory of 4956	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	195
PID 4976 wrote to memory of 5364	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	196
PID 4976 wrote to memory of 5096	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	197
PID 4976 wrote to memory of 5876	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	198
PID 4976 wrote to memory of 6140	4976	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	199

C:\Users\Admin\AppData\Local\Temp\2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
"C:\Users\Admin\AppData\Local\Temp\2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe"
1⤵
- Adds Run key to start application
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4736
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4892
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4900
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2316
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3480
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2376
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4456
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3196
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2856
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5372
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1332
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1104
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:5164
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1688
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5760
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:5936
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:2624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:1004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4440
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5044
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5180
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5428
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5144
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4972
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:2892
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:1280
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3036
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5680
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5744
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5280
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2796
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3748
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5364
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5096
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6140
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2280
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:1264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:3764
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:1868
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:404
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3936
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:3784
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3084
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:5212
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3580
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5856
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:1052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:3348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3316
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5084
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:5320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4596
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5012
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1932

C:\Users\Admin\AppData\Local\Temp\2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
C:\Users\Admin\AppData\Local\Temp\2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
1⤵
PID:5812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:3064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:6832
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:3524
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:6964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6604
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:6776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5260
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:5740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6772
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6932
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:6372
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2036
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:820
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5644
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5792
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:6800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1592
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6784
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4292
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4140
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:3396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:1600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6596
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:2488
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5620
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6764
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:3288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1488
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2584
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:3240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:5052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:3452
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:1188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:5876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:3196
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:2796
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2280
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4592
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:3040
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:3088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:3224
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5212
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5024
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:6368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:5936
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:6028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4336
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:6020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:1484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:3812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:3320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:3556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2424
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4228
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6536
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1912
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5376
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:6900
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1872
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6084
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:3248
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1532
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5892
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4412
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1724
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:3808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:6256