formbook | d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005

Analysis

max time kernel
164s
max time network
160s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
Size 277KB
Sample260720-rdt8asct8k
SHA256 d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005
MD5 12573405bc4fca639ff9be8299c4c61f
SHA1 e04f94a8659b47974efc4540b9a4edef5e414c22
SHA512 9b2d29b8727dcf97a1075d9e4d255ee8f0b4462105990fb4cafe0e6a6a78627762c04ec064a1654d0973b03936ca8935399191fd515e28f6f008d9bc0bbda72c
SSDEEP 6144:QpZgUXltNBTzfMVuEMqHJ54z8ayCipum5u6Hmk5:AFf4uEMqHJ56HCHz
TLSH
T11454E186B080D4EBD9666831D4BBDD2147263F6A83D15B0F2366773EA873163072F64B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution formbook rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1880-961-0x0000000000400000-0x00000000016E6000-memory.dmp	family_formbook

Loads dropped DLL 64 IoCs

pid	Process
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1880	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
1880	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\Observationsklasse.exe	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1228	cmd.exe
3356	cmd.exe
2068	cmd.exe
2684	cmd.exe
3536	cmd.exe
3528	cmd.exe
3056	cmd.exe
3884	cmd.exe
3344	cmd.exe
1264	cmd.exe
6012	cmd.exe
4184	cmd.exe
4192	cmd.exe
4608	cmd.exe
5420	cmd.exe
4284	cmd.exe
3016	cmd.exe
4296	cmd.exe
3448	cmd.exe
4204	cmd.exe
944	cmd.exe
1696	cmd.exe
4836	cmd.exe
2340	cmd.exe
4828	cmd.exe
3900	cmd.exe
1916	cmd.exe
2352	cmd.exe
612	cmd.exe
1472	cmd.exe
4332	cmd.exe
4640	cmd.exe
3028	cmd.exe
5048	cmd.exe
3544	cmd.exe
1368	cmd.exe
2256	cmd.exe
2564	cmd.exe
1276	cmd.exe
3372	cmd.exe
5064	cmd.exe
2304	cmd.exe
2404	cmd.exe
4284	cmd.exe
2936	cmd.exe
576	cmd.exe
3492	cmd.exe
552	cmd.exe
5996	cmd.exe
1608	cmd.exe
3492	cmd.exe
2152	cmd.exe
2756	cmd.exe
996	cmd.exe
4256	cmd.exe
3724	cmd.exe
4412	cmd.exe
828	cmd.exe
2568	cmd.exe
5412	cmd.exe
6100	cmd.exe
4112	cmd.exe
4512	cmd.exe
1532	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4500	1880	WerFault.exe	678

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1880	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
1880	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 4672	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	88
PID 6020 wrote to memory of 700	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	90
PID 6020 wrote to memory of 4828	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	92
PID 6020 wrote to memory of 3048	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	94
PID 6020 wrote to memory of 4600	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	96
PID 6020 wrote to memory of 5592	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	98
PID 6020 wrote to memory of 4192	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	100
PID 6020 wrote to memory of 6056	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	102
PID 6020 wrote to memory of 4456	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	104
PID 6020 wrote to memory of 5400	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	106
PID 6020 wrote to memory of 576	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	108
PID 6020 wrote to memory of 1840	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	110
PID 6020 wrote to memory of 996	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	112
PID 6020 wrote to memory of 2384	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	114
PID 6020 wrote to memory of 1004	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	116
PID 6020 wrote to memory of 5784	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	118
PID 6020 wrote to memory of 3404	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	120
PID 6020 wrote to memory of 4236	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	122
PID 6020 wrote to memory of 5412	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	124
PID 6020 wrote to memory of 2404	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	126
PID 6020 wrote to memory of 5904	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	128
PID 6020 wrote to memory of 1264	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	130
PID 6020 wrote to memory of 4436	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	132
PID 6020 wrote to memory of 5760	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	134
PID 6020 wrote to memory of 1416	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	136
PID 6020 wrote to memory of 4256	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	138
PID 6020 wrote to memory of 3164	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	140
PID 6020 wrote to memory of 4184	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	142
PID 6020 wrote to memory of 4336	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	144
PID 6020 wrote to memory of 3536	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	146
PID 6020 wrote to memory of 6124	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	148
PID 6020 wrote to memory of 3312	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	150
PID 6020 wrote to memory of 5424	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	152
PID 6020 wrote to memory of 1896	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	154
PID 6020 wrote to memory of 4664	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	156
PID 6020 wrote to memory of 2532	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	158
PID 6020 wrote to memory of 4608	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	160
PID 6020 wrote to memory of 2452	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	162
PID 6020 wrote to memory of 1312	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	164
PID 6020 wrote to memory of 5996	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	166
PID 6020 wrote to memory of 3544	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	168
PID 6020 wrote to memory of 4660	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	170
PID 6020 wrote to memory of 4640	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	172
PID 6020 wrote to memory of 6056	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	174
PID 6020 wrote to memory of 2568	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	176
PID 6020 wrote to memory of 4084	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	178
PID 6020 wrote to memory of 3724	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	180
PID 6020 wrote to memory of 3476	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	182
PID 6020 wrote to memory of 1868	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	184
PID 6020 wrote to memory of 5756	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	186
PID 6020 wrote to memory of 3448	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	188
PID 6020 wrote to memory of 3016	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	190
PID 6020 wrote to memory of 3624	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	192
PID 6020 wrote to memory of 3068	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	194
PID 6020 wrote to memory of 3276	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	196
PID 6020 wrote to memory of 1600	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	198
PID 6020 wrote to memory of 2440	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	200
PID 6020 wrote to memory of 5952	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	202
PID 6020 wrote to memory of 4412	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	204
PID 6020 wrote to memory of 3040	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	206
PID 6020 wrote to memory of 2364	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	208
PID 6020 wrote to memory of 2780	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	210
PID 6020 wrote to memory of 340	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	212
PID 6020 wrote to memory of 4344	6020	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	214

C:\Users\Admin\AppData\Local\Temp\d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
"C:\Users\Admin\AppData\Local\Temp\d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  PID:4672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  - Executes a command shell one-liner
  PID:4828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  PID:3048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:4600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:5592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - Executes a command shell one-liner
  PID:4192
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:4456
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:5400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "154^217"
  2⤵
  PID:576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:1840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - Executes a command shell one-liner
  PID:996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:2384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  PID:1004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:5784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  PID:3404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - Executes a command shell one-liner
  PID:5412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:2404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  PID:5904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:1264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "180^217"
  2⤵
  PID:4436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:1416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  - Executes a command shell one-liner
  PID:4256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3164
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:6124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  PID:5424
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  PID:1896
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4608
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:1312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3724
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "169^217"
  2⤵
  PID:1868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  PID:1600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:2440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:4412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  PID:340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:2232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  - Executes a command shell one-liner
  PID:5420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:5428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - Executes a command shell one-liner
  PID:828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:5088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  PID:5108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:4828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:1312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  - Executes a command shell one-liner
  PID:5996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:4640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:896
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - Executes a command shell one-liner
  PID:2568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:4084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "143^217"
  2⤵
  PID:3724
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  PID:5756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "172^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:2756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - Executes a command shell one-liner
  PID:6100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  - Executes a command shell one-liner
  PID:1368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:4512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "186^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  - Executes a command shell one-liner
  PID:1264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:3028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:4204
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - Executes a command shell one-liner
  PID:2352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  PID:4552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:3536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:5420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:2768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  PID:2892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:4284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:1620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:5708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:6040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2152
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:2256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:3528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:2564
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  PID:1916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  PID:2756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:6100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  - Executes a command shell one-liner
  PID:1228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "169^217"
  2⤵
  - Executes a command shell one-liner
  PID:4512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:1712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:4504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  PID:4412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:4900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  PID:4436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1424
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:1080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  PID:4908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:6128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:5636
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:1980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - Executes a command shell one-liner
  PID:2936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:6124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "138^217"
  2⤵
  PID:6084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:2324
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  PID:828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  - Executes a command shell one-liner
  PID:944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - Executes a command shell one-liner
  PID:4284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - Executes a command shell one-liner
  PID:612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^217"
  2⤵
  - Executes a command shell one-liner
  PID:1696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  PID:4332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "183^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:2640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  - Executes a command shell one-liner
  PID:576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:5048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:2664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:3192
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "224^217"
  2⤵
  - Executes a command shell one-liner
  PID:3056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:2404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:3612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:2488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:1608
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:1532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:5308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:1876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:1044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:3572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:1148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  - Executes a command shell one-liner
  PID:3884
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  PID:3628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:5348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - Executes a command shell one-liner
  PID:3356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:2776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:5884
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:2256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - Executes a command shell one-liner
  PID:1472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:5048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "189^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  - Executes a command shell one-liner
  PID:3492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - Executes a command shell one-liner
  PID:4836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  - Executes a command shell one-liner
  PID:2068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:3344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:3612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:1276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:1648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  PID:4256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:3024
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:5620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:4672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:4264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3884
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  PID:6012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "243^217"
  2⤵
  PID:3628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:896
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3268
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:1472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:5048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  - Executes a command shell one-liner
  PID:3492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - Executes a command shell one-liner
  PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "172^217"
  2⤵
  PID:2068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "170^217"
  2⤵
  - Executes a command shell one-liner
  PID:552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:2460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - Executes a command shell one-liner
  PID:3344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:4504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:3348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:4780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "154^217"
  2⤵
  PID:4468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  - Executes a command shell one-liner
  PID:3372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:3296
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "142^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "183^217"
  2⤵
  PID:3768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "189^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  PID:6124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "174^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3196
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  PID:4272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "186^217"
  2⤵
  PID:3292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  PID:472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  - Executes a command shell one-liner
  PID:5064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:3216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  PID:5708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:2684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:2152
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2300
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:1916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:2756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4496
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  - Executes a command shell one-liner
  PID:4296
- C:\Users\Admin\AppData\Local\Temp\d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
  "C:\Users\Admin\AppData\Local\Temp\d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe"
  2⤵
  PID:3120
- C:\Users\Admin\AppData\Local\Temp\d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
  "C:\Users\Admin\AppData\Local\Temp\d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1880
- - C:\Users\Admin\AppData\Local\Temp\d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
    "C:\Users\Admin\AppData\Local\Temp\d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe"
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 1220
    3⤵
    - Program crash
    PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1880 -ip 1880
1⤵
PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nskCD2B.tmp\System.dll
Size 11KB
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
TLSH
T1A8325C15136046F3E1D2853C542B3AAB6FB869118AF04E43CFB36852EF396C79D79352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nskCD2B.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
TLSH
T16BD1097675E22EB3C50ACA313C127A2B57F8C8111B9401549B938BD238C5EB3EA28282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1880-959-0x0000000000400000-0x00000000016E6000-memory.dmp

Download

memory/1880-960-0x0000000000400000-0x00000000016E6000-memory.dmp

Download

memory/1880-961-0x0000000000400000-0x00000000016E6000-memory.dmp

Download

memory/6020-958-0x0000000010004000-0x0000000010005000-memory.dmp

Download