d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
Size 277KB
Sample260810-tg165asdqa
SHA256 d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005
MD5 12573405bc4fca639ff9be8299c4c61f
SHA1 e04f94a8659b47974efc4540b9a4edef5e414c22
SHA512 9b2d29b8727dcf97a1075d9e4d255ee8f0b4462105990fb4cafe0e6a6a78627762c04ec064a1654d0973b03936ca8935399191fd515e28f6f008d9bc0bbda72c
SSDEEP 6144:QpZgUXltNBTzfMVuEMqHJ54z8ayCipum5u6Hmk5:AFf4uEMqHJ56HCHz
TLSH
T11454E186B080D4EBD9666831D4BBDD2147263F6A83D15B0F2366773EA873163072F64B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
5992	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\Observationsklasse.exe	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3156	cmd.exe
5984	cmd.exe
5828	cmd.exe
4160	cmd.exe
5656	cmd.exe
5992	cmd.exe
2700	cmd.exe
4084	cmd.exe
4436	cmd.exe
2620	cmd.exe
1464	cmd.exe
3748	cmd.exe
5228	cmd.exe
5364	cmd.exe
6036	cmd.exe
3420	cmd.exe
5272	cmd.exe
2304	cmd.exe
1216	cmd.exe
5572	cmd.exe
700	cmd.exe
3036	cmd.exe
5892	cmd.exe
4412	cmd.exe
4892	cmd.exe
4524	cmd.exe
5836	cmd.exe
4704	cmd.exe
5292	cmd.exe
3976	cmd.exe
5536	cmd.exe
3572	cmd.exe
3664	cmd.exe
3876	cmd.exe
5472	cmd.exe
640	cmd.exe
1936	cmd.exe
3436	cmd.exe
1900	cmd.exe
4604	cmd.exe
1540	cmd.exe
5164	cmd.exe
3048	cmd.exe
2276	cmd.exe
1588	cmd.exe
4420	cmd.exe
788	cmd.exe
4168	cmd.exe
5664	cmd.exe
632	cmd.exe
6136	cmd.exe
4796	cmd.exe
1540	cmd.exe
1636	cmd.exe
3424	cmd.exe
5684	cmd.exe
3192	cmd.exe
1668	cmd.exe
872	cmd.exe
4364	cmd.exe
1188	cmd.exe
3748	cmd.exe
5224	cmd.exe
2156	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5124 wrote to memory of 1188	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	85
PID 5124 wrote to memory of 2276	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	87
PID 5124 wrote to memory of 4908	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	89
PID 5124 wrote to memory of 5332	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	91
PID 5124 wrote to memory of 5932	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	93
PID 5124 wrote to memory of 5960	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	95
PID 5124 wrote to memory of 1476	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	97
PID 5124 wrote to memory of 1660	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	99
PID 5124 wrote to memory of 4764	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	101
PID 5124 wrote to memory of 748	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	103
PID 5124 wrote to memory of 2304	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	105
PID 5124 wrote to memory of 552	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	107
PID 5124 wrote to memory of 5356	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	109
PID 5124 wrote to memory of 2692	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	111
PID 5124 wrote to memory of 4892	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	113
PID 5124 wrote to memory of 5580	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	115
PID 5124 wrote to memory of 5540	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	117
PID 5124 wrote to memory of 3856	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	119
PID 5124 wrote to memory of 5656	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	121
PID 5124 wrote to memory of 3028	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	123
PID 5124 wrote to memory of 4712	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	125
PID 5124 wrote to memory of 832	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	127
PID 5124 wrote to memory of 2900	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	129
PID 5124 wrote to memory of 3956	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	131
PID 5124 wrote to memory of 1216	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	133
PID 5124 wrote to memory of 640	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	135
PID 5124 wrote to memory of 5856	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	137
PID 5124 wrote to memory of 3876	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	139
PID 5124 wrote to memory of 2700	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	141
PID 5124 wrote to memory of 632	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	143
PID 5124 wrote to memory of 2588	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	145
PID 5124 wrote to memory of 5524	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	147
PID 5124 wrote to memory of 3464	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	149
PID 5124 wrote to memory of 3456	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	151
PID 5124 wrote to memory of 4092	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	153
PID 5124 wrote to memory of 1588	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	155
PID 5124 wrote to memory of 1272	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	157
PID 5124 wrote to memory of 4236	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	159
PID 5124 wrote to memory of 4524	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	161
PID 5124 wrote to memory of 708	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	163
PID 5124 wrote to memory of 5712	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	165
PID 5124 wrote to memory of 4968	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	167
PID 5124 wrote to memory of 5496	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	169
PID 5124 wrote to memory of 6040	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	171
PID 5124 wrote to memory of 4464	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	173
PID 5124 wrote to memory of 5280	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	175
PID 5124 wrote to memory of 5308	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	177
PID 5124 wrote to memory of 904	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	179
PID 5124 wrote to memory of 5032	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	181
PID 5124 wrote to memory of 5132	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	183
PID 5124 wrote to memory of 5272	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	185
PID 5124 wrote to memory of 5156	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	187
PID 5124 wrote to memory of 2968	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	189
PID 5124 wrote to memory of 4084	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	191
PID 5124 wrote to memory of 4204	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	193
PID 5124 wrote to memory of 4896	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	195
PID 5124 wrote to memory of 5244	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	197
PID 5124 wrote to memory of 5472	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	199
PID 5124 wrote to memory of 2512	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	201
PID 5124 wrote to memory of 5540	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	203
PID 5124 wrote to memory of 6072	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	206
PID 5124 wrote to memory of 3092	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	208
PID 5124 wrote to memory of 4816	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	210
PID 5124 wrote to memory of 672	5124	d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe	213

C:\Users\Admin\AppData\Local\Temp\d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
"C:\Users\Admin\AppData\Local\Temp\d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  - Executes a command shell one-liner
  PID:1188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - Executes a command shell one-liner
  PID:2276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:4908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:5932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:5960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:1476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:1660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:4764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "154^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:5356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  - Executes a command shell one-liner
  PID:4892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:5580
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  PID:5540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - Executes a command shell one-liner
  PID:5656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:3028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  PID:4712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "180^217"
  2⤵
  PID:2900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:3876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:2700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:632
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  PID:3464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  PID:3456
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:1588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:1272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5496
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "169^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:5272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:4084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4204
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  PID:4896
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:5472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:6072
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  PID:3092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  PID:4816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:2384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  - Executes a command shell one-liner
  PID:3192
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:3132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:3048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:2808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  PID:1776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - Executes a command shell one-liner
  PID:4704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:5372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:1572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:5688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - Executes a command shell one-liner
  PID:4420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:3160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:2896
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "143^217"
  2⤵
  - Executes a command shell one-liner
  PID:3664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - Executes a command shell one-liner
  PID:6136
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  PID:2440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "172^217"
  2⤵
  - Executes a command shell one-liner
  PID:4436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:2984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:5088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:2328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  - Executes a command shell one-liner
  PID:4604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "186^217"
  2⤵
  - Executes a command shell one-liner
  PID:5292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  - Executes a command shell one-liner
  PID:5228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:3572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:4576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  PID:5908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5136
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  - Executes a command shell one-liner
  PID:640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:4804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:2172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  PID:2108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  PID:2588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:2380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:5992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4164
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4072
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:5364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3820
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:1936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  PID:1692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  PID:1476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:5016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "169^217"
  2⤵
  - Executes a command shell one-liner
  PID:3976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:2664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:5788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  PID:1700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:4080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:4456
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:4576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - Executes a command shell one-liner
  PID:5536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "138^217"
  2⤵
  PID:1216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - Executes a command shell one-liner
  PID:3156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  PID:5408
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  - Executes a command shell one-liner
  PID:4796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:5708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^217"
  2⤵
  PID:3224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  PID:4888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "183^217"
  2⤵
  - Executes a command shell one-liner
  PID:4168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  PID:656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:3972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:1916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:5240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:2248
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "224^217"
  2⤵
  PID:4352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  - Executes a command shell one-liner
  PID:2620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:3308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:3748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:3572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:3920
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:1888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:1836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:2420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - Executes a command shell one-liner
  PID:5224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:5568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  - Executes a command shell one-liner
  PID:5664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:5992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:3764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:4692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - Executes a command shell one-liner
  PID:1668
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - Executes a command shell one-liner
  PID:1540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:4440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "189^217"
  2⤵
  PID:5268
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  PID:4828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - Executes a command shell one-liner
  PID:1636
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:5700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - Executes a command shell one-liner
  PID:6036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:668
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:3276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  PID:5516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:3948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3740
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  PID:3464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:2156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:2840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:5652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:5920
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  - Executes a command shell one-liner
  PID:4364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  PID:4260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:8
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "243^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:2440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5668
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:1700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:5292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:5692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:3340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "172^217"
  2⤵
  PID:5212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "170^217"
  2⤵
  PID:4596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:4904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:5360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "154^217"
  2⤵
  PID:4180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  - Executes a command shell one-liner
  PID:5984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:3224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - Executes a command shell one-liner
  PID:5164
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "142^217"
  2⤵
  - Executes a command shell one-liner
  PID:5572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "183^217"
  2⤵
  PID:5664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "189^217"
  2⤵
  PID:5992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  - Executes a command shell one-liner
  PID:700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "174^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^217"
  2⤵
  - Executes a command shell one-liner
  PID:5828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - Executes a command shell one-liner
  PID:3424
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  PID:3700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "186^217"
  2⤵
  PID:1476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  PID:5620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:2452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3176
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:3420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:5684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4608
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:3036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:3048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:4412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:2260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:1776
- C:\Users\Admin\AppData\Local\Temp\d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
  "C:\Users\Admin\AppData\Local\Temp\d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe"
  2⤵
  PID:1400
- C:\Users\Admin\AppData\Local\Temp\d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
  "C:\Users\Admin\AppData\Local\Temp\d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:5992
- - C:\Users\Admin\AppData\Local\Temp\d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe
    "C:\Users\Admin\AppData\Local\Temp\d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe"
    3⤵
    PID:5776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb1614.tmp\System.dll
Size 11KB
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
TLSH
T1A8325C15136046F3E1D2853C542B3AAB6FB869118AF04E43CFB36852EF396C79D79352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb1614.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
TLSH
T16BD1097675E22EB3C50ACA313C127A2B57F8C8111B9401549B938BD238C5EB3EA28282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5124-958-0x0000000010004000-0x0000000010005000-memory.dmp

Download

memory/5992-959-0x0000000000400000-0x0000000001654000-memory.dmp

Download

memory/5992-960-0x0000000000400000-0x0000000001654000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads