b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b

General

Target

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Size

353KB
MD5

7fb6a8bbcc54cc1619ffd51aa9818fd6
SHA1

1bce717878bbc4e5638ca3fcc8179addd64a77fb
SHA256

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b
SHA512

9f3a56a2d642b940d01438783604c374017e9a94114a4298e957c047ca3ddbdccd5d360e5003a5f6b588e8429f5938081a338470d9a2981216b9870aeffb1032
SSDEEP

6144:ZsKxNX1AZr4pmt/DjcT3VMgEWM9Ks1i6bgQz8N6IjXjuPD:JWZr4pmtbjcT3ygK/11bR8NVoD

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 64 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid	process
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

15 drive.google.com
11 drive.google.com
12 drive.google.com
13 drive.google.com
14 drive.google.com
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exeb187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid process

1816 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4556 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

flow	ioc
15	drive.google.com
11	drive.google.com
12	drive.google.com
13	drive.google.com
14	drive.google.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	pid	process	target process
PID 1816 set thread context of 4556	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Drops file in Windows directory 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description ioc process

File opened for modification C:\Windows\resources\frontalangrebs\appetizer.ini b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid process

1816 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	ioc	process
File opened for modification	C:\Windows\resources\frontalangrebs\appetizer.ini	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	pid	process	target process
PID 1816 wrote to memory of 4688	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4688	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4688	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4128	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4128	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4128	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4820	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4820	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4820	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 2208	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 2208	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 2208	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 3628	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 3628	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 3628	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 1612	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 1612	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 1612	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 2708	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 2708	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 2708	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 1836	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 1836	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 1836	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 2632	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 2632	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 2632	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4368	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4368	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4368	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 912	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 912	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 912	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4196	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4196	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4196	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 5112	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 5112	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 5112	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 2816	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 2816	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 2816	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 748	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 748	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 748	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 1692	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 1692	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 1692	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 2644	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 2644	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 2644	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4884	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4884	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4884	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 3412	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 3412	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 3412	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4816	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4816	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 4816	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 1256	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 1256	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 1256	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 1816 wrote to memory of 2328	1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
"C:\Users\Admin\AppData\Local\Temp\b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:4688

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:4128

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:4820

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:2208

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:3628

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:1612

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:2708

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:1836

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2632

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:4368

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "242^177"
2⤵
PID:912

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:4196

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:5112

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:2816

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:748

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:1692

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
2⤵
PID:2644

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4884

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:3412

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:4816

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
2⤵
PID:1256

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:2328

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "220^177"
2⤵
PID:3928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4288

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:4936

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:2716

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:984

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:4388

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:780

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1828

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2612

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4504

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:756

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:1428

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:5084

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4776

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:884

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3652

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:548

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:600

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1724

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1152

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3004

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1692

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:708

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2800

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2784

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "193^177"
2⤵
PID:3172

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4080

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3504

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:4280

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4696

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4936

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2684

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:4760

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:4976

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1124

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2116

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3384

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:412

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:3132

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:2276

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:960

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2808

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4368

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2384

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2080

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1948

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:4556

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2180

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:3604

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1576

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:4276

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:4224

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:1296

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:4980

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:2580

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:2300

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:1420

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:2436

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:4800

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:3864

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:984

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:3608

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "231^177"
2⤵
PID:4344

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4924

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2024

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:3060

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "196^177"
2⤵
PID:4520

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:5012

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:5040

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
2⤵
PID:5028

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:4192

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:3256

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:5112

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "210^177"
2⤵
PID:2096

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:752

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2376

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4380

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4880

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:4548

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2532

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1364

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:5092

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:4704

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:3928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:3004

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
2⤵
PID:2308

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4696

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:4708

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4936

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3964

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3052

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:3916

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4976

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1524

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2224

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2292

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1100

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:2708

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:5056

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3392

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3852

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2512

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1588

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2968

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2544

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4796

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3840

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:1464

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:1576

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4276

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:2592

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "193^177"
2⤵
PID:4868

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:1604

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1684

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:1252

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:2700

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:3812

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2148

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:2716

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:984

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:3608

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:1572

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:396

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:2936

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2744

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:3132

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "226^177"
2⤵
PID:5012

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2276

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:5040

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:4700

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
2⤵
PID:400

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:3756

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:1952

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:5112

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:4692

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1724

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "225^177"
2⤵
PID:3212

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:4084

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1692

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "223^177"
2⤵
PID:1784

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:3412

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:2780

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:3516

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:2328

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4080

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4268

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1240

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:824

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2020

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4444

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1512

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2396

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
2⤵
PID:2304

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1124

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
2⤵
PID:1916

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
2⤵
PID:2948

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3168

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:3440

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1836

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1468

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4684

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4512

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:400

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:548

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2196

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:764

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:748

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1164

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:1692

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1028

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:3892

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:4636

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:4076

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:1604

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:4340

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:4280

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1252

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:4908

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1420

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:4356

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2436

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:1716

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2684

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:2716

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:3864

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:1568

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:4376

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:3484

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1524

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:1084

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:2932

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "213^177"
2⤵
PID:3804

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
2⤵
PID:1312

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1800

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:960

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:3392

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:5028

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:4192

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:732

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2760

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:448

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2544

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:680

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4796

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:3888

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:5008

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1464

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2680

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4532

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:696

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:3644

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1296

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2668

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4980

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:856

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1912

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:3680

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:3936

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:4800

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:3940

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
2⤵
PID:3728

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:1904

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4428

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1372

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4924

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2628

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "155^177"
2⤵
PID:2844

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:3168

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:792

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2708

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2632

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2944

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:912

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2384

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4512

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4448

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3040

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:404

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:2496

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:764

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:3840

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2376

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:1164

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4380

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2800

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:4548

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:3216

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:3892

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "196^177"
2⤵
PID:2884

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4636

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "194^177"
2⤵
PID:3172

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:5092

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:4220

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:4020

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:4672

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:3488

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4908

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:4688

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:824

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2516

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2020

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "242^177"
2⤵
PID:2940

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:4820

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:4376

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:4344

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "230^177"
2⤵
PID:3952

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2432

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2024

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "223^177"
2⤵
PID:4504

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "213^177"
2⤵
PID:4944

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:1836

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:5012

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "198^177"
2⤵
PID:4776

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "225^177"
2⤵
PID:3972

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:4188

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:2760

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "210^177"
2⤵
PID:4292

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1952

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
2⤵
PID:2404

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:680

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:3748

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1552

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1136

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2344

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:1980

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2780

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:900

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:760

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1684

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4020

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:4584

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1988

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3564

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2148

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:5100

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4976

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1356

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1424

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1916

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2292

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:5016

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2688

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1468

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3656

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:884

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:2032

C:\Users\Admin\AppData\Local\Temp\b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
"C:\Users\Admin\AppData\Local\Temp\b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4556

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsx4D94.tmp\System.dll
Filesize
11KB

MD5
883eff06ac96966270731e4e22817e11

SHA1
523c87c98236cbc04430e87ec19b977595092ac8

SHA256
44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

SHA512
60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx4D94.tmp\nsExec.dll
Filesize
6KB

MD5
8d4278d0b0af44c989ed14ea40b75e06

SHA1
072f92761b281bc20d0bc3b3486251f60e6c259f

SHA256
9c50ba10ff8009137ad005aee7bdcace042ff343b37e11cd6ca45a6186ae977e

SHA512
1a22c3aa8ea1ff980b5c7812f75a9369cfd74f2b780039e79c0c52eb00cb019bac6f860e97a7279f0c8e4c890e5dd1bca31e69d6548fc73397d4fa05c8b12542

Download Submit
memory/1816-1260-0x0000000010004000-0x0000000010005000-memory.dmp

Filesize
4KB

Download
memory/4556-1261-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4556-1262-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download

pid	process
1816	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4556	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads