guloader | 0eaa6dd0dbecdcb8877516e71a86427d219665332b94f7fc86ff047d5ef62003

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 08:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
Size 753KB
Sample240426-j6qftace69
SHA256 8059dc704b71f1a978547729e4afdf62f0c834950758ca8bb6a25fa6fca0b03d
MD5 dbe4440d32dc0b20dee76c192587ab33
SHA1 d5c94559655c5fc5bc552fce62aad8673731a3bb
SHA512 13eea3b51fce84b90b363de9b05f6e08fa0c082b67f0be91146f241ab49f7d421fec5d81b5507c6df396bdba21e71b6cef176f8a70a0d972c11cf2ad7d768efa
SSDEEP 6144:9zZzl4awJ9Gal0ZcMGDTBRA5bASrGs/1iLJ0ca8EptqioUCaSniaVgkpmcqaw/c0:DaalkPhH8V/kLBa8CwioQAxjw/ar4vd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection downloader persistence spyware stealer

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3128-1338-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/3128-1335-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4144-1326-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4144-1343-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

resource	yara_rule
behavioral2/memory/4144-1326-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3128-1338-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4144-1343-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/400-1337-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/400-1336-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3128-1335-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

Loads dropped DLL 64 IoCs

pid	Process
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Nomap = "C:\\Users\\Admin\\AppData\\Local\\Temp\\weltervgter\\Gutte.exe"	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
1200	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
1200	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
1200	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2840 set thread context of 1200	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	687
PID 1200 set thread context of 4144	1200	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	689
PID 1200 set thread context of 3128	1200	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	690
PID 1200 set thread context of 400	1200	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	691

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\gashanens.ini	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4144	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
4144	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
400	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
400	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
4144	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
4144	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
1200	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
1200	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
1200	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	400	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1200	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 1104	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	85
PID 2840 wrote to memory of 1104	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	85
PID 2840 wrote to memory of 1104	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	85
PID 2840 wrote to memory of 2156	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	88
PID 2840 wrote to memory of 2156	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	88
PID 2840 wrote to memory of 2156	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	88
PID 2840 wrote to memory of 3336	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	91
PID 2840 wrote to memory of 3336	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	91
PID 2840 wrote to memory of 3336	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	91
PID 2840 wrote to memory of 4516	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	94
PID 2840 wrote to memory of 4516	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	94
PID 2840 wrote to memory of 4516	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	94
PID 2840 wrote to memory of 2416	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	96
PID 2840 wrote to memory of 2416	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	96
PID 2840 wrote to memory of 2416	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	96
PID 2840 wrote to memory of 4112	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	98
PID 2840 wrote to memory of 4112	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	98
PID 2840 wrote to memory of 4112	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	98
PID 2840 wrote to memory of 1960	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	100
PID 2840 wrote to memory of 1960	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	100
PID 2840 wrote to memory of 1960	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	100
PID 2840 wrote to memory of 4608	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	102
PID 2840 wrote to memory of 4608	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	102
PID 2840 wrote to memory of 4608	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	102
PID 2840 wrote to memory of 4168	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	104
PID 2840 wrote to memory of 4168	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	104
PID 2840 wrote to memory of 4168	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	104
PID 2840 wrote to memory of 2392	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	106
PID 2840 wrote to memory of 2392	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	106
PID 2840 wrote to memory of 2392	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	106
PID 2840 wrote to memory of 4104	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	108
PID 2840 wrote to memory of 4104	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	108
PID 2840 wrote to memory of 4104	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	108
PID 2840 wrote to memory of 3444	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	110
PID 2840 wrote to memory of 3444	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	110
PID 2840 wrote to memory of 3444	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	110
PID 2840 wrote to memory of 4084	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	112
PID 2840 wrote to memory of 4084	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	112
PID 2840 wrote to memory of 4084	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	112
PID 2840 wrote to memory of 3284	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	114
PID 2840 wrote to memory of 3284	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	114
PID 2840 wrote to memory of 3284	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	114
PID 2840 wrote to memory of 1200	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	116
PID 2840 wrote to memory of 1200	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	116
PID 2840 wrote to memory of 1200	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	116
PID 2840 wrote to memory of 2452	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	118
PID 2840 wrote to memory of 2452	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	118
PID 2840 wrote to memory of 2452	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	118
PID 2840 wrote to memory of 3240	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	120
PID 2840 wrote to memory of 3240	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	120
PID 2840 wrote to memory of 3240	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	120
PID 2840 wrote to memory of 3732	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	122
PID 2840 wrote to memory of 3732	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	122
PID 2840 wrote to memory of 3732	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	122
PID 2840 wrote to memory of 4604	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	125
PID 2840 wrote to memory of 4604	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	125
PID 2840 wrote to memory of 4604	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	125
PID 2840 wrote to memory of 4732	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	127
PID 2840 wrote to memory of 4732	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	127
PID 2840 wrote to memory of 4732	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	127
PID 2840 wrote to memory of 3488	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	129
PID 2840 wrote to memory of 3488	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	129
PID 2840 wrote to memory of 3488	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	129
PID 2840 wrote to memory of 2804	2840	PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe	131

C:\Users\Admin\AppData\Local\Temp\PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
"C:\Users\Admin\AppData\Local\Temp\PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "250^177"
  2⤵
  PID:1104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:2156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^177"
  2⤵
  PID:3336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "255^177"
  2⤵
  PID:4516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:2416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "253^177"
  2⤵
  PID:4112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:1960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "131^177"
  2⤵
  PID:4608
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:4168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:2392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "242^177"
  2⤵
  PID:4104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:3444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:4084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "208^177"
  2⤵
  PID:3284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "197^177"
  2⤵
  PID:1200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:2452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^177"
  2⤵
  PID:3240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:4604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:4732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^177"
  2⤵
  PID:3488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "153^177"
  2⤵
  PID:2804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "220^177"
  2⤵
  PID:2428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:2560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "133^177"
  2⤵
  PID:3440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:2200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:3940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "201^177"
  2⤵
  PID:1200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^177"
  2⤵
  PID:544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:5040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:3396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:5100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:4956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:5104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:3128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:2108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "193^177"
  2⤵
  PID:2216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:3168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1424
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "133^177"
  2⤵
  PID:3600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:4736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:3276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "201^177"
  2⤵
  PID:400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^177"
  2⤵
  PID:752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:3480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:4532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^177"
  2⤵
  PID:1972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^177"
  2⤵
  PID:2408
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:2180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "132^177"
  2⤵
  PID:4092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "141^177"
  2⤵
  PID:4956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "250^177"
  2⤵
  PID:2416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:2212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^177"
  2⤵
  PID:4140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "255^177"
  2⤵
  PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:1676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "253^177"
  2⤵
  PID:1920
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:1648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "131^177"
  2⤵
  PID:4468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:4876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:4372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "231^177"
  2⤵
  PID:1336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:4684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:3524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "197^177"
  2⤵
  PID:1424
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "196^177"
  2⤵
  PID:2396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "208^177"
  2⤵
  PID:2028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:4112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^177"
  2⤵
  PID:2736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:4380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "222^177"
  2⤵
  PID:552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "210^177"
  2⤵
  PID:2892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "153^177"
  2⤵
  PID:60
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:4320
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:3368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "135^177"
  2⤵
  PID:1516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "134^177"
  2⤵
  PID:744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "133^177"
  2⤵
  PID:1912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:4956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:2416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "134^177"
  2⤵
  PID:2212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "134^177"
  2⤵
  PID:4476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "135^177"
  2⤵
  PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:5028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:4468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:4876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "201^177"
  2⤵
  PID:4372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:4976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:3012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:4956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3248
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:4140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "201^177"
  2⤵
  PID:4796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "133^177"
  2⤵
  PID:1672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1920
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^177"
  2⤵
  PID:1648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "193^177"
  2⤵
  PID:392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^177"
  2⤵
  PID:3776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "128^177"
  2⤵
  PID:4976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "141^177"
  2⤵
  PID:2156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "250^177"
  2⤵
  PID:1516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^177"
  2⤵
  PID:1912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "255^177"
  2⤵
  PID:4956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:3248
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "253^177"
  2⤵
  PID:1028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:4476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "131^177"
  2⤵
  PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:1676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "226^177"
  2⤵
  PID:4532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:4356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "197^177"
  2⤵
  PID:5040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^177"
  2⤵
  PID:2384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:2396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:1416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^177"
  2⤵
  PID:4308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "222^177"
  2⤵
  PID:2412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "223^177"
  2⤵
  PID:4812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "197^177"
  2⤵
  PID:2108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:4084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:4072
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "153^177"
  2⤵
  PID:2216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:4468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:4604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:3488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "132^177"
  2⤵
  PID:2160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "135^177"
  2⤵
  PID:1636
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "134^177"
  2⤵
  PID:2848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "134^177"
  2⤵
  PID:3028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:4100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:4016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3152
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:4356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:4372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:5096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:4484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^177"
  2⤵
  PID:1416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^177"
  2⤵
  PID:3308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:4168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:4380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "141^177"
  2⤵
  PID:4500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "250^177"
  2⤵
  PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:1676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^177"
  2⤵
  PID:420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "255^177"
  2⤵
  PID:3744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:4624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "253^177"
  2⤵
  PID:220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:5040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "131^177"
  2⤵
  PID:2648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^177"
  2⤵
  PID:3012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:4692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "208^177"
  2⤵
  PID:4396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "213^177"
  2⤵
  PID:752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^177"
  2⤵
  PID:4476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:4844
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:3144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:2452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "153^177"
  2⤵
  PID:2672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:4020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:2344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "132^177"
  2⤵
  PID:2384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:4692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "128^177"
  2⤵
  PID:4396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:4380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:4424
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1844
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "135^177"
  2⤵
  PID:5092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "134^177"
  2⤵
  PID:3240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "133^177"
  2⤵
  PID:2808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:5040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "134^177"
  2⤵
  PID:2648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "134^177"
  2⤵
  PID:416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "135^177"
  2⤵
  PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:2376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "155^177"
  2⤵
  PID:948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:3980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:4652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3152
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:4356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^177"
  2⤵
  PID:4996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^177"
  2⤵
  PID:2120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:2396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:2156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "141^177"
  2⤵
  PID:5012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "196^177"
  2⤵
  PID:2736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "194^177"
  2⤵
  PID:3228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:4396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:4784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:2488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "131^177"
  2⤵
  PID:2036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:1844
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:3368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "242^177"
  2⤵
  PID:3240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "208^177"
  2⤵
  PID:3732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:2540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:5100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "230^177"
  2⤵
  PID:2476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:4328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "223^177"
  2⤵
  PID:4308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "213^177"
  2⤵
  PID:2376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "222^177"
  2⤵
  PID:4544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "198^177"
  2⤵
  PID:3212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^177"
  2⤵
  PID:1596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:2216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "222^177"
  2⤵
  PID:4468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "210^177"
  2⤵
  PID:3396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^177"
  2⤵
  PID:4916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "153^177"
  2⤵
  PID:5044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2820
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:3568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "128^177"
  2⤵
  PID:4484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:3028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:4380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:4424
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1920
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:4532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:5092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:4060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:5096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^177"
  2⤵
  PID:3180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "141^177"
  2⤵
  PID:3028
- C:\Users\Admin\AppData\Local\Temp\PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
  "C:\Users\Admin\AppData\Local\Temp\PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  PID:1200
- - C:\Users\Admin\AppData\Local\Temp\PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
    C:\Users\Admin\AppData\Local\Temp\PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe /stext "C:\Users\Admin\AppData\Local\Temp\ixiqi"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4144
- - C:\Users\Admin\AppData\Local\Temp\PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
    C:\Users\Admin\AppData\Local\Temp\PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe /stext "C:\Users\Admin\AppData\Local\Temp\krnjbang"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:3128
- - C:\Users\Admin\AppData\Local\Temp\PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
    C:\Users\Admin\AppData\Local\Temp\PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe /stext "C:\Users\Admin\AppData\Local\Temp\utbbcsxayob"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nst4F4A.tmp\System.dll
Size 11KB
SHA256 b9631423a50c666faf2cc6901c5a8d6eb2fecd306fdd2524256b7e2e37b251c2
MD5 6ad39193ed20078aa1b23c33a1e48859
SHA1 95e70e4f47aa1689cc08afbdaef3ec323b5342fa
SHA512 78c89bb8c86f3b68e5314467eca4e8e922d143335081fa66b01d756303e1aec68ed01f4be7098dbe06a789ca32a0f31102f5ba408bc5ab28e61251611bb4f62b
SSDEEP 96:qIsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9Fug:ZVL7ikJb76BQUoUm+RnyXVYO2RvHFug
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nst4F4A.tmp\nsExec.dll
Size 6KB
SHA256 9a1a5c6f598247bfa52624cd793b9ef4fb85863cc9dfd69eb7ef671cacc906c9
MD5 052a077ee8b519aadbcf29e6b5e710a4
SHA1 b3ab29d0ebdbdca63e4dffd2fd2e6b9188ffae4b
SHA512 cb11cba331b85122dcc2d57171ce20382af0a9fdf0a85a30155404d975901a313c9285eb9445e51979c6ec8416ccdf97fdeaf1bd2203c9395ad046a385a90009
SSDEEP 96:Q7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgNF38:aygp3FcHi0xhYMR8dMqJVgN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-1336-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/400-1337-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/400-1334-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/400-1325-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1200-1300-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1314-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1262-0x0000000001A90000-0x0000000005AD8000-memory.dmp

Download

memory/1200-1266-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1267-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1268-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1269-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1270-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1271-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1272-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1273-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1274-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1302-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1276-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1277-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1278-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1279-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1280-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1281-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1282-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1283-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1284-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1285-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1286-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1288-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1289-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1290-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1291-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1294-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1295-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1296-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1297-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1298-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1299-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1264-0x0000000077191000-0x00000000772B1000-memory.dmp

Download

memory/1200-1301-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1275-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1265-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1318-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1305-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1306-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1307-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1308-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1310-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1311-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1312-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1313-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1303-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1315-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1316-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1317-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1355-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1304-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1354-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1260-0x0000000077191000-0x00000000772B1000-memory.dmp

Download

memory/1200-1353-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1327-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1333-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1259-0x0000000077218000-0x0000000077219000-memory.dmp

Download

memory/1200-1339-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1352-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1351-0x0000000036F60000-0x0000000036F79000-memory.dmp

Download

memory/1200-1350-0x0000000036F60000-0x0000000036F79000-memory.dmp

Download

memory/1200-1346-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/1200-1345-0x0000000036F60000-0x0000000036F79000-memory.dmp

Download

memory/1200-1324-0x0000000000830000-0x0000000001A84000-memory.dmp

Download

memory/2840-1257-0x0000000077191000-0x00000000772B1000-memory.dmp

Download

memory/2840-1258-0x0000000010000000-0x0000000010006000-memory.dmp

Download

memory/3128-1328-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3128-1321-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3128-1335-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3128-1338-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4144-1343-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4144-1326-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4144-1322-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4144-1319-0x0000000000400000-0x0000000000478000-memory.dmp

Download