guloader | 7384dec8a7a13e1709dff93154c0cd796055798a19fe470f30c211a991d46849

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2023, 09:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

IMG-WAA02112023-Disilicid4858792000000000000000.exe
Size

311KB
MD5

5de8a53252f7936c76faed665958ede7
SHA1

8507c24f624e17abcd03bac2a125f5effad52295
SHA256

7384dec8a7a13e1709dff93154c0cd796055798a19fe470f30c211a991d46849
SHA512

64e151775f815e91f9dab4475ddd9e2b649de5cdc7a89ddb075caf7d655ba5342e6f39b3fe7a1c3c2bf8d99aebbff279b9b0d79fbe496279b4f06e513f0f5abc
SSDEEP

6144:KNeZz2KU3/oXHSR0a/r8Z6YXar2VTXgOQllchjpV:KNTBaHGXrk6Ikm8RlKhj7

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 64 IoCs

pid	Process
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Startup key = "C:\\Users\\Admin\\AppData\\Local\\Temp\\subfolder1\\Udplantningen.exe"	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
3436	wab.exe
3436	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe
3436	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3244 set thread context of 3436	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	638

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\refunction\lntrykkeren\behagelysten\ryot\nodeblades\Gummistvler\heterakis.vul	IMG-WAA02112023-Disilicid4858792000000000000000.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 1744	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	86
PID 3244 wrote to memory of 1744	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	86
PID 3244 wrote to memory of 1744	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	86
PID 3244 wrote to memory of 2236	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	88
PID 3244 wrote to memory of 2236	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	88
PID 3244 wrote to memory of 2236	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	88
PID 3244 wrote to memory of 4132	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	90
PID 3244 wrote to memory of 4132	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	90
PID 3244 wrote to memory of 4132	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	90
PID 3244 wrote to memory of 5012	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	92
PID 3244 wrote to memory of 5012	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	92
PID 3244 wrote to memory of 5012	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	92
PID 3244 wrote to memory of 2768	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	94
PID 3244 wrote to memory of 2768	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	94
PID 3244 wrote to memory of 2768	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	94
PID 3244 wrote to memory of 1868	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	96
PID 3244 wrote to memory of 1868	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	96
PID 3244 wrote to memory of 1868	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	96
PID 3244 wrote to memory of 3524	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	98
PID 3244 wrote to memory of 3524	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	98
PID 3244 wrote to memory of 3524	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	98
PID 3244 wrote to memory of 3796	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	100
PID 3244 wrote to memory of 3796	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	100
PID 3244 wrote to memory of 3796	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	100
PID 3244 wrote to memory of 492	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	102
PID 3244 wrote to memory of 492	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	102
PID 3244 wrote to memory of 492	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	102
PID 3244 wrote to memory of 4128	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	104
PID 3244 wrote to memory of 4128	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	104
PID 3244 wrote to memory of 4128	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	104
PID 3244 wrote to memory of 3688	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	106
PID 3244 wrote to memory of 3688	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	106
PID 3244 wrote to memory of 3688	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	106
PID 3244 wrote to memory of 1424	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	108
PID 3244 wrote to memory of 1424	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	108
PID 3244 wrote to memory of 1424	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	108
PID 3244 wrote to memory of 1428	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	110
PID 3244 wrote to memory of 1428	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	110
PID 3244 wrote to memory of 1428	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	110
PID 3244 wrote to memory of 5068	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	112
PID 3244 wrote to memory of 5068	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	112
PID 3244 wrote to memory of 5068	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	112
PID 3244 wrote to memory of 4348	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	114
PID 3244 wrote to memory of 4348	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	114
PID 3244 wrote to memory of 4348	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	114
PID 3244 wrote to memory of 3000	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	116
PID 3244 wrote to memory of 3000	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	116
PID 3244 wrote to memory of 3000	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	116
PID 3244 wrote to memory of 4356	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	118
PID 3244 wrote to memory of 4356	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	118
PID 3244 wrote to memory of 4356	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	118
PID 3244 wrote to memory of 1764	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	120
PID 3244 wrote to memory of 1764	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	120
PID 3244 wrote to memory of 1764	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	120
PID 3244 wrote to memory of 2248	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	122
PID 3244 wrote to memory of 2248	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	122
PID 3244 wrote to memory of 2248	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	122
PID 3244 wrote to memory of 4396	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	124
PID 3244 wrote to memory of 4396	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	124
PID 3244 wrote to memory of 4396	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	124
PID 3244 wrote to memory of 1436	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	126
PID 3244 wrote to memory of 1436	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	126
PID 3244 wrote to memory of 1436	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	126
PID 3244 wrote to memory of 3520	3244	IMG-WAA02112023-Disilicid4858792000000000000000.exe	128

C:\Users\Admin\AppData\Local\Temp\IMG-WAA02112023-Disilicid4858792000000000000000.exe
"C:\Users\Admin\AppData\Local\Temp\IMG-WAA02112023-Disilicid4858792000000000000000.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x9E^235"
  2⤵
  PID:1744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x98^235"
  2⤵
  PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x8E^235"
  2⤵
  PID:4132
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x99^235"
  2⤵
  PID:5012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD8^235"
  2⤵
  PID:2768
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD9^235"
  2⤵
  PID:1868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD1^235"
  2⤵
  PID:3524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD1^235"
  2⤵
  PID:3796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xB8^235"
  2⤵
  PID:492
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x83^235"
  2⤵
  PID:4128
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x84^235"
  2⤵
  PID:3688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x9C^235"
  2⤵
  PID:1424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xBC^235"
  2⤵
  PID:1428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:5068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x85^235"
  2⤵
  PID:4348
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x8F^235"
  2⤵
  PID:3000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x84^235"
  2⤵
  PID:4356
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x9C^235"
  2⤵
  PID:1764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC3^235"
  2⤵
  PID:2248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:4396
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x99^235"
  2⤵
  PID:1436
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDC^235"
  2⤵
  PID:3520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC7^235"
  2⤵
  PID:2148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:3300
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:4296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC2^235"
  2⤵
  PID:3224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x92^235"
  2⤵
  PID:1356
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x86^235"
  2⤵
  PID:4904
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x98^235"
  2⤵
  PID:1308
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x9D^235"
  2⤵
  PID:2384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x88^235"
  2⤵
  PID:2784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x99^235"
  2⤵
  PID:4788
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x9F^235"
  2⤵
  PID:4972
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC5^235"
  2⤵
  PID:5036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x8F^235"
  2⤵
  PID:4128
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x87^235"
  2⤵
  PID:4828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x87^235"
  2⤵
  PID:1512
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD1^235"
  2⤵
  PID:864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD1^235"
  2⤵
  PID:4200
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xB4^235"
  2⤵
  PID:2900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x84^235"
  2⤵
  PID:3440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x9B^235"
  2⤵
  PID:3768
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x8E^235"
  2⤵
  PID:1800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x85^235"
  2⤵
  PID:3368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC3^235"
  2⤵
  PID:4156
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x86^235"
  2⤵
  PID:3780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:3912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x99^235"
  2⤵
  PID:4020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDF^235"
  2⤵
  PID:4880
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC7^235"
  2⤵
  PID:4920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:4524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:4328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:5084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:3620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:4856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x93^235"
  2⤵
  PID:4908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD3^235"
  2⤵
  PID:1128
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:4376
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:1636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:2840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC7^235"
  2⤵
  PID:1676
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:4336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:3992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:2900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:3440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x93^235"
  2⤵
  PID:2248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDA^235"
  2⤵
  PID:2448
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:4708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:4400
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC2^235"
  2⤵
  PID:4380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:3452
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC5^235"
  2⤵
  PID:1148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x99^235"
  2⤵
  PID:4880
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDE^235"
  2⤵
  PID:2224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x92^235"
  2⤵
  PID:3964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xA0^235"
  2⤵
  PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xAE^235"
  2⤵
  PID:4424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xB9^235"
  2⤵
  PID:4188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xA5^235"
  2⤵
  PID:4516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xAE^235"
  2⤵
  PID:2156
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xA7^235"
  2⤵
  PID:456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD8^235"
  2⤵
  PID:636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD9^235"
  2⤵
  PID:2840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD1^235"
  2⤵
  PID:4836
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD1^235"
  2⤵
  PID:3868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xBD^235"
  2⤵
  PID:2816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:4792
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x99^235"
  2⤵
  PID:3824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x9F^235"
  2⤵
  PID:1800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x9E^235"
  2⤵
  PID:3984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x8A^235"
  2⤵
  PID:3520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x87^235"
  2⤵
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xAA^235"
  2⤵
  PID:3884
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x87^235"
  2⤵
  PID:2796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x87^235"
  2⤵
  PID:1088
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x84^235"
  2⤵
  PID:1756
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x88^235"
  2⤵
  PID:2152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xAE^235"
  2⤵
  PID:4668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x93^235"
  2⤵
  PID:3188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC3^235"
  2⤵
  PID:5004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:3856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:1628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC6^235"
  2⤵
  PID:3456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDA^235"
  2⤵
  PID:2608
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC7^235"
  2⤵
  PID:4464
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:4064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:1676
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:4944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC7^235"
  2⤵
  PID:2860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:4456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:1720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD8^235"
  2⤵
  PID:1804
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:3068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDD^235"
  2⤵
  PID:4556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDE^235"
  2⤵
  PID:4208
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:3192
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD8^235"
  2⤵
  PID:1068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDD^235"
  2⤵
  PID:3508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD3^235"
  2⤵
  PID:4540
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC7^235"
  2⤵
  PID:4084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:5072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:1732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:4028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x93^235"
  2⤵
  PID:1636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD8^235"
  2⤵
  PID:4344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:888
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:1864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC7^235"
  2⤵
  PID:4336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:1480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:4284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:1728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDD^235"
  2⤵
  PID:1240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDF^235"
  2⤵
  PID:3140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC2^235"
  2⤵
  PID:4248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x9B^235"
  2⤵
  PID:4380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC5^235"
  2⤵
  PID:4296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x99^235"
  2⤵
  PID:4900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDF^235"
  2⤵
  PID:3672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x92^235"
  2⤵
  PID:4580
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x86^235"
  2⤵
  PID:2624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x98^235"
  2⤵
  PID:5012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x9D^235"
  2⤵
  PID:4012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x88^235"
  2⤵
  PID:4428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x99^235"
  2⤵
  PID:4516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x9F^235"
  2⤵
  PID:1008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD1^235"
  2⤵
  PID:4628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD1^235"
  2⤵
  PID:5068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xB4^235"
  2⤵
  PID:720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x87^235"
  2⤵
  PID:992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x98^235"
  2⤵
  PID:4916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x8E^235"
  2⤵
  PID:3480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x8E^235"
  2⤵
  PID:5064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x80^235"
  2⤵
  PID:3768
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC3^235"
  2⤵
  PID:4672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:2480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x99^235"
  2⤵
  PID:1320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDE^235"
  2⤵
  PID:4244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC7^235"
  2⤵
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:4660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:2396
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:4620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD8^235"
  2⤵
  PID:3964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDA^235"
  2⤵
  PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD2^235"
  2⤵
  PID:3620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:1336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:1056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC7^235"
  2⤵
  PID:1424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:2620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:4128
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:2824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:648
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC2^235"
  2⤵
  PID:1580
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:3992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC5^235"
  2⤵
  PID:1764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x99^235"
  2⤵
  PID:1432
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDC^235"
  2⤵
  PID:3436
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x92^235"
  2⤵
  PID:2792
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x86^235"
  2⤵
  PID:3492
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x98^235"
  2⤵
  PID:2148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x9D^235"
  2⤵
  PID:4048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x88^235"
  2⤵
  PID:4252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x99^235"
  2⤵
  PID:1744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x9F^235"
  2⤵
  PID:392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC5^235"
  2⤵
  PID:3508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x8F^235"
  2⤵
  PID:1964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x87^235"
  2⤵
  PID:4536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x87^235"
  2⤵
  PID:4908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD1^235"
  2⤵
  PID:3620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD1^235"
  2⤵
  PID:1336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xB4^235"
  2⤵
  PID:1056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x99^235"
  2⤵
  PID:1424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x8E^235"
  2⤵
  PID:1724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x8A^235"
  2⤵
  PID:3728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x8F^235"
  2⤵
  PID:4980
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC3^235"
  2⤵
  PID:4064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:1624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:3868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x99^235"
  2⤵
  PID:1808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDE^235"
  2⤵
  PID:3272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC7^235"
  2⤵
  PID:3368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:4008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:2284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:2544
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x99^235"
  2⤵
  PID:4380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDF^235"
  2⤵
  PID:4308
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC7^235"
  2⤵
  PID:1148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:4720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:4332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:5012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD8^235"
  2⤵
  PID:4012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:3212
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDD^235"
  2⤵
  PID:4376
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDE^235"
  2⤵
  PID:3688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:1636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD8^235"
  2⤵
  PID:4736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDD^235"
  2⤵
  PID:720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD3^235"
  2⤵
  PID:1864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC2^235"
  2⤵
  PID:4200
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x92^235"
  2⤵
  PID:2536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x9E^235"
  2⤵
  PID:2900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x98^235"
  2⤵
  PID:5092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x8E^235"
  2⤵
  PID:1728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x99^235"
  2⤵
  PID:3600
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD8^235"
  2⤵
  PID:3140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD9^235"
  2⤵
  PID:1140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD1^235"
  2⤵
  PID:808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xD1^235"
  2⤵
  PID:1264
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xA8^235"
  2⤵
  PID:972
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x8A^235"
  2⤵
  PID:3224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x87^235"
  2⤵
  PID:2104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x87^235"
  2⤵
  PID:1384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xBC^235"
  2⤵
  PID:2624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:5084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x85^235"
  2⤵
  PID:5004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x8F^235"
  2⤵
  PID:2512
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x84^235"
  2⤵
  PID:3048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x9C^235"
  2⤵
  PID:3560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xBB^235"
  2⤵
  PID:456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x99^235"
  2⤵
  PID:4464
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x84^235"
  2⤵
  PID:992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x88^235"
  2⤵
  PID:1864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xAA^235"
  2⤵
  PID:4932
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC3^235"
  2⤵
  PID:1580
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:2188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x99^235"
  2⤵
  PID:3704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDF^235"
  2⤵
  PID:3764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:1228
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC7^235"
  2⤵
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:3452
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:3136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC7^235"
  2⤵
  PID:1136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:4368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:4432
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:4132
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC7^235"
  2⤵
  PID:2736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:364
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:5004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:2512
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:2036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC7^235"
  2⤵
  PID:4148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:4548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x82^235"
  2⤵
  PID:1284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xCB^235"
  2⤵
  PID:2840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xDB^235"
  2⤵
  PID:4916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0xC2^235"
  2⤵
  PID:4200
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x92^235"
  2⤵
  PID:2536
- C:\Program Files (x86)\windows mail\wab.exe
  "C:\Users\Admin\AppData\Local\Temp\IMG-WAA02112023-Disilicid4858792000000000000000.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBC5C.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
memory/3244-618-0x0000000003300000-0x000000000503B000-memory.dmp

Filesize
29.2MB

Download
memory/3244-619-0x0000000003300000-0x000000000503B000-memory.dmp

Filesize
29.2MB

Download
memory/3244-620-0x0000000076FB1000-0x00000000770D1000-memory.dmp

Filesize
1.1MB

Download
memory/3244-621-0x0000000073CA0000-0x0000000073CA7000-memory.dmp

Filesize
28KB

Download
memory/3436-622-0x0000000000C00000-0x000000000293B000-memory.dmp

Filesize
29.2MB

Download
memory/3436-623-0x0000000077038000-0x0000000077039000-memory.dmp

Filesize
4KB

Download
memory/3436-624-0x0000000076FB1000-0x00000000770D1000-memory.dmp

Filesize
1.1MB

Download
memory/3436-626-0x0000000000C00000-0x000000000293B000-memory.dmp

Filesize
29.2MB

Download
memory/3436-627-0x0000000000C00000-0x000000000293B000-memory.dmp

Filesize
29.2MB

Download
memory/3436-629-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-630-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-631-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-632-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-633-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-634-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-635-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-636-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-637-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-638-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-639-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-640-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-641-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-642-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-643-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-644-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-645-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-646-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-647-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-648-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-649-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-650-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-651-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-652-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-653-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-654-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-655-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-656-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-657-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-658-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-659-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-660-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-661-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-662-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-663-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-664-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-665-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-666-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-667-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-668-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-669-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-671-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download
memory/3436-672-0x0000000072A40000-0x0000000073C94000-memory.dmp

Filesize
18.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads