b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df

General

Target

b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
Size

431KB
MD5

07cbab426f1bc77ca5d0f6a8fc1c9b4b
SHA1

70dc25df196c9bd87c2add428dc86b5f272eb15c
SHA256

b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df
SHA512

a53c41aa20e76b7ee3baaa08aee3a4aa5361314a677ca753f68e1aca607fc8c8fdb3ab4f932991662976db2e1e30b5632bb7ebc5c12aa24dcb6703b5f311c9d7
SSDEEP

12288:Q0pZnHL9jAT8mU07ijSq/X7/8omMZ8LliOPZx:Q0pZnrhVG7imq/TdmMZ8Dx

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 64 IoCs

Processes:

b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

pid	process
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

3 drive.google.com
5 drive.google.com

flow	ioc
3	drive.google.com
5	drive.google.com

Drops file in System32 directory 1 IoCs

Processes:

b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\undergrundslitteraturernes\warstlers.ini	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

pid process

1088 b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

pid	process
1088	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exeb7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

pid	process
2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
1088	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

description	pid	process	target process
PID 2052 set thread context of 1088	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

Drops file in Windows directory 1 IoCs

Processes:

b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

description ioc process

File opened for modification C:\Windows\Fonts\starflower.thu b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3028 1088 WerFault.exe b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

pid process

1088 b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

pid process

2052 b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

description	ioc	process
File opened for modification	C:\Windows\Fonts\starflower.thu	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

pid	pid_target	process	target process
3028	1088	WerFault.exe	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

pid	process
1088	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe

description	pid	process	target process
PID 2052 wrote to memory of 2912	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2912	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2912	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2912	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2964	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2964	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2964	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2964	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 1808	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 1808	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 1808	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 1808	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2716	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2716	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2716	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2716	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2720	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2720	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2720	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2720	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2852	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2852	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2852	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2852	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2832	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2832	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2832	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2832	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2656	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2656	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2656	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2656	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2744	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2744	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2744	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2744	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2420	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2420	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2420	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2420	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2164	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2164	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2164	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2164	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 1052	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 1052	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 1052	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 1052	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2208	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2208	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2208	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2208	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 1088	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 1088	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 1088	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 1088	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 1328	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 1328	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 1328	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 1328	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2196	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2196	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2196	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe
PID 2052 wrote to memory of 2196	2052	b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
"C:\Users\Admin\AppData\Local\Temp\b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2052

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x53^38"
2⤵
PID:2912

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
2⤵
PID:2964

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
2⤵
PID:1808

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:2716

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
2⤵
PID:2720

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
2⤵
PID:2852

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:2832

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:2656

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x75^38"
2⤵
PID:2744

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4E^38"
2⤵
PID:2420

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
2⤵
PID:2164

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x51^38"
2⤵
PID:1052

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x71^38"
2⤵
PID:2208

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:1088

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x48^38"
2⤵
PID:1328

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
2⤵
PID:2196

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
2⤵
PID:2580

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x51^38"
2⤵
PID:1968

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
2⤵
PID:2508

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2908

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:2620

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
2⤵
PID:2236

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:2348

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:332

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:1620

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
2⤵
PID:1592

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
2⤵
PID:2336

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
2⤵
PID:2864

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
2⤵
PID:2240

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x50^38"
2⤵
PID:960

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
2⤵
PID:2032

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:2012

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
2⤵
PID:2432

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
2⤵
PID:344

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
2⤵
PID:2260

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:888

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:2360

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:2104

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:2152

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x79^38"
2⤵
PID:2968

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
2⤵
PID:2996

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x56^38"
2⤵
PID:3020

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
2⤵
PID:2752

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x48^38"
2⤵
PID:2856

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
2⤵
PID:2556

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
2⤵
PID:2836

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2568

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:2532

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
2⤵
PID:2688

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:2080

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:1916

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:1640

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:1388

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:1216

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:1608

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
2⤵
PID:2204

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
2⤵
PID:1904

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:2412

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:376

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:2820

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:2148

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:3028

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2280

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:688

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:1476

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
2⤵
PID:1428

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x17^38"
2⤵
PID:1132

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:2876

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:1744

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
2⤵
PID:1540

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:772

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
2⤵
PID:2028

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:2044

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
2⤵
PID:3016

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
2⤵
PID:2976

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x6D^38"
2⤵
PID:984

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x63^38"
2⤵
PID:2260

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x74^38"
2⤵
PID:1736

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x68^38"
2⤵
PID:2988

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x63^38"
2⤵
PID:1628

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x6A^38"
2⤵
PID:2896

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
2⤵
PID:2180

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
2⤵
PID:2844

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:3048

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:2668

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x70^38"
2⤵
PID:2764

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2856

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:2804

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
2⤵
PID:2704

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x53^38"
2⤵
PID:2740

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x47^38"
2⤵
PID:2552

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:2972

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x67^38"
2⤵
PID:2164

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:1912

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:2000

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
2⤵
PID:1960

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
2⤵
PID:1568

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x63^38"
2⤵
PID:1236

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
2⤵
PID:1328

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
2⤵
PID:2200

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:1964

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:908

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0B^38"
2⤵
PID:2608

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x17^38"
2⤵
PID:2696

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:2404

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2268

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2616

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2280

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:688

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:580

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:1492

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2492

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
2⤵
PID:2872

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
2⤵
PID:2864

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
2⤵
PID:1540

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
2⤵
PID:772

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
2⤵
PID:2028

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
2⤵
PID:2044

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x10^38"
2⤵
PID:3016

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
2⤵
PID:2976

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:2328

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:1704

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2088

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:1680

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:1284

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
2⤵
PID:2840

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
2⤵
PID:2916

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:2964

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:2628

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:812

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:2648

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2372

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2760

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:1956

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x10^38"
2⤵
PID:2576

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
2⤵
PID:2532

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
2⤵
PID:2592

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x56^38"
2⤵
PID:2484

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
2⤵
PID:1424

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:2208

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
2⤵
PID:1952

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
2⤵
PID:1180

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
2⤵
PID:632

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
2⤵
PID:1608

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x50^38"
2⤵
PID:1976

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
2⤵
PID:1904

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:1968

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
2⤵
PID:2508

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:2824

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:2292

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x79^38"
2⤵
PID:2256

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:676

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
2⤵
PID:1040

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
2⤵
PID:1620

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
2⤵
PID:2496

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4D^38"
2⤵
PID:1524

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
2⤵
PID:2884

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:1368

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:1648

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:960

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
2⤵
PID:2284

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:1000

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2436

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2124

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2860

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
2⤵
PID:1496

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x17^38"
2⤵
PID:2888

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1F^38"
2⤵
PID:1584

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:2100

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:760

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:2920

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2928

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:1796

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2992

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:2736

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
2⤵
PID:2644

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2852

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
2⤵
PID:2832

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:2692

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
2⤵
PID:2516

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
2⤵
PID:2640

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
2⤵
PID:2944

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
2⤵
PID:1972

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x50^38"
2⤵
PID:1436

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
2⤵
PID:1640

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:1312

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
2⤵
PID:852

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
2⤵
PID:1996

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
2⤵
PID:1184

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:1624

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:1964

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:908

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:2608

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x79^38"
2⤵
PID:2696

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:2148

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
2⤵
PID:2236

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x47^38"
2⤵
PID:768

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
2⤵
PID:332

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
2⤵
PID:1096

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:1812

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:448

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:1132

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
2⤵
PID:2876

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:1744

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:1540

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2424

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:592

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:828

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
2⤵
PID:2116

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:2232

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:3056

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:1740

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:1560

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
2⤵
PID:2360

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
2⤵
PID:2104

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
2⤵
PID:2780

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
2⤵
PID:2996

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
2⤵
PID:900

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
2⤵
PID:2716

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x10^38"
2⤵
PID:2652

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
2⤵
PID:2636

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
2⤵
PID:2548

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
2⤵
PID:2712

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x53^38"
2⤵
PID:3004

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
2⤵
PID:2684

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
2⤵
PID:2520

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:2936

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
2⤵
PID:2484

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
2⤵
PID:1336

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:1920

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:2756

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x65^38"
2⤵
PID:2324

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x47^38"
2⤵
PID:2004

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:1932

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:1976

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x71^38"
2⤵
PID:1904

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:696

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x48^38"
2⤵
PID:1756

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
2⤵
PID:2800

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
2⤵
PID:2064

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x51^38"
2⤵
PID:3028

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x76^38"
2⤵
PID:348

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:484

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
2⤵
PID:1724

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
2⤵
PID:2496

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x67^38"
2⤵
PID:1524

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
2⤵
PID:2884

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:1344

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:1340

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:268

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
2⤵
PID:792

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:836

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:1056

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:1604

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:1764

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:2296

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:1728

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:1584

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:1392

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:1580

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:2896

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2180

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2624

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2748

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:2672

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:3044

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2544

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2632

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2692

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:2516

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
2⤵
PID:2540

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
2⤵
PID:2972

C:\Users\Admin\AppData\Local\Temp\b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
"C:\Users\Admin\AppData\Local\Temp\b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe"
2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 68
3⤵
- Program crash
PID:3028

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst23A8.tmp\System.dll
Filesize
12KB

MD5
12b140583e3273ee1f65016becea58c4

SHA1
92df24d11797fefd2e1f8d29be9dfd67c56c1ada

SHA256
014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042

SHA512
49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a

Download Submit
\Users\Admin\AppData\Local\Temp\nst23A8.tmp\nsExec.dll
Filesize
6KB

MD5
4a2f4fe4a3ad1de56ee6bf7dd4923963

SHA1
7cc68b94448c964fd99904e5784b059aed4d5daa

SHA256
89b1e6509a1b45b32933e9d785a9c8c5b9ce7c616e1112dcf7fc3fa5ca27ebde

SHA512
4b6bbe75beafae9a29932ff5ddd3940aadfae62c157836e6cdab755955782dd5354d5eb389b4b8c16bf59f4ce7a099a0161d915c1cf2968f28e195dc8e3997ea

Download Submit
memory/1088-895-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1088-917-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1088-918-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1088-919-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1088-920-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1088-921-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1088-922-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads