b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Transferencia.exe
Size

431KB
MD5

07cbab426f1bc77ca5d0f6a8fc1c9b4b
SHA1

70dc25df196c9bd87c2add428dc86b5f272eb15c
SHA256

b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df
SHA512

a53c41aa20e76b7ee3baaa08aee3a4aa5361314a677ca753f68e1aca607fc8c8fdb3ab4f932991662976db2e1e30b5632bb7ebc5c12aa24dcb6703b5f311c9d7
SSDEEP

12288:Q0pZnHL9jAT8mU07ijSq/X7/8omMZ8LliOPZx:Q0pZnrhVG7imq/TdmMZ8Dx

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe
3192	Transferencia.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\undergrundslitteraturernes\warstlers.ini	Transferencia.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\starflower.thu	Transferencia.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 2076	3192	Transferencia.exe	92
PID 3192 wrote to memory of 2076	3192	Transferencia.exe	92
PID 3192 wrote to memory of 2076	3192	Transferencia.exe	92
PID 3192 wrote to memory of 4168	3192	Transferencia.exe	94
PID 3192 wrote to memory of 4168	3192	Transferencia.exe	94
PID 3192 wrote to memory of 4168	3192	Transferencia.exe	94
PID 3192 wrote to memory of 2444	3192	Transferencia.exe	96
PID 3192 wrote to memory of 2444	3192	Transferencia.exe	96
PID 3192 wrote to memory of 2444	3192	Transferencia.exe	96
PID 3192 wrote to memory of 2036	3192	Transferencia.exe	98
PID 3192 wrote to memory of 2036	3192	Transferencia.exe	98
PID 3192 wrote to memory of 2036	3192	Transferencia.exe	98
PID 3192 wrote to memory of 2524	3192	Transferencia.exe	100
PID 3192 wrote to memory of 2524	3192	Transferencia.exe	100
PID 3192 wrote to memory of 2524	3192	Transferencia.exe	100
PID 3192 wrote to memory of 4760	3192	Transferencia.exe	102
PID 3192 wrote to memory of 4760	3192	Transferencia.exe	102
PID 3192 wrote to memory of 4760	3192	Transferencia.exe	102
PID 3192 wrote to memory of 1864	3192	Transferencia.exe	104
PID 3192 wrote to memory of 1864	3192	Transferencia.exe	104
PID 3192 wrote to memory of 1864	3192	Transferencia.exe	104
PID 3192 wrote to memory of 4164	3192	Transferencia.exe	106
PID 3192 wrote to memory of 4164	3192	Transferencia.exe	106
PID 3192 wrote to memory of 4164	3192	Transferencia.exe	106
PID 3192 wrote to memory of 4488	3192	Transferencia.exe	108
PID 3192 wrote to memory of 4488	3192	Transferencia.exe	108
PID 3192 wrote to memory of 4488	3192	Transferencia.exe	108
PID 3192 wrote to memory of 3688	3192	Transferencia.exe	110
PID 3192 wrote to memory of 3688	3192	Transferencia.exe	110
PID 3192 wrote to memory of 3688	3192	Transferencia.exe	110
PID 3192 wrote to memory of 1780	3192	Transferencia.exe	112
PID 3192 wrote to memory of 1780	3192	Transferencia.exe	112
PID 3192 wrote to memory of 1780	3192	Transferencia.exe	112
PID 3192 wrote to memory of 1256	3192	Transferencia.exe	114
PID 3192 wrote to memory of 1256	3192	Transferencia.exe	114
PID 3192 wrote to memory of 1256	3192	Transferencia.exe	114
PID 3192 wrote to memory of 4840	3192	Transferencia.exe	116
PID 3192 wrote to memory of 4840	3192	Transferencia.exe	116
PID 3192 wrote to memory of 4840	3192	Transferencia.exe	116
PID 3192 wrote to memory of 2488	3192	Transferencia.exe	118
PID 3192 wrote to memory of 2488	3192	Transferencia.exe	118
PID 3192 wrote to memory of 2488	3192	Transferencia.exe	118
PID 3192 wrote to memory of 988	3192	Transferencia.exe	120
PID 3192 wrote to memory of 988	3192	Transferencia.exe	120
PID 3192 wrote to memory of 988	3192	Transferencia.exe	120
PID 3192 wrote to memory of 3276	3192	Transferencia.exe	122
PID 3192 wrote to memory of 3276	3192	Transferencia.exe	122
PID 3192 wrote to memory of 3276	3192	Transferencia.exe	122
PID 3192 wrote to memory of 4476	3192	Transferencia.exe	124
PID 3192 wrote to memory of 4476	3192	Transferencia.exe	124
PID 3192 wrote to memory of 4476	3192	Transferencia.exe	124
PID 3192 wrote to memory of 548	3192	Transferencia.exe	126
PID 3192 wrote to memory of 548	3192	Transferencia.exe	126
PID 3192 wrote to memory of 548	3192	Transferencia.exe	126
PID 3192 wrote to memory of 4140	3192	Transferencia.exe	128
PID 3192 wrote to memory of 4140	3192	Transferencia.exe	128
PID 3192 wrote to memory of 4140	3192	Transferencia.exe	128
PID 3192 wrote to memory of 624	3192	Transferencia.exe	130
PID 3192 wrote to memory of 624	3192	Transferencia.exe	130
PID 3192 wrote to memory of 624	3192	Transferencia.exe	130
PID 3192 wrote to memory of 3964	3192	Transferencia.exe	132
PID 3192 wrote to memory of 3964	3192	Transferencia.exe	132
PID 3192 wrote to memory of 3964	3192	Transferencia.exe	132
PID 3192 wrote to memory of 4752	3192	Transferencia.exe	134

C:\Users\Admin\AppData\Local\Temp\Transferencia.exe
"C:\Users\Admin\AppData\Local\Temp\Transferencia.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x53^38"
  2⤵
  PID:2076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x55^38"
  2⤵
  PID:4168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x43^38"
  2⤵
  PID:2444
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x54^38"
  2⤵
  PID:2036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x15^38"
  2⤵
  PID:2524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x14^38"
  2⤵
  PID:4760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1C^38"
  2⤵
  PID:1864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1C^38"
  2⤵
  PID:4164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x75^38"
  2⤵
  PID:4488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4E^38"
  2⤵
  PID:3688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x49^38"
  2⤵
  PID:1780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x51^38"
  2⤵
  PID:1256
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x71^38"
  2⤵
  PID:4840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:2488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x48^38"
  2⤵
  PID:988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x42^38"
  2⤵
  PID:3276
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x49^38"
  2⤵
  PID:4476
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x51^38"
  2⤵
  PID:548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0E^38"
  2⤵
  PID:4140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x54^38"
  2⤵
  PID:3964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x11^38"
  2⤵
  PID:4752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0A^38"
  2⤵
  PID:3792
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:4044
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:4956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0F^38"
  2⤵
  PID:868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x5F^38"
  2⤵
  PID:3336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4B^38"
  2⤵
  PID:2204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x55^38"
  2⤵
  PID:2244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x50^38"
  2⤵
  PID:4852
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x45^38"
  2⤵
  PID:1856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x54^38"
  2⤵
  PID:3152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x52^38"
  2⤵
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x08^38"
  2⤵
  PID:3428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x42^38"
  2⤵
  PID:2316
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4A^38"
  2⤵
  PID:4472
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4A^38"
  2⤵
  PID:32
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1C^38"
  2⤵
  PID:4476
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1C^38"
  2⤵
  PID:2728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x79^38"
  2⤵
  PID:4500
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x49^38"
  2⤵
  PID:2900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x56^38"
  2⤵
  PID:1040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x43^38"
  2⤵
  PID:3916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x48^38"
  2⤵
  PID:2112
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0E^38"
  2⤵
  PID:4956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4B^38"
  2⤵
  PID:5108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:2012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x54^38"
  2⤵
  PID:4756
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x12^38"
  2⤵
  PID:1960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0A^38"
  2⤵
  PID:3632
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:3108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:3952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:2876
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:2956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:1668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x5E^38"
  2⤵
  PID:4024
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1E^38"
  2⤵
  PID:2188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:3900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:3876
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:2444
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0A^38"
  2⤵
  PID:3048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:1952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:4560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:316
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x5E^38"
  2⤵
  PID:2592
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x17^38"
  2⤵
  PID:2312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:3152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:1496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0F^38"
  2⤵
  PID:364
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:4344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x08^38"
  2⤵
  PID:2404
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x54^38"
  2⤵
  PID:2732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x13^38"
  2⤵
  PID:4500
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x5F^38"
  2⤵
  PID:2472
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x6D^38"
  2⤵
  PID:3092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x63^38"
  2⤵
  PID:3920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x74^38"
  2⤵
  PID:3852
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x68^38"
  2⤵
  PID:4956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x63^38"
  2⤵
  PID:1920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x6A^38"
  2⤵
  PID:4100
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x15^38"
  2⤵
  PID:4488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x14^38"
  2⤵
  PID:2244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1C^38"
  2⤵
  PID:3420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1C^38"
  2⤵
  PID:3904
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x70^38"
  2⤵
  PID:4840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:3512
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x54^38"
  2⤵
  PID:4420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x52^38"
  2⤵
  PID:1116
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x53^38"
  2⤵
  PID:5060
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x47^38"
  2⤵
  PID:5032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4A^38"
  2⤵
  PID:2976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x67^38"
  2⤵
  PID:3584
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4A^38"
  2⤵
  PID:744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4A^38"
  2⤵
  PID:2892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x49^38"
  2⤵
  PID:4252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x45^38"
  2⤵
  PID:2204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x63^38"
  2⤵
  PID:2244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x5E^38"
  2⤵
  PID:2080
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0E^38"
  2⤵
  PID:1200
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:4040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:3512
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0B^38"
  2⤵
  PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x17^38"
  2⤵
  PID:3184
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0A^38"
  2⤵
  PID:5104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:4780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:2976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:4440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0A^38"
  2⤵
  PID:4104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:3596
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:4176
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1E^38"
  2⤵
  PID:2516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x11^38"
  2⤵
  PID:1440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x12^38"
  2⤵
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1E^38"
  2⤵
  PID:4680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x14^38"
  2⤵
  PID:448
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x15^38"
  2⤵
  PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x10^38"
  2⤵
  PID:392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1E^38"
  2⤵
  PID:3964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0A^38"
  2⤵
  PID:2028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:1936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:4956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:1408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:4164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x5E^38"
  2⤵
  PID:4252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x15^38"
  2⤵
  PID:3632
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:3152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:2080
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:4776
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0A^38"
  2⤵
  PID:1348
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:3204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:4140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:5060
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x10^38"
  2⤵
  PID:2184
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x12^38"
  2⤵
  PID:5104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0F^38"
  2⤵
  PID:3048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x56^38"
  2⤵
  PID:3832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x08^38"
  2⤵
  PID:4068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x54^38"
  2⤵
  PID:2920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x12^38"
  2⤵
  PID:4852
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x5F^38"
  2⤵
  PID:4280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4B^38"
  2⤵
  PID:3564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x55^38"
  2⤵
  PID:4300
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x50^38"
  2⤵
  PID:3108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x45^38"
  2⤵
  PID:4776
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x54^38"
  2⤵
  PID:4996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x52^38"
  2⤵
  PID:3532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1C^38"
  2⤵
  PID:3572
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1C^38"
  2⤵
  PID:4168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x79^38"
  2⤵
  PID:5032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4A^38"
  2⤵
  PID:5040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x55^38"
  2⤵
  PID:4952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x43^38"
  2⤵
  PID:2344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x43^38"
  2⤵
  PID:4440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4D^38"
  2⤵
  PID:4488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0E^38"
  2⤵
  PID:1604
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:3688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:1900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x54^38"
  2⤵
  PID:2312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x13^38"
  2⤵
  PID:2112
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0A^38"
  2⤵
  PID:2488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:4476
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:3768
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:792
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x11^38"
  2⤵
  PID:1480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x17^38"
  2⤵
  PID:628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1F^38"
  2⤵
  PID:1864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:2152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:4460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0A^38"
  2⤵
  PID:4032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:4044
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:1444
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:2688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:388
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0F^38"
  2⤵
  PID:4540
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:4100
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x08^38"
  2⤵
  PID:2444
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x54^38"
  2⤵
  PID:4680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x11^38"
  2⤵
  PID:1668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x5F^38"
  2⤵
  PID:2880
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4B^38"
  2⤵
  PID:392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x55^38"
  2⤵
  PID:1224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x50^38"
  2⤵
  PID:1212
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x45^38"
  2⤵
  PID:1984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x54^38"
  2⤵
  PID:4068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x52^38"
  2⤵
  PID:4940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x08^38"
  2⤵
  PID:3728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x42^38"
  2⤵
  PID:2204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4A^38"
  2⤵
  PID:2524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4A^38"
  2⤵
  PID:5020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1C^38"
  2⤵
  PID:4300
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1C^38"
  2⤵
  PID:4688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x79^38"
  2⤵
  PID:4400
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x54^38"
  2⤵
  PID:4680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x43^38"
  2⤵
  PID:3572
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x47^38"
  2⤵
  PID:2732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x42^38"
  2⤵
  PID:4056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0E^38"
  2⤵
  PID:2028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:2152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x54^38"
  2⤵
  PID:4560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x13^38"
  2⤵
  PID:3288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0A^38"
  2⤵
  PID:4852
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:1232
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:2688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:4976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x54^38"
  2⤵
  PID:4896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x12^38"
  2⤵
  PID:1956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0A^38"
  2⤵
  PID:1600
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:448
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:1668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:4168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1E^38"
  2⤵
  PID:3188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x11^38"
  2⤵
  PID:3048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x12^38"
  2⤵
  PID:4956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1E^38"
  2⤵
  PID:2344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x14^38"
  2⤵
  PID:4068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x15^38"
  2⤵
  PID:2124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x10^38"
  2⤵
  PID:1656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1E^38"
  2⤵
  PID:1444
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0F^38"
  2⤵
  PID:4436
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x5F^38"
  2⤵
  PID:4840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x53^38"
  2⤵
  PID:1392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x55^38"
  2⤵
  PID:940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x43^38"
  2⤵
  PID:3828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x54^38"
  2⤵
  PID:536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x15^38"
  2⤵
  PID:4140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x14^38"
  2⤵
  PID:2880
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1C^38"
  2⤵
  PID:3908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x1C^38"
  2⤵
  PID:3188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x65^38"
  2⤵
  PID:5040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x47^38"
  2⤵
  PID:4956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4A^38"
  2⤵
  PID:2344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4A^38"
  2⤵
  PID:1728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x71^38"
  2⤵
  PID:3524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:2072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x48^38"
  2⤵
  PID:2592
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x42^38"
  2⤵
  PID:4784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x49^38"
  2⤵
  PID:1860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x51^38"
  2⤵
  PID:3504
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x76^38"
  2⤵
  PID:1312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x54^38"
  2⤵
  PID:2036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x49^38"
  2⤵
  PID:5048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x45^38"
  2⤵
  PID:5064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x67^38"
  2⤵
  PID:3184
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0E^38"
  2⤵
  PID:3452
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:2028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:876
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x54^38"
  2⤵
  PID:1408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x12^38"
  2⤵
  PID:4988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:1528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0A^38"
  2⤵
  PID:3372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:3564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:5020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0A^38"
  2⤵
  PID:372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:444
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:4420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:3532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0A^38"
  2⤵
  PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:3876
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:3036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:4344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:1984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0A^38"
  2⤵
  PID:2976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:4356
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x4F^38"
  2⤵
  PID:3288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x06^38"
  2⤵
  PID:4852
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x16^38"
  2⤵
  PID:1484
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x0F^38"
  2⤵
  PID:3556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set /a "0x5F^38"
  2⤵
  PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3724 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsf124C.tmp\System.dll

Filesize
12KB

MD5
12b140583e3273ee1f65016becea58c4

SHA1
92df24d11797fefd2e1f8d29be9dfd67c56c1ada

SHA256
014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042

SHA512
49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf124C.tmp\nsExec.dll

Filesize
6KB

MD5
4a2f4fe4a3ad1de56ee6bf7dd4923963

SHA1
7cc68b94448c964fd99904e5784b059aed4d5daa

SHA256
89b1e6509a1b45b32933e9d785a9c8c5b9ce7c616e1112dcf7fc3fa5ca27ebde

SHA512
4b6bbe75beafae9a29932ff5ddd3940aadfae62c157836e6cdab755955782dd5354d5eb389b4b8c16bf59f4ce7a099a0161d915c1cf2968f28e195dc8e3997ea

Download Submit