remcos | c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
Size 859KB
Sample260801-kdaeka1eqa
SHA256 c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5
MD5 86666c4287b523e0b80c14dbda780f08
SHA1 9e3b5d55d1d97611ba8fca903eb8bddf8a9b0810
SHA512 404ab18ab9b7a06e51aaf6cf5e8c3cb712d2ff5df7a581b548baa540edc6c226b15de08b993ebce942b60cb386235e852b0f21656a5343f216a7b0ecaeff0394
SSDEEP 24576:hv6Dmf5/CEa+Q1NQhaM6gpmaITJXe+56LqgBA:8qR6D1ir6gM1f8BA
TLSH
T160152392FB60E967D490DDB24CB4F02E47E7EC40D9A5870AFB01B64AF83C5C5994E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery execution remcos rat

Malware Config

Extracted

Family

remcos

Version

7.2.5 Pro

Botnet

RemoteHost

204.10.160.191:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-4J0YSW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Loads dropped DLL 64 IoCs

pid	Process
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
52	drive.google.com
53	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3028	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
3028	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1428	cmd.exe
204	cmd.exe
3628	cmd.exe
700	cmd.exe
2792	cmd.exe
4832	cmd.exe
2092	cmd.exe
4868	cmd.exe
3452	cmd.exe
2572	cmd.exe
5112	cmd.exe
3792	cmd.exe
2096	cmd.exe
1232	cmd.exe
2128	cmd.exe
4244	cmd.exe
2440	cmd.exe
4936	cmd.exe
3364	cmd.exe
1244	cmd.exe
3060	cmd.exe
2072	cmd.exe
3452	cmd.exe
2136	cmd.exe
684	cmd.exe
4544	cmd.exe
4336	cmd.exe
4784	cmd.exe
3904	cmd.exe
1560	cmd.exe
2276	cmd.exe
2068	cmd.exe
4024	cmd.exe
3972	cmd.exe
2020	cmd.exe
2820	cmd.exe
2168	cmd.exe
3916	cmd.exe
3472	cmd.exe
228	cmd.exe
2444	cmd.exe
4600	cmd.exe
1960	cmd.exe
3472	cmd.exe
2812	cmd.exe
876	cmd.exe
5044	cmd.exe
2988	cmd.exe
4360	cmd.exe
3332	cmd.exe
2352	cmd.exe
2736	cmd.exe
3984	cmd.exe
636	cmd.exe
5024	cmd.exe
960	cmd.exe
4392	cmd.exe
636	cmd.exe
3384	cmd.exe
1284	cmd.exe
1284	cmd.exe
1908	cmd.exe
3128	cmd.exe
3088	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3028	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 3024	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	84
PID 2836 wrote to memory of 2816	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	86
PID 2836 wrote to memory of 1292	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	88
PID 2836 wrote to memory of 3976	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	90
PID 2836 wrote to memory of 3288	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	92
PID 2836 wrote to memory of 3216	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	96
PID 2836 wrote to memory of 1888	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	98
PID 2836 wrote to memory of 1704	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	100
PID 2836 wrote to memory of 388	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	103
PID 2836 wrote to memory of 3164	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	106
PID 2836 wrote to memory of 1904	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	108
PID 2836 wrote to memory of 4032	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	111
PID 2836 wrote to memory of 2936	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	113
PID 2836 wrote to memory of 1244	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	115
PID 2836 wrote to memory of 3312	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	117
PID 2836 wrote to memory of 3088	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	119
PID 2836 wrote to memory of 4808	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	121
PID 2836 wrote to memory of 2572	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	123
PID 2836 wrote to memory of 4408	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	125
PID 2836 wrote to memory of 1372	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	127
PID 2836 wrote to memory of 3496	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	129
PID 2836 wrote to memory of 5000	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	131
PID 2836 wrote to memory of 1836	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	133
PID 2836 wrote to memory of 1348	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	135
PID 2836 wrote to memory of 2820	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	137
PID 2836 wrote to memory of 768	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	139
PID 2836 wrote to memory of 3652	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	141
PID 2836 wrote to memory of 4392	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	143
PID 2836 wrote to memory of 4828	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	145
PID 2836 wrote to memory of 3840	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	147
PID 2836 wrote to memory of 4544	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	149
PID 2836 wrote to memory of 3916	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	151
PID 2836 wrote to memory of 4940	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	153
PID 2836 wrote to memory of 4712	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	155
PID 2836 wrote to memory of 204	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	157
PID 2836 wrote to memory of 4936	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	159
PID 2836 wrote to memory of 2792	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	161
PID 2836 wrote to memory of 636	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	163
PID 2836 wrote to memory of 3160	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	165
PID 2836 wrote to memory of 2384	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	167
PID 2836 wrote to memory of 2324	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	169
PID 2836 wrote to memory of 3472	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	171
PID 2836 wrote to memory of 4780	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	173
PID 2836 wrote to memory of 2460	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	175
PID 2836 wrote to memory of 2352	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	177
PID 2836 wrote to memory of 2072	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	179
PID 2836 wrote to memory of 4596	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	181
PID 2836 wrote to memory of 1728	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	183
PID 2836 wrote to memory of 2972	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	185
PID 2836 wrote to memory of 2076	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	187
PID 2836 wrote to memory of 5024	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	189
PID 2836 wrote to memory of 2428	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	191
PID 2836 wrote to memory of 1288	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	193
PID 2836 wrote to memory of 3872	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	195
PID 2836 wrote to memory of 2720	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	197
PID 2836 wrote to memory of 3628	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	199
PID 2836 wrote to memory of 4404	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	201
PID 2836 wrote to memory of 228	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	203
PID 2836 wrote to memory of 2980	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	205
PID 2836 wrote to memory of 4832	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	207
PID 2836 wrote to memory of 2444	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	209
PID 2836 wrote to memory of 1932	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	211
PID 2836 wrote to memory of 2472	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	213
PID 2836 wrote to memory of 3384	2836	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	215

C:\Users\Admin\AppData\Local\Temp\c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
"C:\Users\Admin\AppData\Local\Temp\c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3024
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:1292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  PID:3976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:3288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:3216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:1704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:3164
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "154^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:4032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:2936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:1244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  PID:3312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - Executes a command shell one-liner
  PID:3088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:2572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:4408
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:1372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  PID:3496
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:5000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "180^217"
  2⤵
  PID:1836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:2820
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  PID:768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:4392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:4544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  PID:4940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  PID:4712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:204
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:2792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:636
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2324
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:2352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2072
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "169^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5024
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:2428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  - Executes a command shell one-liner
  PID:3628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:4832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:2444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  PID:1932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  PID:2472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:3384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:2656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:4456
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:4912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  - Executes a command shell one-liner
  PID:2092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  - Executes a command shell one-liner
  PID:4600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  PID:4896
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - Executes a command shell one-liner
  PID:2276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:3952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  PID:4784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:3344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:4716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:3476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:2392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:1720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "143^217"
  2⤵
  - Executes a command shell one-liner
  PID:2736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  - Executes a command shell one-liner
  PID:2096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "172^217"
  2⤵
  PID:1732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:1552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - Executes a command shell one-liner
  PID:3472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:4044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  PID:4744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "186^217"
  2⤵
  PID:460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  - Executes a command shell one-liner
  PID:3060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:2068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - Executes a command shell one-liner
  PID:5044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  PID:116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:1548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  - Executes a command shell one-liner
  PID:4024
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  PID:2000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  - Executes a command shell one-liner
  PID:4336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:1960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  PID:4964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:1892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4668
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:2072
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:1264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:4244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  PID:4372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  PID:1288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "169^217"
  2⤵
  PID:4760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:2912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:204
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  PID:2780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:4768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:3160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:3316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:4664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:4564
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:1676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:3784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "138^217"
  2⤵
  PID:1228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - Executes a command shell one-liner
  PID:5112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4456
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  - Executes a command shell one-liner
  PID:960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^217"
  2⤵
  PID:1172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  - Executes a command shell one-liner
  PID:2440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "183^217"
  2⤵
  PID:3032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  PID:4760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:4732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - Executes a command shell one-liner
  PID:2128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:2828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:3996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "224^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  - Executes a command shell one-liner
  PID:2812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:1728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5024
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:1172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:1140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:4936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:4448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:2168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - Executes a command shell one-liner
  PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:3968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - Executes a command shell one-liner
  PID:3452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:1836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  PID:3436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:3060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:2020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - Executes a command shell one-liner
  PID:4360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:3428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:4160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:3172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  - Executes a command shell one-liner
  PID:4784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:1048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:4760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "189^217"
  2⤵
  - Executes a command shell one-liner
  PID:3984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  PID:3204
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3584
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:4852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:3312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:4868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:3452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:4520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  PID:2868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:2628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:1764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:1724
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:2956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  - Executes a command shell one-liner
  PID:3792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:3676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:4144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  PID:4332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  - Executes a command shell one-liner
  PID:876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:1284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "243^217"
  2⤵
  PID:1372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3496
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:3972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:2020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:4160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:3488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:3008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "172^217"
  2⤵
  - Executes a command shell one-liner
  PID:636
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "170^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - Executes a command shell one-liner
  PID:3904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:4944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - Executes a command shell one-liner
  PID:2136
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:4688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:1372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - Executes a command shell one-liner
  PID:3452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "154^217"
  2⤵
  PID:3412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:2972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "142^217"
  2⤵
  PID:3952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "183^217"
  2⤵
  - Executes a command shell one-liner
  PID:1560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "189^217"
  2⤵
  PID:2452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  - Executes a command shell one-liner
  PID:3364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "174^217"
  2⤵
  PID:2828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^217"
  2⤵
  PID:3584
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:5016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "186^217"
  2⤵
  PID:876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  PID:4904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:2080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:2820
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  PID:3216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:1048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:1060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:2168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2152
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:1348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:3872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:3752
- C:\Users\Admin\AppData\Local\Temp\c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
  "C:\Users\Admin\AppData\Local\Temp\c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe"
  2⤵
  PID:3416
- C:\Users\Admin\AppData\Local\Temp\c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
  "C:\Users\Admin\AppData\Local\Temp\c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:3028
- - C:\Users\Admin\AppData\Local\Temp\c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
    "C:\Users\Admin\AppData\Local\Temp\c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe"
    3⤵
    PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 e90785d0bfac02476ed38eceb1a51dc1ed8daad82925e2a3efdfa9b7c57b4feb
MD5 8c794ba394be7f146be22e549b49f8dd
SHA1 0e44a4411e0ddc0cea6d78f4b18a0237299ba6ce
SHA512 1351d2bf9a32df828758a164d19dc72b45e3854bc45ddaf5ee16afd62969286251f79febce62d20be4f9a8cc53fe0538f28ae870e6cc69d57f47d5ac8326ce26
TLSH
T19EC09B5B3BD120297877F35694B700363A71FD55413CC84D15D103CC05F160125417D3
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nse69E1.tmp\System.dll
Size 12KB
SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
MD5 81e268e27dbbcadbf116b5a9402195ab
SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
TLSH
T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nse69E1.tmp\nsExec.dll
Size 6KB
SHA256 e20666c498941d36bfd0eae411ad73c475d043cee39b50c31734a70eecaae0bb
MD5 13bd8e89dc79004d85ab02626e08c3c5
SHA1 0ef0efb3237233de26f55c4420753ed0fed418ad
SHA512 58841cc9e8313775a097a93e68952d8005b826bf1349dc24d49e3128b87e9021a028d2d4e738997390f1625f7ae7744a9ff85289f6c78f5ebd67c0da61ef2120
SSDEEP 96:pOBtYZKtPsrqBApt1JHpb9XWk7Qe06iE6mE6YNFyVOHd0+uUwEX:ptZKtrAJJJbP7iEHEbN8Ved0Pw
TLSH
T1F7D1F83A2AD12DF3D04889702827793ACBB9C8360F500650DF671EE225E1DE7DB2038B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2836-673-0x0000000074655000-0x0000000074656000-memory.dmp

Download

memory/3028-697-0x0000000000450000-0x00000000016A4000-memory.dmp

Download

memory/3028-691-0x0000000000450000-0x00000000016A4000-memory.dmp

Download

memory/3028-694-0x0000000000450000-0x00000000016A4000-memory.dmp

Download

memory/3028-688-0x0000000000450000-0x00000000016A4000-memory.dmp

Download

memory/3028-683-0x0000000000450000-0x00000000016A4000-memory.dmp

Download

memory/3028-700-0x0000000000450000-0x00000000016A4000-memory.dmp

Download

memory/3028-703-0x0000000000450000-0x00000000016A4000-memory.dmp

Download

memory/3028-706-0x0000000000450000-0x00000000016A4000-memory.dmp

Download

memory/3028-709-0x0000000000450000-0x00000000016A4000-memory.dmp

Download

memory/3028-712-0x0000000000450000-0x00000000016A4000-memory.dmp

Download

memory/3028-715-0x0000000000450000-0x00000000016A4000-memory.dmp

Download

memory/3028-718-0x0000000000450000-0x00000000016A4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads