c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
Size 620KB
Sample240711-de4apsvgkm
SHA256 c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b
MD5 b409d2fd594633bc71e64da08aed9951
SHA1 c6f38e204419c12044e34baf398030b76e616a2f
SHA512 b234f0a848c3d775cde23d4965084714fe13b3dd076f3749213e0f55a3f69cad302bebd2db2ce189333f85b4d81554dffc74b58553120251acb0f2ce6b03ecf6
SSDEEP 12288:9vxwRbB0H5KUjUPKCuO+ggobwxbAW07FN3WNZt:9vx6bB0ZqAHgDSbxQFN3WDt
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\ideologised\responseless.hvo	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\postnaris\Omsaetningen.ini	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1524	1320	WerFault.exe	29

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1936	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	30
PID 1320 wrote to memory of 1936	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	30
PID 1320 wrote to memory of 1936	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	30
PID 1320 wrote to memory of 1936	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	30
PID 1320 wrote to memory of 2372	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	32
PID 1320 wrote to memory of 2372	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	32
PID 1320 wrote to memory of 2372	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	32
PID 1320 wrote to memory of 2372	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	32
PID 1320 wrote to memory of 832	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	34
PID 1320 wrote to memory of 832	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	34
PID 1320 wrote to memory of 832	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	34
PID 1320 wrote to memory of 832	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	34
PID 1320 wrote to memory of 1020	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	36
PID 1320 wrote to memory of 1020	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	36
PID 1320 wrote to memory of 1020	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	36
PID 1320 wrote to memory of 1020	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	36
PID 1320 wrote to memory of 2716	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	38
PID 1320 wrote to memory of 2716	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	38
PID 1320 wrote to memory of 2716	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	38
PID 1320 wrote to memory of 2716	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	38
PID 1320 wrote to memory of 3040	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	40
PID 1320 wrote to memory of 3040	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	40
PID 1320 wrote to memory of 3040	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	40
PID 1320 wrote to memory of 3040	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	40
PID 1320 wrote to memory of 2824	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	42
PID 1320 wrote to memory of 2824	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	42
PID 1320 wrote to memory of 2824	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	42
PID 1320 wrote to memory of 2824	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	42
PID 1320 wrote to memory of 3028	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	44
PID 1320 wrote to memory of 3028	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	44
PID 1320 wrote to memory of 3028	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	44
PID 1320 wrote to memory of 3028	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	44
PID 1320 wrote to memory of 2956	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	46
PID 1320 wrote to memory of 2956	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	46
PID 1320 wrote to memory of 2956	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	46
PID 1320 wrote to memory of 2956	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	46
PID 1320 wrote to memory of 2088	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	48
PID 1320 wrote to memory of 2088	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	48
PID 1320 wrote to memory of 2088	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	48
PID 1320 wrote to memory of 2088	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	48
PID 1320 wrote to memory of 2064	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	50
PID 1320 wrote to memory of 2064	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	50
PID 1320 wrote to memory of 2064	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	50
PID 1320 wrote to memory of 2064	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	50
PID 1320 wrote to memory of 2600	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	52
PID 1320 wrote to memory of 2600	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	52
PID 1320 wrote to memory of 2600	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	52
PID 1320 wrote to memory of 2600	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	52
PID 1320 wrote to memory of 2020	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	54
PID 1320 wrote to memory of 2020	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	54
PID 1320 wrote to memory of 2020	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	54
PID 1320 wrote to memory of 2020	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	54
PID 1320 wrote to memory of 2352	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	56
PID 1320 wrote to memory of 2352	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	56
PID 1320 wrote to memory of 2352	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	56
PID 1320 wrote to memory of 2352	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	56
PID 1320 wrote to memory of 1144	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	58
PID 1320 wrote to memory of 1144	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	58
PID 1320 wrote to memory of 1144	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	58
PID 1320 wrote to memory of 1144	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	58
PID 1320 wrote to memory of 1228	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	60
PID 1320 wrote to memory of 1228	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	60
PID 1320 wrote to memory of 1228	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	60
PID 1320 wrote to memory of 1228	1320	c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe	60

C:\Users\Admin\AppData\Local\Temp\c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe
"C:\Users\Admin\AppData\Local\Temp\c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "250^177"
  2⤵
  PID:1936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:2372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^177"
  2⤵
  PID:832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "255^177"
  2⤵
  PID:1020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:2716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "253^177"
  2⤵
  PID:3040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:2824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "131^177"
  2⤵
  PID:3028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:2956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:2088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "242^177"
  2⤵
  PID:2064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:2600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:2020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "208^177"
  2⤵
  PID:2352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "197^177"
  2⤵
  PID:1144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:1228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^177"
  2⤵
  PID:2828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:2972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^177"
  2⤵
  PID:2260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "153^177"
  2⤵
  PID:1776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "220^177"
  2⤵
  PID:2864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:1316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "133^177"
  2⤵
  PID:2592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1920
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "201^177"
  2⤵
  PID:2488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^177"
  2⤵
  PID:1584
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2884
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:3032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:3028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:2008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "193^177"
  2⤵
  PID:2396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "133^177"
  2⤵
  PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:2260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "201^177"
  2⤵
  PID:2592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^177"
  2⤵
  PID:2960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2564
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^177"
  2⤵
  PID:1608
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^177"
  2⤵
  PID:1520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:2256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "132^177"
  2⤵
  PID:2568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "141^177"
  2⤵
  PID:2324
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "250^177"
  2⤵
  PID:2388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:2760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^177"
  2⤵
  PID:2756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "255^177"
  2⤵
  PID:2844
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:2900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "253^177"
  2⤵
  PID:2648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:2776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "131^177"
  2⤵
  PID:2732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:2140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:2064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "231^177"
  2⤵
  PID:2600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:1816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "197^177"
  2⤵
  PID:1368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "196^177"
  2⤵
  PID:1752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "208^177"
  2⤵
  PID:2936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:2968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^177"
  2⤵
  PID:2652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:2244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "222^177"
  2⤵
  PID:2224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "210^177"
  2⤵
  PID:1932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "153^177"
  2⤵
  PID:2964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "133^177"
  2⤵
  PID:1068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "135^177"
  2⤵
  PID:1924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "133^177"
  2⤵
  PID:876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:3024
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:2696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "132^177"
  2⤵
  PID:3008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^177"
  2⤵
  PID:2156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "133^177"
  2⤵
  PID:2192
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:2544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2740
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "201^177"
  2⤵
  PID:2436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:2620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:2088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1192
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "201^177"
  2⤵
  PID:1216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "133^177"
  2⤵
  PID:540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^177"
  2⤵
  PID:2932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "193^177"
  2⤵
  PID:2872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^177"
  2⤵
  PID:2708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:2196
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "128^177"
  2⤵
  PID:292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "141^177"
  2⤵
  PID:2228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "250^177"
  2⤵
  PID:444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:1868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^177"
  2⤵
  PID:1336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "255^177"
  2⤵
  PID:2208
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:1560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "253^177"
  2⤵
  PID:1544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:1968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "131^177"
  2⤵
  PID:2220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:1848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "226^177"
  2⤵
  PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "197^177"
  2⤵
  PID:684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^177"
  2⤵
  PID:2312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:2392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:2416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^177"
  2⤵
  PID:2924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "222^177"
  2⤵
  PID:2848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "223^177"
  2⤵
  PID:2820
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "197^177"
  2⤵
  PID:2796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:2096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:2616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "153^177"
  2⤵
  PID:2320
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2680
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:1236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "132^177"
  2⤵
  PID:2396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "135^177"
  2⤵
  PID:2876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "134^177"
  2⤵
  PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "134^177"
  2⤵
  PID:2348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1456
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:2968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^177"
  2⤵
  PID:2444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^177"
  2⤵
  PID:1528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:1448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "141^177"
  2⤵
  PID:2176
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "250^177"
  2⤵
  PID:2908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:2160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^177"
  2⤵
  PID:2372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "255^177"
  2⤵
  PID:832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "244^177"
  2⤵
  PID:2188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "253^177"
  2⤵
  PID:2500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:2896
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "131^177"
  2⤵
  PID:3032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:2844
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:2636
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^177"
  2⤵
  PID:2660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:1784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "208^177"
  2⤵
  PID:2032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "213^177"
  2⤵
  PID:2672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^177"
  2⤵
  PID:2104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:1052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:1148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "153^177"
  2⤵
  PID:1788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2928
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "132^177"
  2⤵
  PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:3000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2024
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:2420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "128^177"
  2⤵
  PID:2044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1456
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "133^177"
  2⤵
  PID:948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "135^177"
  2⤵
  PID:2444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "133^177"
  2⤵
  PID:1924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "132^177"
  2⤵
  PID:1448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^177"
  2⤵
  PID:684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "133^177"
  2⤵
  PID:2312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:1792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "155^177"
  2⤵
  PID:1820
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:2736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^177"
  2⤵
  PID:1960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^177"
  2⤵
  PID:1756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:2504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:1976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "141^177"
  2⤵
  PID:1700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "196^177"
  2⤵
  PID:2648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "194^177"
  2⤵
  PID:1228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "212^177"
  2⤵
  PID:2868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "130^177"
  2⤵
  PID:2240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "131^177"
  2⤵
  PID:2952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:2984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^177"
  2⤵
  PID:1196
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "242^177"
  2⤵
  PID:1932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "208^177"
  2⤵
  PID:952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:1436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "221^177"
  2⤵
  PID:1336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "230^177"
  2⤵
  PID:2248
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "223^177"
  2⤵
  PID:1060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "213^177"
  2⤵
  PID:2120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "222^177"
  2⤵
  PID:2448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "198^177"
  2⤵
  PID:2168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^177"
  2⤵
  PID:1920
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:1412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "222^177"
  2⤵
  PID:1616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "210^177"
  2⤵
  PID:3008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^177"
  2⤵
  PID:2316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "153^177"
  2⤵
  PID:2192
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "195^177"
  2⤵
  PID:2704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "128^177"
  2⤵
  PID:2760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:2812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:2656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:2504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:1976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:1700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:1228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "157^177"
  2⤵
  PID:2868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "216^177"
  2⤵
  PID:2240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "145^177"
  2⤵
  PID:2952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "129^177"
  2⤵
  PID:2260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^177"
  2⤵
  PID:2944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "141^177"
  2⤵
  PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 544
  2⤵
  - Program crash
  PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path \Users\Admin\AppData\Local\Temp\nstCD10.tmp\System.dll
Size 11KB
SHA256 aec5af9c7c551c3590492b0c0120b535b55ab048e84f695b617a5ab4b1a52f54
MD5 bff2a11d26d951ec34679b8fa1ee7192
SHA1 d3de629a5a86ee35b6afa1802f6ac8b141b07062
SHA512 1dce397c9cab3cd3b58c181688286a89067c743f195403694819c2d988435268ffd01939beaaa17cfa344160c89414f28273b70de154be0def034af8c470723a
SSDEEP 192:G9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:GJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path \Users\Admin\AppData\Local\Temp\nstCD10.tmp\nsExec.dll
Size 6KB
SHA256 e18984e78d58b2383f2c1e8ed0000088ee8d9d469345383618f179176fcddff6
MD5 fdee755c4987e9859e0eec130ee22efd
SHA1 ba32823881a98da6b92eee1d866be2b3a20c6e5d
SHA512 31ba3dad22fd9b78ab3f6017c4373c923d048cf0c010900a131c4533ef185d408a88052aa4cf6184dbe484d44aab9cfa94a052185cf0b9ad19286ed921e4723f
SSDEEP 96:ft4Vl/7Lo1UBrob9ljNEUgD7cyuM1x9XkraK2A2KAB5VVDyssKZ:ft4Vlw1Iul5J8T1vK20I5VVGsb
MD5 SHA1 SHA512 SSDEEP