2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
Size 2.2MB
Sample260810-req72awsav
SHA256 2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290
MD5 12bc60e6d5110c7cece3ef2ee3caf475
SHA1 bfd109af9266ea76b7385ab6bdba75bb96573c15
SHA512 58bd0316a168dfc727f3bf4a20b32d13571e1f862e46e0634c3d5b70b64c5e022755177bc5b4acfd2ac432bf32e1b9064626a7a2952a30381b60155e63135456
SSDEEP 49152:eXekTDkl5sY22/5j2ysPEG0LWC8cpUcqv7RGyRM/ERZiJ:kLsl5B8CGUz9pUTRTR66i
TLSH
T148B59E11AAC297B2E2B717B045B9FF30937DFF1157B25B9B2390C64D1CA16D04A2B362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe"	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4692	cmd.exe
680	cmd.exe
124	cmd.exe
4392	cmd.exe
4236	cmd.exe
5660	cmd.exe
7900	cmd.exe
7884	cmd.exe
2160	cmd.exe
4964	cmd.exe
7892	cmd.exe
7876	cmd.exe
6956	cmd.exe
8008	cmd.exe
3796	cmd.exe
4160	cmd.exe
3328	cmd.exe
5444	cmd.exe
3356	cmd.exe
2604	cmd.exe
4336	cmd.exe
7868	cmd.exe
5320	cmd.exe
5288	cmd.exe
4072	cmd.exe
7852	cmd.exe
4292	cmd.exe
5520	cmd.exe
5948	cmd.exe
3080	cmd.exe
7916	cmd.exe
6228	cmd.exe
5660	cmd.exe
1692	cmd.exe
1976	cmd.exe
4068	cmd.exe
8160	cmd.exe
8152	cmd.exe
8136	cmd.exe
8128	cmd.exe
8016	cmd.exe
7948	cmd.exe
1628	cmd.exe
5588	cmd.exe
5040	cmd.exe
4520	cmd.exe
7932	cmd.exe
7764	cmd.exe
7756	cmd.exe
4420	cmd.exe
5980	cmd.exe
4584	cmd.exe
6936	cmd.exe
6808	cmd.exe
8104	cmd.exe
8032	cmd.exe
4528	cmd.exe
2952	cmd.exe
6068	cmd.exe
5696	cmd.exe
4180	cmd.exe
6820	cmd.exe
968	cmd.exe
8048	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
7860	7740	WerFault.exe	291
3372	4192	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
Token: SeDebugPrivilege	7740	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 4948	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	89
PID 4192 wrote to memory of 4364	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	90
PID 4192 wrote to memory of 2564	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	91
PID 4192 wrote to memory of 3880	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	92
PID 4192 wrote to memory of 5816	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	93
PID 4192 wrote to memory of 4240	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	94
PID 4192 wrote to memory of 5004	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	95
PID 4192 wrote to memory of 4964	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	96
PID 4192 wrote to memory of 4068	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	97
PID 4192 wrote to memory of 3080	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	98
PID 4192 wrote to memory of 5472	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	99
PID 4192 wrote to memory of 5660	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	100
PID 4192 wrote to memory of 5948	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	101
PID 4192 wrote to memory of 4212	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	102
PID 4192 wrote to memory of 5356	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	103
PID 4192 wrote to memory of 4636	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	104
PID 4192 wrote to memory of 5140	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	105
PID 4192 wrote to memory of 5844	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	106
PID 4192 wrote to memory of 2160	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	107
PID 4192 wrote to memory of 1952	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	108
PID 4192 wrote to memory of 3372	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	109
PID 4192 wrote to memory of 3464	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	110
PID 4192 wrote to memory of 5012	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	111
PID 4192 wrote to memory of 1432	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	112
PID 4192 wrote to memory of 5520	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	113
PID 4192 wrote to memory of 2932	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	114
PID 4192 wrote to memory of 3828	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	115
PID 4192 wrote to memory of 4152	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	116
PID 4192 wrote to memory of 4292	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	117
PID 4192 wrote to memory of 5076	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	118
PID 4192 wrote to memory of 3796	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	119
PID 4192 wrote to memory of 4200	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	120
PID 4192 wrote to memory of 2016	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	121
PID 4192 wrote to memory of 4420	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	122
PID 4192 wrote to memory of 3436	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	123
PID 4192 wrote to memory of 4692	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	124
PID 4192 wrote to memory of 5308	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	125
PID 4192 wrote to memory of 4056	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	126
PID 4192 wrote to memory of 4072	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	127
PID 4192 wrote to memory of 4236	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	128
PID 4192 wrote to memory of 1096	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	129
PID 4192 wrote to memory of 4344	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	130
PID 4192 wrote to memory of 4360	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	131
PID 4192 wrote to memory of 1436	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	132
PID 4192 wrote to memory of 4336	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	133
PID 4192 wrote to memory of 5040	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	134
PID 4192 wrote to memory of 4320	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	135
PID 4192 wrote to memory of 4940	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	136
PID 4192 wrote to memory of 1856	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	137
PID 4192 wrote to memory of 4424	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	138
PID 4192 wrote to memory of 4764	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	139
PID 4192 wrote to memory of 5588	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	140
PID 4192 wrote to memory of 1084	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	142
PID 4192 wrote to memory of 4972	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	143
PID 4192 wrote to memory of 2604	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	144
PID 4192 wrote to memory of 2952	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	145
PID 4192 wrote to memory of 5840	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	146
PID 4192 wrote to memory of 3356	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	147
PID 4192 wrote to memory of 1704	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	148
PID 4192 wrote to memory of 5408	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	149
PID 4192 wrote to memory of 2548	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	150
PID 4192 wrote to memory of 2768	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	151
PID 4192 wrote to memory of 5444	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	152
PID 4192 wrote to memory of 5288	4192	2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe	153

C:\Users\Admin\AppData\Local\Temp\2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
"C:\Users\Admin\AppData\Local\Temp\2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe"
1⤵
- Adds Run key to start application
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4364
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:3880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:5660
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:5948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4212
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5140
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:2160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1952
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:3372
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:3464
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5012
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:5520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2932
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:3828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4292
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:3796
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4200
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4420
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:3436
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5308
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4236
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1096
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4344
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4360
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1436
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4336
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5040
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4940
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1856
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4424
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4764
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1084
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4972
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:2604
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2952
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:3356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2548
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:5444
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:5288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:1976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1620
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4376
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3212
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1628
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3572
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4392
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4416
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1524
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3204
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:296
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:292
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:124
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4488
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4528
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:5980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:680
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 1668
  2⤵
  - Program crash
  PID:3372

C:\Users\Admin\AppData\Local\Temp\2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
C:\Users\Admin\AppData\Local\Temp\2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290.exe
1⤵
- Maps connected drives based on registry
- Suspicious use of AdjustPrivilegeToken
PID:7740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:7756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:7764
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:7772
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:7780
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7788
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:7796
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:7804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:7812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:7820
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:7828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7836
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:7852
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:7860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:7868
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:7876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:7884
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:7892
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:7900
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:7908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:7916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:7924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:7932
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:7940
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:7948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:7956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:7984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:7992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:8000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:8008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:8016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:8024
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:8032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8040
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:8048
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:8080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:8096
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:8104
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:8112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:8128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:8136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:8144
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:8152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:8160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:8168
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:8176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:8184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:5320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1416
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5436
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:6808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:6820
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4340
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6936
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5516
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:6956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5140
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6208
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4180
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4360
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1940
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:4648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4244
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:4584
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1724
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:2160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:1692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:5696
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:7108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:5660
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:6232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:5512
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  PID:1780
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c exit
  2⤵
  - Executes a command shell one-liner
  PID:6228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7740 -s 976
  2⤵
  - Program crash
  PID:7860