formbook | 2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
Size 285KB
Sample260825-ajqcvsvgpd
SHA256 2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc
MD5 3970164bd18987cfc471ad7cc228b0c9
SHA1 47d4cc9959d92c7f19fe29fd7584d49100267710
SHA512 97b8e19ca6da292c5b4c625c745c1c1856b1f7b06778d06cfe5dc8a1be434f5822105692a15e2ad833c48a6b6ade4562a83b3a2dcc1fac506b06e36d2a3798ff
SSDEEP 6144:5pZgUXltNBTzuVuEEpTsnKZ0+PtF3eh9GSBLkd:rF6uEEpGK1lBwbBY
TLSH
T1A254E0867684D4EAD9366471C8BBDD220B277E6A97D15B0F33B1362E6873113072FA07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution formbook rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3212-974-0x0000000000400000-0x00000000016E6000-memory.dmp	family_formbook

Loads dropped DLL 64 IoCs

pid	Process
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3212	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
3212	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\Observationsklasse.exe	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4496	cmd.exe
3572	cmd.exe
4388	cmd.exe
5128	cmd.exe
4100	cmd.exe
3516	cmd.exe
776	cmd.exe
5184	cmd.exe
1128	cmd.exe
4856	cmd.exe
2336	cmd.exe
1936	cmd.exe
4548	cmd.exe
1568	cmd.exe
3832	cmd.exe
5332	cmd.exe
4940	cmd.exe
2312	cmd.exe
5732	cmd.exe
1276	cmd.exe
944	cmd.exe
4804	cmd.exe
2904	cmd.exe
2352	cmd.exe
5028	cmd.exe
3032	cmd.exe
756	cmd.exe
6060	cmd.exe
2120	cmd.exe
2996	cmd.exe
4888	cmd.exe
4772	cmd.exe
5560	cmd.exe
4644	cmd.exe
2412	cmd.exe
4580	cmd.exe
4804	cmd.exe
2604	cmd.exe
3924	cmd.exe
2612	cmd.exe
4048	cmd.exe
616	cmd.exe
2988	cmd.exe
4568	cmd.exe
2756	cmd.exe
4356	cmd.exe
3308	cmd.exe
4940	cmd.exe
3908	cmd.exe
3308	cmd.exe
2888	cmd.exe
2012	cmd.exe
5760	cmd.exe
2744	cmd.exe
3316	cmd.exe
2868	cmd.exe
4772	cmd.exe
2732	cmd.exe
1348	cmd.exe
5732	cmd.exe
2632	cmd.exe
1156	cmd.exe
1660	cmd.exe
3800	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4668	3212	WerFault.exe	681

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3212	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
3212	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 3908	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	89
PID 4328 wrote to memory of 4820	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	91
PID 4328 wrote to memory of 352	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	93
PID 4328 wrote to memory of 2772	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	95
PID 4328 wrote to memory of 5800	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	97
PID 4328 wrote to memory of 2652	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	100
PID 4328 wrote to memory of 5604	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	102
PID 4328 wrote to memory of 776	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	104
PID 4328 wrote to memory of 1056	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	106
PID 4328 wrote to memory of 3732	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	108
PID 4328 wrote to memory of 2436	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	110
PID 4328 wrote to memory of 4072	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	112
PID 4328 wrote to memory of 2352	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	114
PID 4328 wrote to memory of 3572	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	116
PID 4328 wrote to memory of 6076	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	118
PID 4328 wrote to memory of 4636	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	120
PID 4328 wrote to memory of 1576	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	122
PID 4328 wrote to memory of 1904	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	124
PID 4328 wrote to memory of 2240	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	126
PID 4328 wrote to memory of 1936	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	128
PID 4328 wrote to memory of 3692	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	130
PID 4328 wrote to memory of 5696	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	132
PID 4328 wrote to memory of 5184	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	134
PID 4328 wrote to memory of 2340	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	136
PID 4328 wrote to memory of 4892	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	138
PID 4328 wrote to memory of 3260	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	140
PID 4328 wrote to memory of 4796	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	142
PID 4328 wrote to memory of 5208	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	144
PID 4328 wrote to memory of 1496	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	146
PID 4328 wrote to memory of 5920	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	148
PID 4328 wrote to memory of 5820	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	150
PID 4328 wrote to memory of 4572	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	152
PID 4328 wrote to memory of 2612	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	154
PID 4328 wrote to memory of 6028	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	156
PID 4328 wrote to memory of 3320	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	158
PID 4328 wrote to memory of 4244	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	160
PID 4328 wrote to memory of 352	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	162
PID 4328 wrote to memory of 4592	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	164
PID 4328 wrote to memory of 5028	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	166
PID 4328 wrote to memory of 1460	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	168
PID 4328 wrote to memory of 5048	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	170
PID 4328 wrote to memory of 4580	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	172
PID 4328 wrote to memory of 3308	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	174
PID 4328 wrote to memory of 4316	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	176
PID 4328 wrote to memory of 5116	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	178
PID 4328 wrote to memory of 5632	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	180
PID 4328 wrote to memory of 4924	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	182
PID 4328 wrote to memory of 4960	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	184
PID 4328 wrote to memory of 756	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	186
PID 4328 wrote to memory of 2352	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	188
PID 4328 wrote to memory of 6092	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	190
PID 4328 wrote to memory of 1244	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	192
PID 4328 wrote to memory of 540	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	194
PID 4328 wrote to memory of 1012	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	196
PID 4328 wrote to memory of 3032	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	198
PID 4328 wrote to memory of 5964	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	200
PID 4328 wrote to memory of 1816	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	202
PID 4328 wrote to memory of 2228	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	204
PID 4328 wrote to memory of 3692	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	206
PID 4328 wrote to memory of 4048	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	208
PID 4328 wrote to memory of 6060	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	210
PID 4328 wrote to memory of 5152	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	212
PID 4328 wrote to memory of 5732	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	214
PID 4328 wrote to memory of 824	4328	2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe	216

C:\Users\Admin\AppData\Local\Temp\2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
"C:\Users\Admin\AppData\Local\Temp\2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  - Executes a command shell one-liner
  PID:3908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4820
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  PID:2772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:5800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:2652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:5604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:1056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:3732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "154^217"
  2⤵
  PID:2436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4072
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - Executes a command shell one-liner
  PID:2352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  - Executes a command shell one-liner
  PID:3572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  PID:6076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:4636
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  PID:1576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:1904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:2240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  PID:3692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:5696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "180^217"
  2⤵
  - Executes a command shell one-liner
  PID:5184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:4892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  PID:3260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5208
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1496
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5920
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5820
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3320
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4580
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5632
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "169^217"
  2⤵
  PID:756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:3032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  PID:5964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:1816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:4048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:6060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  PID:5152
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  - Executes a command shell one-liner
  PID:5732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:5180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:5936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:1812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:4264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:2828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  PID:2000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - Executes a command shell one-liner
  PID:3308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  - Executes a command shell one-liner
  PID:4388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2820
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:4524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:2356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:5264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  - Executes a command shell one-liner
  PID:756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:1660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:5776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "143^217"
  2⤵
  PID:5096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:4856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  - Executes a command shell one-liner
  PID:2888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "172^217"
  2⤵
  PID:2520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:1956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:4452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  PID:2228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:608
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "186^217"
  2⤵
  PID:5996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  - Executes a command shell one-liner
  PID:5732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:5128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  - Executes a command shell one-liner
  PID:1276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  PID:3504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2564
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  - Executes a command shell one-liner
  PID:2756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  - Executes a command shell one-liner
  PID:4580
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  PID:5588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:4772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4496
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - Executes a command shell one-liner
  PID:2012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:4856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  PID:5376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:4692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "169^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:4208
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1196
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  - Executes a command shell one-liner
  PID:4804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:3368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  - Executes a command shell one-liner
  PID:3832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - Executes a command shell one-liner
  PID:4940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  - Executes a command shell one-liner
  PID:5332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:3740
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:5408
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "138^217"
  2⤵
  PID:1596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  PID:2896
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  PID:848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:4180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:6052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^217"
  2⤵
  PID:1732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  PID:1768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "183^217"
  2⤵
  PID:5192
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  - Executes a command shell one-liner
  PID:2120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:6068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:1868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:2604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:5760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:3264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "224^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5300
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  - Executes a command shell one-liner
  PID:4888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2632
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:1156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:4524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:2324
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - Executes a command shell one-liner
  PID:1660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:6092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  PID:5096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:5636
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  - Executes a command shell one-liner
  PID:4100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:2664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:5384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - Executes a command shell one-liner
  PID:2336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:1604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:2488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:4212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  - Executes a command shell one-liner
  PID:5760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:4612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:1216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "189^217"
  2⤵
  PID:4332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  PID:5124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:2732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - Executes a command shell one-liner
  PID:944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:4800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:2936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4928
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:5936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:4604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2632
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  - Executes a command shell one-liner
  PID:4772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:5444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:5672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  PID:1576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:2744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  - Executes a command shell one-liner
  PID:3516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  PID:2628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "243^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:2412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5072
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4164
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:4804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:4300
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - Executes a command shell one-liner
  PID:4940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:1460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:2944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "172^217"
  2⤵
  PID:4084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "170^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4884
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:1412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:3540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:6064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:5752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:2572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:2984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "154^217"
  2⤵
  PID:3572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:2012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:1656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - Executes a command shell one-liner
  PID:3924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "142^217"
  2⤵
  PID:2528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "183^217"
  2⤵
  - Executes a command shell one-liner
  PID:2904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "189^217"
  2⤵
  - Executes a command shell one-liner
  PID:3316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  PID:1672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "174^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^217"
  2⤵
  PID:4664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:3376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "186^217"
  2⤵
  PID:5464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  PID:3616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  - Executes a command shell one-liner
  PID:2868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4192
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:3800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:1196
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  PID:4684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:3368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:4568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:1240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:1348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:2876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:4496
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4636
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:1668
- C:\Users\Admin\AppData\Local\Temp\2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
  "C:\Users\Admin\AppData\Local\Temp\2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe"
  2⤵
  PID:3348
- C:\Users\Admin\AppData\Local\Temp\2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
  "C:\Users\Admin\AppData\Local\Temp\2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3212
- - C:\Users\Admin\AppData\Local\Temp\2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe
    "C:\Users\Admin\AppData\Local\Temp\2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe"
    3⤵
    PID:2664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2028
    3⤵
    - Program crash
    PID:4668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3212 -ip 3212
1⤵
PID:788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx6FC8.tmp\System.dll
Size 11KB
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
TLSH
T1A8325C15136046F3E1D2853C542B3AAB6FB869118AF04E43CFB36852EF396C79D79352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx6FC8.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
TLSH
T16BD1097675E22EB3C50ACA313C127A2B57F8C8111B9401549B938BD238C5EB3EA28282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3212-959-0x0000000000400000-0x00000000016E6000-memory.dmp

Download

memory/3212-962-0x0000000000400000-0x00000000016E6000-memory.dmp

Download

memory/3212-973-0x0000000000400000-0x00000000016E6000-memory.dmp

Download

memory/3212-974-0x0000000000400000-0x00000000016E6000-memory.dmp

Download

memory/4328-958-0x0000000010004000-0x0000000010005000-memory.dmp

Download