guloader | e4eae60e94508ef4d6d731be014afe6dd143b5b683e4cd9459d84db208249648

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SCAN00381638.vbe
Size 646KB
Sample240625-cc2tesxgrq
SHA256 411d7a0d9d268daa710bbd8af48825e3227be7ed743c50c68afc05b71a940e83
MD5 877d62bb0a3ca04372a89f1fd63aa517
SHA1 abb9619743f94df8ee35bcb29e08a33f49acc91a
SHA512 072e1b5ebf6aa76ee374d94b5d9f066c3f2c922808a646768234bf8cae9c62b55a82fa4e18ab860f7ffb5b31a625619991feaa3a82bc8fc7a3712b38cbbcf7ae
SSDEEP 12288:NuXAeUMRwhbVmNmN7wNL4NBN3rNrx9V0NnNcN/v3gRN6fyNMNIN3NLojSAfp+J1/:T4Rwhb79SyV7R1AIJTaud62Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection downloader persistence spyware stealer

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Detects executables built or packed with MPress PE compressor 15 IoCs

resource	yara_rule
behavioral2/memory/2520-1369-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1656-1370-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/808-1372-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1656-1368-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2520-1367-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/808-1378-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/808-1380-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/808-1377-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1656-1366-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2520-1362-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1656-1363-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2520-1383-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2868-1386-0x0000000034170000-0x0000000034189000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2868-1390-0x0000000034170000-0x0000000034189000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2868-1389-0x0000000034170000-0x0000000034189000-memory.dmp	INDICATOR_EXE_Packed_MPress

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/memory/1656-1370-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/1656-1368-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/memory/1656-1370-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/1656-1368-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/1656-1370-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/1656-1368-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2520-1367-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/2520-1383-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

resource	yara_rule
behavioral2/memory/1656-1370-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/1656-1368-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2520-1367-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/808-1378-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/808-1380-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2520-1383-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	x.exe

Executes dropped EXE 5 IoCs

pid	Process
1788	x.exe
4140	QQ.exe
2520	QQ.exe
1656	QQ.exe
808	QQ.exe

Loads dropped DLL 64 IoCs

pid	Process
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe
1788	x.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	QQ.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-R6CJUW = "\"C:\\Users\\Admin\\AppData\\Roaming\\QQ\\QQ.exe\""	QQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-R6CJUW = "\"C:\\Users\\Admin\\AppData\\Roaming\\QQ\\QQ.exe\""	QQ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-R6CJUW = "\"C:\\Users\\Admin\\AppData\\Roaming\\QQ\\QQ.exe\""	x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-R6CJUW = "\"C:\\Users\\Admin\\AppData\\Roaming\\QQ\\QQ.exe\""	x.exe

Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs

pid	Process
3544	x.exe
3544	x.exe
2868	QQ.exe
2868	QQ.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1788	x.exe
3544	x.exe
4140	QQ.exe
2868	QQ.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1788 set thread context of 3544	1788	x.exe	634
PID 4140 set thread context of 2868	4140	QQ.exe	1180
PID 2868 set thread context of 2520	2868	QQ.exe	1181
PID 2868 set thread context of 1656	2868	QQ.exe	1182
PID 2868 set thread context of 808	2868	QQ.exe	1183

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\sanitetstjenesten.par	QQ.exe
File opened for modification	C:\Windows\resources\gokke\empacket.bru	x.exe
File opened for modification	C:\Windows\resources\Informationssgningers.par	x.exe
File opened for modification	C:\Windows\Fonts\sanitetstjenesten.par	x.exe
File opened for modification	C:\Windows\resources\gokke\empacket.bru	QQ.exe
File opened for modification	C:\Windows\resources\Informationssgningers.par	QQ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2520	QQ.exe
2520	QQ.exe
808	QQ.exe
808	QQ.exe
2520	QQ.exe
2520	QQ.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1788	x.exe
4140	QQ.exe
2868	QQ.exe
2868	QQ.exe
2868	QQ.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	808	QQ.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2868	QQ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 1788	4312	WScript.exe	80
PID 4312 wrote to memory of 1788	4312	WScript.exe	80
PID 4312 wrote to memory of 1788	4312	WScript.exe	80
PID 1788 wrote to memory of 2508	1788	x.exe	85
PID 1788 wrote to memory of 2508	1788	x.exe	85
PID 1788 wrote to memory of 2508	1788	x.exe	85
PID 1788 wrote to memory of 5104	1788	x.exe	87
PID 1788 wrote to memory of 5104	1788	x.exe	87
PID 1788 wrote to memory of 5104	1788	x.exe	87
PID 1788 wrote to memory of 4540	1788	x.exe	89
PID 1788 wrote to memory of 4540	1788	x.exe	89
PID 1788 wrote to memory of 4540	1788	x.exe	89
PID 1788 wrote to memory of 4780	1788	x.exe	91
PID 1788 wrote to memory of 4780	1788	x.exe	91
PID 1788 wrote to memory of 4780	1788	x.exe	91
PID 1788 wrote to memory of 4640	1788	x.exe	93
PID 1788 wrote to memory of 4640	1788	x.exe	93
PID 1788 wrote to memory of 4640	1788	x.exe	93
PID 1788 wrote to memory of 3660	1788	x.exe	95
PID 1788 wrote to memory of 3660	1788	x.exe	95
PID 1788 wrote to memory of 3660	1788	x.exe	95
PID 1788 wrote to memory of 2208	1788	x.exe	97
PID 1788 wrote to memory of 2208	1788	x.exe	97
PID 1788 wrote to memory of 2208	1788	x.exe	97
PID 1788 wrote to memory of 4516	1788	x.exe	99
PID 1788 wrote to memory of 4516	1788	x.exe	99
PID 1788 wrote to memory of 4516	1788	x.exe	99
PID 1788 wrote to memory of 5092	1788	x.exe	101
PID 1788 wrote to memory of 5092	1788	x.exe	101
PID 1788 wrote to memory of 5092	1788	x.exe	101
PID 1788 wrote to memory of 4932	1788	x.exe	103
PID 1788 wrote to memory of 4932	1788	x.exe	103
PID 1788 wrote to memory of 4932	1788	x.exe	103
PID 1788 wrote to memory of 3068	1788	x.exe	105
PID 1788 wrote to memory of 3068	1788	x.exe	105
PID 1788 wrote to memory of 3068	1788	x.exe	105
PID 1788 wrote to memory of 3432	1788	x.exe	107
PID 1788 wrote to memory of 3432	1788	x.exe	107
PID 1788 wrote to memory of 3432	1788	x.exe	107
PID 1788 wrote to memory of 3532	1788	x.exe	109
PID 1788 wrote to memory of 3532	1788	x.exe	109
PID 1788 wrote to memory of 3532	1788	x.exe	109
PID 1788 wrote to memory of 3408	1788	x.exe	111
PID 1788 wrote to memory of 3408	1788	x.exe	111
PID 1788 wrote to memory of 3408	1788	x.exe	111
PID 1788 wrote to memory of 4704	1788	x.exe	113
PID 1788 wrote to memory of 4704	1788	x.exe	113
PID 1788 wrote to memory of 4704	1788	x.exe	113
PID 1788 wrote to memory of 640	1788	x.exe	115
PID 1788 wrote to memory of 640	1788	x.exe	115
PID 1788 wrote to memory of 640	1788	x.exe	115
PID 1788 wrote to memory of 2476	1788	x.exe	117
PID 1788 wrote to memory of 2476	1788	x.exe	117
PID 1788 wrote to memory of 2476	1788	x.exe	117
PID 1788 wrote to memory of 4400	1788	x.exe	119
PID 1788 wrote to memory of 4400	1788	x.exe	119
PID 1788 wrote to memory of 4400	1788	x.exe	119
PID 1788 wrote to memory of 1832	1788	x.exe	122
PID 1788 wrote to memory of 1832	1788	x.exe	122
PID 1788 wrote to memory of 1832	1788	x.exe	122
PID 1788 wrote to memory of 60	1788	x.exe	124
PID 1788 wrote to memory of 60	1788	x.exe	124
PID 1788 wrote to memory of 60	1788	x.exe	124
PID 1788 wrote to memory of 876	1788	x.exe	126

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SCAN00381638.vbe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x53^38"
    3⤵
    PID:2508
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x55^38"
    3⤵
    PID:5104
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x43^38"
    3⤵
    PID:4540
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:4780
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x15^38"
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:3660
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:2208
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x75^38"
    3⤵
    PID:5092
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4E^38"
    3⤵
    PID:4932
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x49^38"
    3⤵
    PID:3068
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x51^38"
    3⤵
    PID:3432
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x71^38"
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x48^38"
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x42^38"
    3⤵
    PID:640
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x49^38"
    3⤵
    PID:2476
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x51^38"
    3⤵
    PID:4400
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0E^38"
    3⤵
    PID:1832
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:60
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:876
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x11^38"
    3⤵
    PID:3052
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:3748
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:4720
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0F^38"
    3⤵
    PID:4776
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5F^38"
    3⤵
    PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4B^38"
    3⤵
    PID:5020
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x55^38"
    3⤵
    PID:220
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x50^38"
    3⤵
    PID:4004
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x45^38"
    3⤵
    PID:1996
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:1300
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x52^38"
    3⤵
    PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x08^38"
    3⤵
    PID:2980
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x42^38"
    3⤵
    PID:3744
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:3044
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:3944
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:4140
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x79^38"
    3⤵
    PID:1228
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x49^38"
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x56^38"
    3⤵
    PID:756
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x43^38"
    3⤵
    PID:3132
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x48^38"
    3⤵
    PID:4676
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0E^38"
    3⤵
    PID:1276
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4B^38"
    3⤵
    PID:4204
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:5048
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:2228
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1192
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:3660
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:3240
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5E^38"
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1E^38"
    3⤵
    PID:1012
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:1748
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2576
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:3880
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:1556
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5E^38"
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x17^38"
    3⤵
    PID:5052
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:4392
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0F^38"
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:1280
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x08^38"
    3⤵
    PID:1920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:4420
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x13^38"
    3⤵
    PID:2816
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5F^38"
    3⤵
    PID:5072
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x6D^38"
    3⤵
    PID:4180
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x63^38"
    3⤵
    PID:5092
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x74^38"
    3⤵
    PID:3304
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x68^38"
    3⤵
    PID:3368
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x63^38"
    3⤵
    PID:1652
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x6A^38"
    3⤵
    PID:4104
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x15^38"
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:3140
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x70^38"
    3⤵
    PID:1860
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:3036
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:3556
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x52^38"
    3⤵
    PID:740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x53^38"
    3⤵
    PID:3384
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x47^38"
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:4392
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x67^38"
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:5116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:5060
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x49^38"
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x45^38"
    3⤵
    PID:1428
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x63^38"
    3⤵
    PID:2020
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5E^38"
    3⤵
    PID:3288
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0E^38"
    3⤵
    PID:4436
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1088
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0B^38"
    3⤵
    PID:4304
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x17^38"
    3⤵
    PID:1420
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:688
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1080
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2572
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:4604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:1536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:1092
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:4876
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:4720
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x15^38"
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x11^38"
    3⤵
    PID:4776
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:4076
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x13^38"
    3⤵
    PID:212
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x17^38"
    3⤵
    PID:1280
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:5004
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:2192
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:4900
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:1300
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2428
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:1560
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5E^38"
    3⤵
    PID:3744
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x15^38"
    3⤵
    PID:2092
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:3712
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:2232
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:2352
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:4788
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1064
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1292
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x10^38"
    3⤵
    PID:4528
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:4808
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0F^38"
    3⤵
    PID:5100
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x56^38"
    3⤵
    PID:4892
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x08^38"
    3⤵
    PID:656
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:4376
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5F^38"
    3⤵
    PID:5116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4B^38"
    3⤵
    PID:3704
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x55^38"
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x50^38"
    3⤵
    PID:1428
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x45^38"
    3⤵
    PID:2020
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:1340
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x52^38"
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:4584
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x79^38"
    3⤵
    PID:4480
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:3432
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x55^38"
    3⤵
    PID:1420
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x43^38"
    3⤵
    PID:688
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x43^38"
    3⤵
    PID:3988
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4D^38"
    3⤵
    PID:4644
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0E^38"
    3⤵
    PID:4604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:3464
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:1092
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x13^38"
    3⤵
    PID:1276
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:464
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1052
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:4380
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:5104
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x11^38"
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x17^38"
    3⤵
    PID:2240
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1F^38"
    3⤵
    PID:3740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:5004
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:936
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:4896
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2472
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:684
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:4192
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0F^38"
    3⤵
    PID:548
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x08^38"
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:4140
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x11^38"
    3⤵
    PID:4344
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5F^38"
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4B^38"
    3⤵
    PID:756
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x55^38"
    3⤵
    PID:3488
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x50^38"
    3⤵
    PID:4052
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x45^38"
    3⤵
    PID:1556
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:4448
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x52^38"
    3⤵
    PID:4836
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x08^38"
    3⤵
    PID:4692
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x42^38"
    3⤵
    PID:1852
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:208
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x79^38"
    3⤵
    PID:5008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:316
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x43^38"
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x47^38"
    3⤵
    PID:1940
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x42^38"
    3⤵
    PID:3632
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0E^38"
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:3744
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:3668
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:2484
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x13^38"
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:4796
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:4328
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:4932
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:4656
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:3880
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:1288
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:4156
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:656
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:1684
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x15^38"
    3⤵
    PID:888
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x11^38"
    3⤵
    PID:4816
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:876
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:220
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x13^38"
    3⤵
    PID:1996
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x17^38"
    3⤵
    PID:2208
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:944
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0F^38"
    3⤵
    PID:3608
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5F^38"
    3⤵
    PID:3492
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x53^38"
    3⤵
    PID:3692
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x55^38"
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x43^38"
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:3224
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x15^38"
    3⤵
    PID:3988
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:1144
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x65^38"
    3⤵
    PID:388
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x47^38"
    3⤵
    PID:2372
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:900
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:3136
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x71^38"
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:4784
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x48^38"
    3⤵
    PID:1532
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x42^38"
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x49^38"
    3⤵
    PID:372
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x51^38"
    3⤵
    PID:4732
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x76^38"
    3⤵
    PID:5060
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x49^38"
    3⤵
    PID:4664
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x45^38"
    3⤵
    PID:2224
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x67^38"
    3⤵
    PID:1604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0E^38"
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:5096
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2732
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:2484
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:4788
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:4028
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:632
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:4528
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:1072
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:4048
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:464
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:4776
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:4784
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:1532
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:372
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:1808
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2816
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:4908
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:3840
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0F^38"
    3⤵
    PID:3632
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5F^38"
    3⤵
    PID:3492
- - C:\Users\Admin\AppData\Local\Temp\x.exe
    "C:\Users\Admin\AppData\Local\Temp\x.exe"
    3⤵
    - Checks computer location settings
    - Adds Run key to start application
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3544
  - - C:\Users\Admin\AppData\Roaming\QQ\QQ.exe
      "C:\Users\Admin\AppData\Roaming\QQ\QQ.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious behavior: MapViewOfSection
      PID:4140
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x53^38"
        5⤵
        
        PID:1276
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x55^38"
        5⤵
        
        PID:5088
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x43^38"
        5⤵
        
        PID:1052
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x54^38"
        5⤵
        
        PID:4540
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x15^38"
        5⤵
        
        PID:4076
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x14^38"
        5⤵
        
        PID:3400
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x1C^38"
        5⤵
        
        PID:4832
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x1C^38"
        5⤵
        
        PID:1192
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x75^38"
        5⤵
        
        PID:1112
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4E^38"
        5⤵
        
        PID:3836
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x49^38"
        5⤵
        
        PID:3416
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x51^38"
        5⤵
        
        PID:3356
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x71^38"
        5⤵
        
        PID:2980
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:3528
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x48^38"
        5⤵
        
        PID:4100
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x42^38"
        5⤵
        
        PID:3068
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x49^38"
        5⤵
        
        PID:1084
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x51^38"
        5⤵
        
        PID:1788
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0E^38"
        5⤵
        
        PID:4104
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:4644
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x54^38"
        5⤵
        
        PID:3116
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x11^38"
        5⤵
        
        PID:3020
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0A^38"
        5⤵
        
        PID:2448
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:3232
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:3784
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0F^38"
        5⤵
        
        PID:748
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x5F^38"
        5⤵
        
        PID:2272
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4B^38"
        5⤵
        
        PID:952
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x55^38"
        5⤵
        
        PID:4776
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x50^38"
        5⤵
        
        PID:4076
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x45^38"
        5⤵
        
        PID:3740
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x54^38"
        5⤵
        
        PID:2508
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x52^38"
        5⤵
        
        PID:2020
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x08^38"
        5⤵
        
        PID:3564
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x42^38"
        5⤵
        
        PID:1716
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4A^38"
        5⤵
        
        PID:3288
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4A^38"
        5⤵
        
        PID:1612
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x1C^38"
        5⤵
        
        PID:968
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x1C^38"
        5⤵
        
        PID:3376
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x79^38"
        5⤵
        
        PID:1004
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x49^38"
        5⤵
        
        PID:4840
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x56^38"
        5⤵
        
        PID:4196
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x43^38"
        5⤵
        
        PID:3496
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x48^38"
        5⤵
        
        PID:4104
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0E^38"
        5⤵
        
        PID:3240
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4B^38"
        5⤵
        
        PID:4932
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:2576
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x54^38"
        5⤵
        
        PID:3880
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x12^38"
        5⤵
        
        PID:628
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0A^38"
        5⤵
        
        PID:5052
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:1828
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:1432
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:2244
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:2108
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:2512
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x5E^38"
        5⤵
        
        PID:5116
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x1E^38"
        5⤵
        
        PID:876
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:220
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:4464
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:3164
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0A^38"
        5⤵
        
        PID:2224
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:1244
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:1636
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:3492
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:2468
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x5E^38"
        5⤵
        
        PID:2340
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x17^38"
        5⤵
        
        PID:2140
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:4036
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:1560
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0F^38"
        5⤵
        
        PID:2488
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:3488
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x08^38"
        5⤵
        
        PID:4052
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x54^38"
        5⤵
        
        PID:2576
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x13^38"
        5⤵
        
        PID:3880
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x5F^38"
        5⤵
        
        PID:628
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x6D^38"
        5⤵
        
        PID:3136
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x63^38"
        5⤵
        
        PID:1828
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x74^38"
        5⤵
        
        PID:1432
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x68^38"
        5⤵
        
        PID:3312
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x63^38"
        5⤵
        
        PID:224
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x6A^38"
        5⤵
        
        PID:3400
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x15^38"
        5⤵
        
        PID:3032
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x14^38"
        5⤵
        
        PID:2144
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x1C^38"
        5⤵
        
        PID:1996
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x1C^38"
        5⤵
        
        PID:2208
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x70^38"
        5⤵
        
        PID:4180
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:2044
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x54^38"
        5⤵
        
        PID:3548
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x52^38"
        5⤵
        
        PID:4192
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x53^38"
        5⤵
        
        PID:4940
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x47^38"
        5⤵
        
        PID:3756
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4A^38"
        5⤵
        
        PID:4564
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x67^38"
        5⤵
        
        PID:536
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4A^38"
        5⤵
        
        PID:2352
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4A^38"
        5⤵
        
        PID:4104
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x49^38"
        5⤵
        
        PID:2488
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x45^38"
        5⤵
        
        PID:3488
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x63^38"
        5⤵
        
        PID:4052
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x5E^38"
        5⤵
        
        PID:2576
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0E^38"
        5⤵
        
        PID:3880
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:628
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:4468
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0B^38"
        5⤵
        
        PID:1828
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x17^38"
        5⤵
        
        PID:3116
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0A^38"
        5⤵
        
        PID:4596
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:4044
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:4132
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:5004
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:2020
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0A^38"
        5⤵
        
        PID:3564
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:1716
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:3044
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x14^38"
        5⤵
        
        PID:2204
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x15^38"
        5⤵
        
        PID:956
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x11^38"
        5⤵
        
        PID:60
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x12^38"
        5⤵
        
        PID:1748
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x12^38"
        5⤵
        
        PID:688
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x13^38"
        5⤵
        
        PID:2864
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x17^38"
        5⤵
        
        PID:3496
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x14^38"
        5⤵
        
        PID:1728
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0A^38"
        5⤵
        
        PID:3940
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:1292
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:2568
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:2372
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:2012
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x5E^38"
        5⤵
        
        PID:2852
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x15^38"
        5⤵
        
        PID:4508
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:4424
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:5064
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:624
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0A^38"
        5⤵
        
        PID:1344
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:4420
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:2812
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:3716
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x10^38"
        5⤵
        
        PID:1300
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x12^38"
        5⤵
        
        PID:2436
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0F^38"
        5⤵
        
        PID:2208
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x56^38"
        5⤵
        
        PID:4180
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x08^38"
        5⤵
        
        PID:4544
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x54^38"
        5⤵
        
        PID:548
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x12^38"
        5⤵
        
        PID:4192
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x5F^38"
        5⤵
        
        PID:4940
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4B^38"
        5⤵
        
        PID:3372
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x55^38"
        5⤵
        
        PID:2592
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x50^38"
        5⤵
        
        PID:4704
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x45^38"
        5⤵
        
        PID:736
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x54^38"
        5⤵
        
        PID:1268
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x52^38"
        5⤵
        
        PID:4400
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x1C^38"
        5⤵
        
        PID:1544
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x1C^38"
        5⤵
        
        PID:2624
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x79^38"
        5⤵
        
        PID:4500
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4A^38"
        5⤵
        
        PID:4808
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x55^38"
        5⤵
        
        PID:3144
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x43^38"
        5⤵
        
        PID:4696
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x43^38"
        5⤵
        
        PID:4468
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4D^38"
        5⤵
        
        PID:2228
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0E^38"
        5⤵
        
        PID:3200
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:4596
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:4044
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x54^38"
        5⤵
        
        PID:4332
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x13^38"
        5⤵
        
        PID:2792
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0A^38"
        5⤵
        
        PID:2428
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:3836
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:4516
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:2520
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x11^38"
        5⤵
        
        PID:3840
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x17^38"
        5⤵
        
        PID:4512
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x1F^38"
        5⤵
        
        PID:3492
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:3600
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:3540
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0A^38"
        5⤵
        
        PID:3372
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:2592
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:4704
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:736
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:1268
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0F^38"
        5⤵
        
        PID:4400
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:1544
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x08^38"
        5⤵
        
        PID:5100
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x54^38"
        5⤵
        
        PID:1276
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x11^38"
        5⤵
        
        PID:4808
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x5F^38"
        5⤵
        
        PID:3144
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4B^38"
        5⤵
        
        PID:2908
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x55^38"
        5⤵
        
        PID:5104
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x50^38"
        5⤵
        
        PID:2240
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x45^38"
        5⤵
        
        PID:1532
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x54^38"
        5⤵
        
        PID:2136
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x52^38"
        5⤵
        
        PID:936
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x08^38"
        5⤵
        
        PID:1112
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x42^38"
        5⤵
        
        PID:3708
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4A^38"
        5⤵
        
        PID:4464
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4A^38"
        5⤵
        
        PID:4852
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x1C^38"
        5⤵
        
        PID:1248
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x1C^38"
        5⤵
        
        PID:3356
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x79^38"
        5⤵
        
        PID:4544
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x54^38"
        5⤵
        
        PID:548
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x43^38"
        5⤵
        
        PID:4192
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x47^38"
        5⤵
        
        PID:4940
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x42^38"
        5⤵
        
        PID:4672
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0E^38"
        5⤵
        
        PID:4728
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:1444
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:2780
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x54^38"
        5⤵
        
        PID:4588
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x13^38"
        5⤵
        
        PID:4104
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0A^38"
        5⤵
        
        PID:2488
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:2624
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:4500
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:2576
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x54^38"
        5⤵
        
        PID:2752
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x12^38"
        5⤵
        
        PID:4660
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0A^38"
        5⤵
        
        PID:4504
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:1432
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:3312
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:1408
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x14^38"
        5⤵
        
        PID:3688
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x15^38"
        5⤵
        
        PID:4348
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x11^38"
        5⤵
        
        PID:2616
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x12^38"
        5⤵
        
        PID:3536
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x12^38"
        5⤵
        
        PID:1720
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x13^38"
        5⤵
        
        PID:4480
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x17^38"
        5⤵
        
        PID:4008
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x14^38"
        5⤵
        
        PID:3168
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0F^38"
        5⤵
        
        PID:1340
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x5F^38"
        5⤵
        
        PID:3808
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x53^38"
        5⤵
        
        PID:688
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x55^38"
        5⤵
        
        PID:5000
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x43^38"
        5⤵
        
        PID:680
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x54^38"
        5⤵
        
        PID:1592
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x15^38"
        5⤵
        
        PID:3240
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x14^38"
        5⤵
        
        PID:4644
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x1C^38"
        5⤵
        
        PID:4928
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x1C^38"
        5⤵
        
        PID:3028
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x65^38"
        5⤵
        
        PID:3396
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x47^38"
        5⤵
        
        PID:1372
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4A^38"
        5⤵
        
        PID:2052
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4A^38"
        5⤵
        
        PID:4156
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x71^38"
        5⤵
        
        PID:628
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:4468
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x48^38"
        5⤵
        
        PID:2228
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x42^38"
        5⤵
        
        PID:3200
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x49^38"
        5⤵
        
        PID:4596
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x51^38"
        5⤵
        
        PID:1192
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x76^38"
        5⤵
        
        PID:4332
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x54^38"
        5⤵
        
        PID:4348
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x49^38"
        5⤵
        
        PID:2868
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x45^38"
        5⤵
        
        PID:4848
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x67^38"
        5⤵
        
        PID:2964
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0E^38"
        5⤵
        
        PID:2208
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:5092
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:3840
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x54^38"
        5⤵
        
        PID:3168
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x12^38"
        5⤵
        
        PID:1340
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:2092
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0A^38"
        5⤵
        
        PID:3756
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:4564
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:1536
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:1804
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0A^38"
        5⤵
        
        PID:4612
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:3920
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:2900
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:2448
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0A^38"
        5⤵
        
        PID:3556
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:3384
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:4532
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:3260
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:4780
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0A^38"
        5⤵
        
        PID:4376
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:5104
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x4F^38"
        5⤵
        
        PID:2916
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x06^38"
        5⤵
        
        PID:3312
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x16^38"
        5⤵
        
        PID:3740
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x0F^38"
        5⤵
        
        PID:980
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set /a "0x5F^38"
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Roaming\QQ\QQ.exe
        
        "C:\Users\Admin\AppData\Roaming\QQ\QQ.exe"
        5⤵
        Adds Run key to start application
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        
        PID:2868
      - C:\Users\Admin\AppData\Roaming\QQ\QQ.exe
        
        C:\Users\Admin\AppData\Roaming\QQ\QQ.exe /stext "C:\Users\Admin\AppData\Local\Temp\urqxrdcwg"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2520
      - C:\Users\Admin\AppData\Roaming\QQ\QQ.exe
        
        C:\Users\Admin\AppData\Roaming\QQ\QQ.exe /stext "C:\Users\Admin\AppData\Local\Temp\xleqsvvyusyxa"
        6⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        
        PID:1656
      - C:\Users\Admin\AppData\Roaming\QQ\QQ.exe
        
        C:\Users\Admin\AppData\Roaming\QQ\QQ.exe /stext "C:\Users\Admin\AppData\Local\Temp\hnjitofriaqkkmlf"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 aba1bc01d2137674bb6ebc0054a3d3e90bee10b48217b239316f5662e0f784b8
MD5 fe6441592c3b0f554be2b6cab33d30f1
SHA1 b7e54a0a4f75bf64a2f3a467277ab3e956e84848
SHA512 e65104aef3f077cdf442e101adc3b7cbd97f70ae23054ca74b1bb08a16ad9a6cc91fc1afa9fe6ef8328346817e38faa00d18a8ecd851733a869ee285e05d5ee6
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf53CE.tmp\System.dll
Size 12KB
SHA256 1624d9ad8b2e2658af224691263f64388ba3a997efe80011889e3c35237ce4c1
MD5 6c38da8922cc37b4bbb77de4a63ad843
SHA1 4e0533fd11df8bddbd543ed58df7b6060d9f4631
SHA512 ad0be3d7e57da9c304e9b9cac5341b6c76b157456ab44f5579d6c38c830a31c9c3e1e9a875b8f465243c607ea2ede6b0bb77237f17a70a4d4c78606e036c3430
SSDEEP 192:wA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6gn9Mw:QR7SrtTv53tdtTgwF4SQbGPX36g9Mw
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf53CE.tmp\nsExec.dll
Size 7KB
SHA256 99fc8f647bfff3655dcd4ec577d79ec4102fb3a68b567282ba0b51e0b5262802
MD5 052099395689171cf64bf4a868e6a9be
SHA1 9581e80b223226eee5f726f38b3e966fdc5bbfad
SHA512 f45e38314e10129d3cceaefa918b25a432c67db8bf73f110a6957ca7f5cc96db749601fed550e0357bf67c84de2721d9692b8785c295fc7a1537b42c68b461a9
SSDEEP 96:rVl/7KOuFlKHMpXGu8FX6eT3sQk1u2QmIGjbAQvL7hDAbUlV:rVl+hSs2u85TTHkZQmbbLL7hDMo
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.exe

Path C:\Users\Admin\AppData\Local\Temp\x.exe
Size 469KB
SHA256 ddaf4a30fd1d9a4c74f1ae8842a6b0bb2053d9cfdcbcf9b7ad8122561658518a
MD5 9698e5ebed702eb7a5045811c60a3bc9
SHA1 07f394eaa3d0cfdf0933093775062cce0792129b
SHA512 a7f4acc934de58d4f3e203ef764c834ca41afe741ae5f596ed337225886d14052488d8428e34f8a5e28343cc9cbf5114c44c9f089f9675ba8fbb48171cd52a5e
SSDEEP 12288:kS43lfvP6AygOp6e49xcnBgxMemepP5x44:r4Zviv2p1xD3RXd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/808-1380-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/808-1372-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/808-1377-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/808-1378-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1656-1363-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1656-1366-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1656-1370-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1656-1368-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2520-1362-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2520-1367-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2520-1369-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2520-1383-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2868-1360-0x0000000001A70000-0x0000000003115000-memory.dmp

Download

memory/2868-1386-0x0000000034170000-0x0000000034189000-memory.dmp

Download

memory/2868-1390-0x0000000034170000-0x0000000034189000-memory.dmp

Download

memory/2868-1389-0x0000000034170000-0x0000000034189000-memory.dmp

Download

memory/3544-725-0x0000000001A70000-0x0000000003115000-memory.dmp

Download

memory/3544-715-0x0000000001A70000-0x0000000003115000-memory.dmp

Download