remcos | c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5

Analysis

max time kernel
135s
max time network
139s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/05/2026, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ# RE-7.1210594.exe
Size 859KB
Sample260521-jas7tsbs7x
SHA256 c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5
MD5 86666c4287b523e0b80c14dbda780f08
SHA1 9e3b5d55d1d97611ba8fca903eb8bddf8a9b0810
SHA512 404ab18ab9b7a06e51aaf6cf5e8c3cb712d2ff5df7a581b548baa540edc6c226b15de08b993ebce942b60cb386235e852b0f21656a5343f216a7b0ecaeff0394
SSDEEP 24576:hv6Dmf5/CEa+Q1NQhaM6gpmaITJXe+56LqgBA:8qR6D1ir6gM1f8BA
TLSH
T160152392FB60E967D490DDB24CB4F02E47E7EC40D9A5870AFB01B64AF83C5C5994E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost collection discovery remcos rat spyware stealer

Malware Config

Extracted

Family

remcos

Version

7.2.5 Pro

Botnet

RemoteHost

204.10.160.191:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-4J0YSW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Loads dropped DLL 64 IoCs

pid	Process
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe
712	RFQ# RE-7.1210594.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RFQ# RE-7.1210594.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RFQ# RE-7.1210594.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	drive.google.com
1	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3224	RFQ# RE-7.1210594.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
712	RFQ# RE-7.1210594.exe
3224	RFQ# RE-7.1210594.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
712	RFQ# RE-7.1210594.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3224	RFQ# RE-7.1210594.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 1056	712	RFQ# RE-7.1210594.exe	80
PID 712 wrote to memory of 3804	712	RFQ# RE-7.1210594.exe	82
PID 712 wrote to memory of 2532	712	RFQ# RE-7.1210594.exe	84
PID 712 wrote to memory of 4996	712	RFQ# RE-7.1210594.exe	86
PID 712 wrote to memory of 1856	712	RFQ# RE-7.1210594.exe	88
PID 712 wrote to memory of 3868	712	RFQ# RE-7.1210594.exe	90
PID 712 wrote to memory of 3008	712	RFQ# RE-7.1210594.exe	92
PID 712 wrote to memory of 1776	712	RFQ# RE-7.1210594.exe	94
PID 712 wrote to memory of 3984	712	RFQ# RE-7.1210594.exe	96
PID 712 wrote to memory of 8	712	RFQ# RE-7.1210594.exe	98
PID 712 wrote to memory of 4556	712	RFQ# RE-7.1210594.exe	100
PID 712 wrote to memory of 1476	712	RFQ# RE-7.1210594.exe	102
PID 712 wrote to memory of 3856	712	RFQ# RE-7.1210594.exe	104
PID 712 wrote to memory of 2684	712	RFQ# RE-7.1210594.exe	106
PID 712 wrote to memory of 1692	712	RFQ# RE-7.1210594.exe	108
PID 712 wrote to memory of 4064	712	RFQ# RE-7.1210594.exe	110
PID 712 wrote to memory of 5196	712	RFQ# RE-7.1210594.exe	112
PID 712 wrote to memory of 4824	712	RFQ# RE-7.1210594.exe	114
PID 712 wrote to memory of 2076	712	RFQ# RE-7.1210594.exe	116
PID 712 wrote to memory of 916	712	RFQ# RE-7.1210594.exe	118
PID 712 wrote to memory of 3872	712	RFQ# RE-7.1210594.exe	120
PID 712 wrote to memory of 5080	712	RFQ# RE-7.1210594.exe	122
PID 712 wrote to memory of 4960	712	RFQ# RE-7.1210594.exe	124
PID 712 wrote to memory of 4956	712	RFQ# RE-7.1210594.exe	126
PID 712 wrote to memory of 1440	712	RFQ# RE-7.1210594.exe	128
PID 712 wrote to memory of 6028	712	RFQ# RE-7.1210594.exe	130
PID 712 wrote to memory of 428	712	RFQ# RE-7.1210594.exe	132
PID 712 wrote to memory of 5880	712	RFQ# RE-7.1210594.exe	134
PID 712 wrote to memory of 5008	712	RFQ# RE-7.1210594.exe	136
PID 712 wrote to memory of 3356	712	RFQ# RE-7.1210594.exe	138
PID 712 wrote to memory of 2512	712	RFQ# RE-7.1210594.exe	140
PID 712 wrote to memory of 1032	712	RFQ# RE-7.1210594.exe	142
PID 712 wrote to memory of 4244	712	RFQ# RE-7.1210594.exe	144
PID 712 wrote to memory of 5108	712	RFQ# RE-7.1210594.exe	146
PID 712 wrote to memory of 3304	712	RFQ# RE-7.1210594.exe	148
PID 712 wrote to memory of 3240	712	RFQ# RE-7.1210594.exe	150
PID 712 wrote to memory of 572	712	RFQ# RE-7.1210594.exe	152
PID 712 wrote to memory of 5284	712	RFQ# RE-7.1210594.exe	154
PID 712 wrote to memory of 560	712	RFQ# RE-7.1210594.exe	156
PID 712 wrote to memory of 3860	712	RFQ# RE-7.1210594.exe	158
PID 712 wrote to memory of 3524	712	RFQ# RE-7.1210594.exe	160
PID 712 wrote to memory of 4648	712	RFQ# RE-7.1210594.exe	162
PID 712 wrote to memory of 2040	712	RFQ# RE-7.1210594.exe	164
PID 712 wrote to memory of 4696	712	RFQ# RE-7.1210594.exe	166
PID 712 wrote to memory of 2800	712	RFQ# RE-7.1210594.exe	168
PID 712 wrote to memory of 4540	712	RFQ# RE-7.1210594.exe	170
PID 712 wrote to memory of 4048	712	RFQ# RE-7.1210594.exe	172
PID 712 wrote to memory of 5660	712	RFQ# RE-7.1210594.exe	174
PID 712 wrote to memory of 2560	712	RFQ# RE-7.1210594.exe	176
PID 712 wrote to memory of 6084	712	RFQ# RE-7.1210594.exe	178
PID 712 wrote to memory of 3932	712	RFQ# RE-7.1210594.exe	180
PID 712 wrote to memory of 4304	712	RFQ# RE-7.1210594.exe	182
PID 712 wrote to memory of 5448	712	RFQ# RE-7.1210594.exe	184
PID 712 wrote to memory of 5604	712	RFQ# RE-7.1210594.exe	186
PID 712 wrote to memory of 5584	712	RFQ# RE-7.1210594.exe	188
PID 712 wrote to memory of 3992	712	RFQ# RE-7.1210594.exe	190
PID 712 wrote to memory of 5632	712	RFQ# RE-7.1210594.exe	192
PID 712 wrote to memory of 6088	712	RFQ# RE-7.1210594.exe	194
PID 712 wrote to memory of 956	712	RFQ# RE-7.1210594.exe	196
PID 712 wrote to memory of 5684	712	RFQ# RE-7.1210594.exe	198
PID 712 wrote to memory of 4680	712	RFQ# RE-7.1210594.exe	200
PID 712 wrote to memory of 5268	712	RFQ# RE-7.1210594.exe	202
PID 712 wrote to memory of 1716	712	RFQ# RE-7.1210594.exe	204
PID 712 wrote to memory of 4124	712	RFQ# RE-7.1210594.exe	206

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RFQ# RE-7.1210594.exe

C:\Users\Admin\AppData\Local\Temp\RFQ# RE-7.1210594.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ# RE-7.1210594.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  PID:1056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:3804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:1856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:3868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:3008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:1776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:3984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:8
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "154^217"
  2⤵
  PID:4556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:3856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  PID:1692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:4064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  PID:5196
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:2076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  PID:3872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:5080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "180^217"
  2⤵
  PID:4960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:1440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  PID:6028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:1032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  PID:4244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  PID:5108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "169^217"
  2⤵
  PID:2560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:6084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5584
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  PID:3992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5632
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:6088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4680
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5268
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  PID:1716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:2716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:1788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:5800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:5008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  PID:3352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:2344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  PID:4448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:4084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:5856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:2084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:3400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "143^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:3372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "172^217"
  2⤵
  PID:4612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:5772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  PID:2420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:3388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:5996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  PID:5596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "186^217"
  2⤵
  PID:3112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:1736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:6044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:2708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  PID:4156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:6076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:1960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  PID:5964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4928
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4920
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  PID:3564
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:1848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:1188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:1868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  PID:5052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:2084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "169^217"
  2⤵
  PID:3400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:5048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:4528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  PID:4568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:3372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  PID:2932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:4612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:5332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  PID:2508
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:5064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:2592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:5812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:1856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "138^217"
  2⤵
  PID:1392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:5448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4580
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:1316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:2888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:1452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  PID:2748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "183^217"
  2⤵
  PID:2316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  PID:1148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:2760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:4704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:5396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "224^217"
  2⤵
  PID:3572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:1480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:4328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:1564
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:4056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:2112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:5472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:3804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:1672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:2348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:2056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:3796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:2768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:1384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:1428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:4192
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:6128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "189^217"
  2⤵
  PID:1584
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  PID:4800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:5536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:5736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:4868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:3900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:6136
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:5880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5176
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:1936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  PID:5612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:5352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:1804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  PID:560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "243^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:6096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:1500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:3472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:3168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:8
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "172^217"
  2⤵
  PID:4532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "170^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:3752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:3856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:1640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:6076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "154^217"
  2⤵
  PID:5740
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:4368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:4716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "142^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "183^217"
  2⤵
  PID:3448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "189^217"
  2⤵
  PID:1236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  PID:400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "174^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6136
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^217"
  2⤵
  PID:428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:5880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  PID:2260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "186^217"
  2⤵
  PID:3232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  PID:5116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:3260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:3144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  PID:1964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:3600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4176
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:6100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2608
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:6044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:1504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:3956
- C:\Users\Admin\AppData\Local\Temp\RFQ# RE-7.1210594.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ# RE-7.1210594.exe"
  2⤵
  PID:1364
- C:\Users\Admin\AppData\Local\Temp\RFQ# RE-7.1210594.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ# RE-7.1210594.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  PID:3224
- - C:\Users\Admin\AppData\Local\Temp\RFQ# RE-7.1210594.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ# RE-7.1210594.exe"
    3⤵
    PID:5288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuC3FD.tmp\System.dll
Size 12KB
SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
MD5 81e268e27dbbcadbf116b5a9402195ab
SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
TLSH
T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuC3FD.tmp\nsExec.dll
Size 6KB
SHA256 e20666c498941d36bfd0eae411ad73c475d043cee39b50c31734a70eecaae0bb
MD5 13bd8e89dc79004d85ab02626e08c3c5
SHA1 0ef0efb3237233de26f55c4420753ed0fed418ad
SHA512 58841cc9e8313775a097a93e68952d8005b826bf1349dc24d49e3128b87e9021a028d2d4e738997390f1625f7ae7744a9ff85289f6c78f5ebd67c0da61ef2120
SSDEEP 96:pOBtYZKtPsrqBApt1JHpb9XWk7Qe06iE6mE6YNFyVOHd0+uUwEX:ptZKtrAJJJbP7iEHEbN8Ved0Pw
TLSH
T1F7D1F83A2AD12DF3D04889702827793ACBB9C8360F500650DF671EE225E1DE7DB2038B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/712-673-0x0000000073F15000-0x0000000073F16000-memory.dmp

Download

memory/3224-674-0x0000000000450000-0x0000000001767000-memory.dmp

Download

memory/3224-691-0x0000000000450000-0x0000000001767000-memory.dmp

Download

memory/3224-696-0x0000000034F30000-0x0000000035027000-memory.dmp

Download

memory/3224-699-0x0000000034F30000-0x0000000035027000-memory.dmp

Download

memory/3224-700-0x0000000034F30000-0x0000000035027000-memory.dmp

Download

memory/3224-707-0x0000000000450000-0x0000000001767000-memory.dmp

Download

memory/3224-710-0x0000000000450000-0x0000000001767000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads