32acc283188b9c7578a49f288c7adbc7b33a96bb25bcd03057bda02c0f003be8

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
Size 246KB
Sample240522-sdaz4afc2t
SHA256 32acc283188b9c7578a49f288c7adbc7b33a96bb25bcd03057bda02c0f003be8
MD5 819efcf6f8669243f3ac2ee6dabc9d8f
SHA1 7c14a7a4701066ec8c7e4cceba089dc0b6f3f8be
SHA512 c3b8832488e7702d917331709766bd544df0e10a7efc6aeff37b8105c092e43f4b890e9ac02449d3651b180bafacfb79f354e1651cd25abd849588577763d198
SSDEEP 3072:liFi6z/VXzAf3ocDmvQEMpvbAGrXX24tfUQsxQlseOcIWNI5FM9eYh3W/SmizUOb:UxFSbDAGrn24tAQPI5FohhISOOb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Upward = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Melodisestes\\Kokettens.exe"	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
4764	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1800 set thread context of 4764	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	688

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\Intrust.ini	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2288	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	83
PID 1800 wrote to memory of 2288	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	83
PID 1800 wrote to memory of 2288	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	83
PID 1800 wrote to memory of 2252	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	86
PID 1800 wrote to memory of 2252	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	86
PID 1800 wrote to memory of 2252	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	86
PID 1800 wrote to memory of 2332	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	89
PID 1800 wrote to memory of 2332	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	89
PID 1800 wrote to memory of 2332	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	89
PID 1800 wrote to memory of 3420	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	92
PID 1800 wrote to memory of 3420	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	92
PID 1800 wrote to memory of 3420	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	92
PID 1800 wrote to memory of 440	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	94
PID 1800 wrote to memory of 440	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	94
PID 1800 wrote to memory of 440	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	94
PID 1800 wrote to memory of 4544	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	96
PID 1800 wrote to memory of 4544	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	96
PID 1800 wrote to memory of 4544	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	96
PID 1800 wrote to memory of 4172	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	98
PID 1800 wrote to memory of 4172	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	98
PID 1800 wrote to memory of 4172	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	98
PID 1800 wrote to memory of 2168	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	100
PID 1800 wrote to memory of 2168	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	100
PID 1800 wrote to memory of 2168	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	100
PID 1800 wrote to memory of 3892	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	102
PID 1800 wrote to memory of 3892	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	102
PID 1800 wrote to memory of 3892	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	102
PID 1800 wrote to memory of 4328	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	104
PID 1800 wrote to memory of 4328	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	104
PID 1800 wrote to memory of 4328	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	104
PID 1800 wrote to memory of 2320	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	106
PID 1800 wrote to memory of 2320	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	106
PID 1800 wrote to memory of 2320	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	106
PID 1800 wrote to memory of 2688	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	108
PID 1800 wrote to memory of 2688	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	108
PID 1800 wrote to memory of 2688	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	108
PID 1800 wrote to memory of 1080	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	110
PID 1800 wrote to memory of 1080	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	110
PID 1800 wrote to memory of 1080	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	110
PID 1800 wrote to memory of 4308	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	112
PID 1800 wrote to memory of 4308	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	112
PID 1800 wrote to memory of 4308	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	112
PID 1800 wrote to memory of 2096	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	114
PID 1800 wrote to memory of 2096	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	114
PID 1800 wrote to memory of 2096	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	114
PID 1800 wrote to memory of 3340	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	116
PID 1800 wrote to memory of 3340	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	116
PID 1800 wrote to memory of 3340	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	116
PID 1800 wrote to memory of 4228	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	118
PID 1800 wrote to memory of 4228	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	118
PID 1800 wrote to memory of 4228	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	118
PID 1800 wrote to memory of 1216	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	120
PID 1800 wrote to memory of 1216	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	120
PID 1800 wrote to memory of 1216	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	120
PID 1800 wrote to memory of 1628	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	122
PID 1800 wrote to memory of 1628	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	122
PID 1800 wrote to memory of 1628	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	122
PID 1800 wrote to memory of 2976	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	124
PID 1800 wrote to memory of 2976	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	124
PID 1800 wrote to memory of 2976	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	124
PID 1800 wrote to memory of 1972	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	126
PID 1800 wrote to memory of 1972	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	126
PID 1800 wrote to memory of 1972	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	126
PID 1800 wrote to memory of 2860	1800	swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe	128

C:\Users\Admin\AppData\Local\Temp\swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "250^177"
  2⤵
  PID:2288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:2252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^177"
  2⤵
  PID:2332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "255^177"
  2⤵
  PID:3420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "253^177"
  2⤵
  PID:4544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:4172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "131^177"
  2⤵
  PID:2168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:3892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:4328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "242^177"
  2⤵
  PID:2320
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:2688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:1080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "208^177"
  2⤵
  PID:4308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "197^177"
  2⤵
  PID:2096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:3340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^177"
  2⤵
  PID:4228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:1628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:2976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^177"
  2⤵
  PID:1972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "153^177"
  2⤵
  PID:2860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "220^177"
  2⤵
  PID:1744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:4628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:4548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "133^177"
  2⤵
  PID:2332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:3632
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:4124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "201^177"
  2⤵
  PID:3860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^177"
  2⤵
  PID:4396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:3012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:3800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:4940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:4848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:2252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:4720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3408
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "193^177"
  2⤵
  PID:4348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:4856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:4392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "133^177"
  2⤵
  PID:4864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:4728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2636
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "201^177"
  2⤵
  PID:2252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^177"
  2⤵
  PID:4576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:4908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:4016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:4056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^177"
  2⤵
  PID:3936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1152
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^177"
  2⤵
  PID:1548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "132^177"
  2⤵
  PID:2504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "141^177"
  2⤵
  PID:1528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "250^177"
  2⤵
  PID:116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:4968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^177"
  2⤵
  PID:4812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "255^177"
  2⤵
  PID:4748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:1416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "253^177"
  2⤵
  PID:3756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:4480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "131^177"
  2⤵
  PID:2316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:4684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:5032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "231^177"
  2⤵
  PID:4140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:4092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "197^177"
  2⤵
  PID:556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "196^177"
  2⤵
  PID:3860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "208^177"
  2⤵
  PID:1772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:408
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^177"
  2⤵
  PID:2536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:1924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:1180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "222^177"
  2⤵
  PID:2068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "210^177"
  2⤵
  PID:3224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "153^177"
  2⤵
  PID:2492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:5092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1820
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:5000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "136^177"
  2⤵
  PID:4348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "135^177"
  2⤵
  PID:3544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:1596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "132^177"
  2⤵
  PID:4392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "131^177"
  2⤵
  PID:1696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:3012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^177"
  2⤵
  PID:3276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:2876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "201^177"
  2⤵
  PID:3948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:1532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1820
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:3892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:4120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:4348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:4316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:3936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "201^177"
  2⤵
  PID:1764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "133^177"
  2⤵
  PID:1520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:4308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^177"
  2⤵
  PID:3312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "193^177"
  2⤵
  PID:2976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^177"
  2⤵
  PID:4940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:1380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "128^177"
  2⤵
  PID:3280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "141^177"
  2⤵
  PID:2492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "250^177"
  2⤵
  PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:5092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^177"
  2⤵
  PID:468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "255^177"
  2⤵
  PID:3632
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:2964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "253^177"
  2⤵
  PID:4924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:2624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "131^177"
  2⤵
  PID:1540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:1936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "226^177"
  2⤵
  PID:2096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:2148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "197^177"
  2⤵
  PID:3192
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^177"
  2⤵
  PID:3912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^177"
  2⤵
  PID:2660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "222^177"
  2⤵
  PID:3464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:4576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "223^177"
  2⤵
  PID:4480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "197^177"
  2⤵
  PID:2816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:2368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "153^177"
  2⤵
  PID:3632
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:4924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:2624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "132^177"
  2⤵
  PID:1540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:456
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:60
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "135^177"
  2⤵
  PID:3496
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "134^177"
  2⤵
  PID:3912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "134^177"
  2⤵
  PID:4580
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:5004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1296
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:4780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:4168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^177"
  2⤵
  PID:768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^177"
  2⤵
  PID:4348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:1740
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:1560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "141^177"
  2⤵
  PID:372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "250^177"
  2⤵
  PID:1696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:3008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^177"
  2⤵
  PID:4856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "255^177"
  2⤵
  PID:2876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:1996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "253^177"
  2⤵
  PID:4848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "131^177"
  2⤵
  PID:4764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:2752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:5048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^177"
  2⤵
  PID:4372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:4544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "208^177"
  2⤵
  PID:1732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "213^177"
  2⤵
  PID:1396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^177"
  2⤵
  PID:4684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1072
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:2856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:4512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "153^177"
  2⤵
  PID:2224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:4732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:3012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "132^177"
  2⤵
  PID:3276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:4708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:1932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "128^177"
  2⤵
  PID:2332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:3092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "136^177"
  2⤵
  PID:468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "135^177"
  2⤵
  PID:3632
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:3556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "132^177"
  2⤵
  PID:3620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "131^177"
  2⤵
  PID:1540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^177"
  2⤵
  PID:752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:4396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "155^177"
  2⤵
  PID:1624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1844
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1296
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^177"
  2⤵
  PID:652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^177"
  2⤵
  PID:5000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:1688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:3580
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "141^177"
  2⤵
  PID:2464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "196^177"
  2⤵
  PID:4328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "194^177"
  2⤵
  PID:4904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:1892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:1636
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:4316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "131^177"
  2⤵
  PID:1696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:4840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "242^177"
  2⤵
  PID:4940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "208^177"
  2⤵
  PID:1380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:2952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:3756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "230^177"
  2⤵
  PID:2432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "223^177"
  2⤵
  PID:4372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "213^177"
  2⤵
  PID:5032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "222^177"
  2⤵
  PID:3892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "198^177"
  2⤵
  PID:4800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^177"
  2⤵
  PID:3356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:3232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "222^177"
  2⤵
  PID:4172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "210^177"
  2⤵
  PID:2688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^177"
  2⤵
  PID:380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "153^177"
  2⤵
  PID:880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:3272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "128^177"
  2⤵
  PID:1728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:4988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3844
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:4480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:4684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:4624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1740
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:3340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^177"
  2⤵
  PID:1928
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "141^177"
  2⤵
  PID:1728
- C:\Users\Admin\AppData\Local\Temp\swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz513F.tmp\System.dll
Size 12KB
SHA256 c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
MD5 792b6f86e296d3904285b2bf67ccd7e0
SHA1 966b16f84697552747e0ddd19a4ba8ab5083af31
SHA512 97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
SSDEEP 192:rFiQJ771Jt17C8F1A5xjGNNvgFOiLb7lrT/L93:X71Jt48F2eNvgFF/L
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz513F.tmp\nsExec.dll
Size 6KB
SHA256 10675f13abaee592f14382349aa35d82fb52aab4e27eef61d0c83dec1f6b73da
MD5 5aa38904acdcc21a2fb8a1d30a72d92f
SHA1 a9ce7d1456698921791db91347dba0489918d70c
SHA512 f04740da561d7cd0dea5e839c9e1c339d4a3e63944d3566c94c921a3d170a69918a32dff3f3b43f13d55cc25a2dbb4c21104f062c324308ac5104179766402a3
SSDEEP 96:AOBtEB2flLkatAthPZJoi9jpfW/er6cBbcB/NFyVOHd0+uHwEX:AhB2flXAVJtjf6cBbcB/N8Ved0PZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Intrust.ini

Path C:\Windows\Resources\0409\Intrust.ini
Size 32B
SHA256 b161c9d728ffba141254dc4d45978d8111ea32db09318317804ef0367c0935e7
MD5 cf54629b02ee2eb2a9a315c344b547c9
SHA1 96092d008cc931376949ed1591c5f5439bea8465
SHA512 dcd2311ec3e1d6f14d36bb5ac00afe9f0afdce796286a3a3cd4abfcb5901399543d97600d25968b3ad1b440095632defbcf928fdd526133a547bd2551c200052
MD5 SHA1 SHA512

Submit Download

memory/1800-764-0x0000000074AE5000-0x0000000074AE6000-memory.dmp

Download

memory/4764-766-0x0000000000450000-0x00000000016A4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads