remcos | c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5

Analysis

max time kernel
166s
max time network
169s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
Size 859KB
Sample260801-kdaeka1eqa
SHA256 c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5
MD5 86666c4287b523e0b80c14dbda780f08
SHA1 9e3b5d55d1d97611ba8fca903eb8bddf8a9b0810
SHA512 404ab18ab9b7a06e51aaf6cf5e8c3cb712d2ff5df7a581b548baa540edc6c226b15de08b993ebce942b60cb386235e852b0f21656a5343f216a7b0ecaeff0394
SSDEEP 24576:hv6Dmf5/CEa+Q1NQhaM6gpmaITJXe+56LqgBA:8qR6D1ir6gM1f8BA
TLSH
T160152392FB60E967D490DDB24CB4F02E47E7EC40D9A5870AFB01B64AF83C5C5994E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery execution remcos rat

Malware Config

Extracted

Family

remcos

Version

7.2.5 Pro

Botnet

RemoteHost

204.10.160.191:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-4J0YSW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Loads dropped DLL 64 IoCs

pid	Process
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
13	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4224	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
4224	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4860	cmd.exe
2188	cmd.exe
4708	cmd.exe
1332	cmd.exe
4404	cmd.exe
5444	cmd.exe
5240	cmd.exe
1788	cmd.exe
2652	cmd.exe
888	cmd.exe
904	cmd.exe
3484	cmd.exe
4848	cmd.exe
3664	cmd.exe
2320	cmd.exe
3892	cmd.exe
1808	cmd.exe
4816	cmd.exe
6128	cmd.exe
4632	cmd.exe
708	cmd.exe
1348	cmd.exe
4596	cmd.exe
1944	cmd.exe
2356	cmd.exe
5992	cmd.exe
560	cmd.exe
5672	cmd.exe
2800	cmd.exe
2960	cmd.exe
4256	cmd.exe
2804	cmd.exe
2708	cmd.exe
4948	cmd.exe
2512	cmd.exe
2872	cmd.exe
4620	cmd.exe
6076	cmd.exe
4352	cmd.exe
4288	cmd.exe
1712	cmd.exe
4344	cmd.exe
5728	cmd.exe
2716	cmd.exe
1392	cmd.exe
1936	cmd.exe
4088	cmd.exe
5624	cmd.exe
4080	cmd.exe
1804	cmd.exe
3400	cmd.exe
2644	cmd.exe
4828	cmd.exe
4744	cmd.exe
3160	cmd.exe
3836	cmd.exe
2800	cmd.exe
4456	cmd.exe
5300	cmd.exe
4800	cmd.exe
5444	cmd.exe
2520	cmd.exe
1492	cmd.exe
4992	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4224	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 1536	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	89
PID 4328 wrote to memory of 2532	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	91
PID 4328 wrote to memory of 1648	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	93
PID 4328 wrote to memory of 4816	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	95
PID 4328 wrote to memory of 4380	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	97
PID 4328 wrote to memory of 5896	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	99
PID 4328 wrote to memory of 4476	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	101
PID 4328 wrote to memory of 5944	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	103
PID 4328 wrote to memory of 3888	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	105
PID 4328 wrote to memory of 5304	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	107
PID 4328 wrote to memory of 2508	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	109
PID 4328 wrote to memory of 1100	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	111
PID 4328 wrote to memory of 5300	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	113
PID 4328 wrote to memory of 1080	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	115
PID 4328 wrote to memory of 4132	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	117
PID 4328 wrote to memory of 6084	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	119
PID 4328 wrote to memory of 2652	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	121
PID 4328 wrote to memory of 1400	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	123
PID 4328 wrote to memory of 788	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	125
PID 4328 wrote to memory of 3744	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	127
PID 4328 wrote to memory of 5328	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	129
PID 4328 wrote to memory of 6128	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	131
PID 4328 wrote to memory of 2596	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	133
PID 4328 wrote to memory of 2976	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	135
PID 4328 wrote to memory of 4716	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	137
PID 4328 wrote to memory of 2520	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	139
PID 4328 wrote to memory of 3664	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	141
PID 4328 wrote to memory of 2644	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	143
PID 4328 wrote to memory of 2872	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	145
PID 4328 wrote to memory of 3300	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	147
PID 4328 wrote to memory of 4948	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	149
PID 4328 wrote to memory of 5968	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	151
PID 4328 wrote to memory of 5084	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	153
PID 4328 wrote to memory of 4832	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	155
PID 4328 wrote to memory of 4952	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	157
PID 4328 wrote to memory of 2984	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	159
PID 4328 wrote to memory of 4620	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	161
PID 4328 wrote to memory of 4256	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	163
PID 4328 wrote to memory of 5324	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	165
PID 4328 wrote to memory of 6004	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	167
PID 4328 wrote to memory of 6076	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	169
PID 4328 wrote to memory of 1220	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	171
PID 4328 wrote to memory of 4624	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	173
PID 4328 wrote to memory of 4272	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	175
PID 4328 wrote to memory of 3836	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	177
PID 4328 wrote to memory of 888	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	179
PID 4328 wrote to memory of 4360	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	181
PID 4328 wrote to memory of 2320	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	183
PID 4328 wrote to memory of 248	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	185
PID 4328 wrote to memory of 1624	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	187
PID 4328 wrote to memory of 3120	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	189
PID 4328 wrote to memory of 3604	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	191
PID 4328 wrote to memory of 3656	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	193
PID 4328 wrote to memory of 4804	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	195
PID 4328 wrote to memory of 4352	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	197
PID 4328 wrote to memory of 2016	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	199
PID 4328 wrote to memory of 1868	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	201
PID 4328 wrote to memory of 5672	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	203
PID 4328 wrote to memory of 1464	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	205
PID 4328 wrote to memory of 1944	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	207
PID 4328 wrote to memory of 4492	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	209
PID 4328 wrote to memory of 3004	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	211
PID 4328 wrote to memory of 2800	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	213
PID 4328 wrote to memory of 6128	4328	c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe	215

C:\Users\Admin\AppData\Local\Temp\c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
"C:\Users\Admin\AppData\Local\Temp\c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  PID:1536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:1648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  - Executes a command shell one-liner
  PID:4816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:4380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5896
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:4476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:5944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:3888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:5304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "154^217"
  2⤵
  PID:2508
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:1100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5300
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:1080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  PID:4132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:6084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  PID:2652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:1400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:3744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  PID:5328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:6128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "180^217"
  2⤵
  PID:2596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:4716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  - Executes a command shell one-liner
  PID:2520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:3664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:2872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3300
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  PID:5084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  PID:4832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:4620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:4256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5324
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:6004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:1220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2320
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "169^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:248
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:3604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  PID:2016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:1868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:5672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:1464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:1944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:4800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:5240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  - Executes a command shell one-liner
  PID:4632
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:5520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:1112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:3900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  PID:5048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:3892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  - Executes a command shell one-liner
  PID:904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  PID:6132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - Executes a command shell one-liner
  PID:708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:5296
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:4344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:5008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:4812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "143^217"
  2⤵
  PID:4236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:1332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:3364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  PID:3836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "172^217"
  2⤵
  - Executes a command shell one-liner
  PID:5444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  - Executes a command shell one-liner
  PID:1392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:1956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  PID:120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:1164
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  PID:2996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "186^217"
  2⤵
  PID:6108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:1868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:2708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - Executes a command shell one-liner
  PID:1492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:4556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  - Executes a command shell one-liner
  PID:4860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  PID:5736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:6096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:2356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - Executes a command shell one-liner
  PID:4404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:1116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:1936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:4288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  PID:4080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:1264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "169^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  - Executes a command shell one-liner
  PID:4088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:2836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:5748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  PID:1124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:3236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:4804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:4352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:1376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:5732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:3344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:5404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "138^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:4492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  PID:2024
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  - Executes a command shell one-liner
  PID:2800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:2952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^217"
  2⤵
  PID:5556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:6024
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "183^217"
  2⤵
  PID:3488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  PID:5700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:3860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - Executes a command shell one-liner
  PID:4948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:4848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:6068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:3892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:1280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  - Executes a command shell one-liner
  PID:5624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:1260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3320
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "224^217"
  2⤵
  PID:4656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:1648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:1708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:5992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:2512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:6112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:4992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:4684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5680
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:1376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:5732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:3720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:5872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  - Executes a command shell one-liner
  PID:560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:5708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  PID:2960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:2596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4456
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:2104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  - Executes a command shell one-liner
  PID:1348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:2676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:2476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:5924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:5200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:4392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "189^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  PID:5000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:3316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:6140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:2188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:1712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:4316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:5116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:3236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:1008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:5948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  PID:5768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:4132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:3160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  PID:4552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  - Executes a command shell one-liner
  PID:1804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:3884
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "243^217"
  2⤵
  PID:3744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:1044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4724
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:1472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:4828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:3300
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:3168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:4308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "172^217"
  2⤵
  PID:6068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "170^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - Executes a command shell one-liner
  PID:4744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:2124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:4544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:2220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - Executes a command shell one-liner
  PID:1808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "154^217"
  2⤵
  PID:4912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:4720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:4580
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "142^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "183^217"
  2⤵
  PID:4596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "189^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  PID:244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "174^217"
  2⤵
  PID:5748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^217"
  2⤵
  PID:1124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:3236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "186^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  PID:5768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:3160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:1804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  PID:3884
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4844
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:1788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:2960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5608
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:1704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:1196
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:3484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:4848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:4708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1300
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5408
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:968
- C:\Users\Admin\AppData\Local\Temp\c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
  "C:\Users\Admin\AppData\Local\Temp\c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe"
  2⤵
  PID:884
- C:\Users\Admin\AppData\Local\Temp\c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
  "C:\Users\Admin\AppData\Local\Temp\c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:4224
- - C:\Users\Admin\AppData\Local\Temp\c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe
    "C:\Users\Admin\AppData\Local\Temp\c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe"
    3⤵
    PID:2844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 124B
SHA256 b4eb1b587a65930bcaf50ceb77e0ec405af0ff61504c7a1d87edbc9edc295d78
MD5 73147e1a5b3d1469cb55b5f2d11e6d77
SHA1 a807dbc97827766e294c29db4d6279a99dd922d6
SHA512 1adf6308b7a7abed715a365270cca87ed7bbc363f26b566141ad3c43200f837a0783654fd5eacead992beecd5ed99c83466c7b0936d8a9a40f19a99fd679b9ea
TLSH
T1E8B0925B3BD1242678A6E2AA98B700362A607994503CC85D25D0038C05F0A0220423D3
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp4E08.tmp\System.dll
Size 12KB
SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
MD5 81e268e27dbbcadbf116b5a9402195ab
SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
TLSH
T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp4E08.tmp\nsExec.dll
Size 6KB
SHA256 e20666c498941d36bfd0eae411ad73c475d043cee39b50c31734a70eecaae0bb
MD5 13bd8e89dc79004d85ab02626e08c3c5
SHA1 0ef0efb3237233de26f55c4420753ed0fed418ad
SHA512 58841cc9e8313775a097a93e68952d8005b826bf1349dc24d49e3128b87e9021a028d2d4e738997390f1625f7ae7744a9ff85289f6c78f5ebd67c0da61ef2120
SSDEEP 96:pOBtYZKtPsrqBApt1JHpb9XWk7Qe06iE6mE6YNFyVOHd0+uUwEX:ptZKtrAJJJbP7iEHEbN8Ved0Pw
TLSH
T1F7D1F83A2AD12DF3D04889702827793ACBB9C8360F500650DF671EE225E1DE7DB2038B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4224-697-0x0000000000450000-0x0000000001736000-memory.dmp

Download

memory/4224-688-0x0000000000450000-0x0000000001736000-memory.dmp

Download

memory/4224-691-0x0000000000450000-0x0000000001736000-memory.dmp

Download

memory/4224-694-0x0000000000450000-0x0000000001736000-memory.dmp

Download

memory/4224-683-0x0000000000450000-0x0000000001736000-memory.dmp

Download

memory/4224-700-0x0000000000450000-0x0000000001736000-memory.dmp

Download

memory/4224-703-0x0000000000450000-0x0000000001736000-memory.dmp

Download

memory/4224-706-0x0000000000450000-0x0000000001736000-memory.dmp

Download

memory/4224-709-0x0000000000450000-0x0000000001736000-memory.dmp

Download

memory/4224-712-0x0000000000450000-0x0000000001736000-memory.dmp

Download

memory/4224-715-0x0000000000450000-0x0000000001736000-memory.dmp

Download

memory/4224-718-0x0000000000450000-0x0000000001736000-memory.dmp

Download

memory/4328-673-0x0000000074535000-0x0000000074536000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads