449bf249c170a1b3275c2a3ed45292244ecb49bf3be24ccef3809330de252d90

General

Target

29e1467e979c85abfbdd3da6b09e6c16.exe
Size

467KB
MD5

29e1467e979c85abfbdd3da6b09e6c16
SHA1

9cfa0ebefbc7ae0a2a87c255cae34c9e3ce239c5
SHA256

449bf249c170a1b3275c2a3ed45292244ecb49bf3be24ccef3809330de252d90
SHA512

00d7f1882e48222a94107b01734c4225461c28b39e7ff67597061360a1965b278962d3020406f4bcd6d38609d61e687f1b17e4f11735fc98697252bf0b17d79b
SSDEEP

6144:Ddnrsfcv+Q3KGZ+tJm5RliVL4KciREqBQPzF+eanHuU0LIyv5Vl0xq:KgkXm5zibmqBQPzEeqOUgHxB

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 64 IoCs

Processes:

29e1467e979c85abfbdd3da6b09e6c16.exe

pid	process
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe
2080	29e1467e979c85abfbdd3da6b09e6c16.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2708 2080 WerFault.exe 29e1467e979c85abfbdd3da6b09e6c16.exe

pid	pid_target	process	target process
2708	2080	WerFault.exe	29e1467e979c85abfbdd3da6b09e6c16.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

29e1467e979c85abfbdd3da6b09e6c16.exe

description	pid	process	target process
PID 2080 wrote to memory of 2616	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2616	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2616	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2616	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2608	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2608	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2608	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2608	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2784	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2784	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2784	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2784	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2732	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2732	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2732	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2732	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2508	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2508	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2508	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2508	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2904	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2904	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2904	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2904	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2908	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2908	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2908	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2908	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 1548	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 1548	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 1548	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 1548	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 876	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 876	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 876	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 876	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 468	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 468	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 468	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 468	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2284	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2284	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2284	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2284	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 1436	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 1436	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 1436	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 1436	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 1232	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 1232	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 1232	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 1232	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 1204	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 1204	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 1204	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 1204	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2676	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2676	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2676	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2676	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2588	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2588	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2588	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 2080 wrote to memory of 2588	2080	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\29e1467e979c85abfbdd3da6b09e6c16.exe
"C:\Users\Admin\AppData\Local\Temp\29e1467e979c85abfbdd3da6b09e6c16.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:2616

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2608

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:2784

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:2732

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2508

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:2904

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:2908

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:1548

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:876

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:468

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "242^177"
2⤵
PID:2284

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1436

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:1232

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:1204

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:2676

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:2588

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
2⤵
PID:2232

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:320

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:1172

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:1068

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
2⤵
PID:600

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:1524

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "220^177"
2⤵
PID:2324

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2788

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1304

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:1928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1836

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2264

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1768

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2292

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1400

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2200

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:1984

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:2008

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1604

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1968

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1936

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2716

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2696

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2652

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2772

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2744

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2484

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1552

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1592

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1516

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1452

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2164

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "193^177"
2⤵
PID:1900

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1960

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:860

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1320

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2792

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2432

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1036

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:2528

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:904

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:308

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1608

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1096

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1524

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:3052

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:2428

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1028

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1012

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2060

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:688

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2020

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2208

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:2440

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2300

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:2200

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1916

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:2448

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:2092

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:2924

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2636

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:2700

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:2648

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2816

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:2768

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:2592

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:2744

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2176

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2504

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "231^177"
2⤵
PID:2900

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:996

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2144

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:980

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "196^177"
2⤵
PID:752

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:1512

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:2284

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
2⤵
PID:2376

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:1144

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:1320

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:2580

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "210^177"
2⤵
PID:2676

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:2588

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:332

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:952

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2236

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2452

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:600

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1120

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:696

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:2088

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:1564

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
2⤵
PID:1312

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:2848

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:896

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "136^177"
2⤵
PID:644

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
2⤵
PID:1796

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:568

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1044

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2988

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:872

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2280

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:1728

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:2340

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2596

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2824

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3000

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2740

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2936

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2664

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2492

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2556

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:2540

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:2112

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1628

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:1544

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "193^177"
2⤵
PID:1572

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:804

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1520

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:2404

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:1536

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:2916

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:852

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:2476

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:2256

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2024

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:772

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:320

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:528

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2004

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2012

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "226^177"
2⤵
PID:1176

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:2836

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:1040

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
2⤵
PID:2428

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1028

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:972

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:1208

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "225^177"
2⤵
PID:2420

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:2812

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2292

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "223^177"
2⤵
PID:1400

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:572

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:1996

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2272

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:1604

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2976

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2600

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2700

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:2648

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1612

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2668

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2512

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2544

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
2⤵
PID:2076

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
2⤵
PID:2548

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
2⤵
PID:2896

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1592

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1008

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:328

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:752

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1512

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2392

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1436

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2564

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2560

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2780

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:2308

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2224

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:2232

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1652

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:2236

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:2452

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:832

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:1120

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:1616

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:1956

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:1708

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:1928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:1216

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:2264

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2968

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:1640

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:2828

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:2844

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:1680

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "213^177"
2⤵
PID:2184

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
2⤵
PID:1460

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1752

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:1968

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:3044

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:1988

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2108

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2816

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2768

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:2592

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2492

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1912

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2520

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1980

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2912

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:108

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1548

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2380

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1468

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1900

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:1004

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:860

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:2876

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
2⤵
PID:3012

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:2348

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:2676

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "136^177"
2⤵
PID:664

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
2⤵
PID:792

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1644

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "155^177"
2⤵
PID:2248

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1740

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:444

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1884

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1684

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1304

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1716

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1012

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2060

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:688

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2020

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:2208

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2440

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:2300

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:2200

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "196^177"
2⤵
PID:1780

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "194^177"
2⤵
PID:1496

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:2056

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2632

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:2704

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:2496

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2648

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:1612

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "242^177"
2⤵
PID:2668

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:2604

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:2544

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:2076

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "230^177"
2⤵
PID:2548

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2896

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "223^177"
2⤵
PID:1592

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "213^177"
2⤵
PID:1484

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:1452

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "198^177"
2⤵
PID:1944

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "225^177"
2⤵
PID:1576

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1688

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:848

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "210^177"
2⤵
PID:1232

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
2⤵
PID:1204

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:2780

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2308

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2224

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2252

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:1668

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1172

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1068

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1340

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2124

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1888

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1632

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2196

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1216

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2264

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2960

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2104

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3068

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2304

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2884

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2804

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2008

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2092

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1968

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:3044

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 544
2⤵
- Program crash
PID:2708

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst15A5.tmp\Banner.dll
Filesize
3KB

MD5
71eab837b047124129461cb97f39745b

SHA1
6af00ad38ee73303b39970c96859ab6fe7cae584

SHA256
46cbb2797870de12aaac717da5c9bb9e2fab20d42e562d6c3925865caea2e81b

SHA512
66aa810dc1cd6e8e45ddd62ac88a4999b1b9a3c61aded5054ac8374d2ef5403021fa6bb104eb75c1f6ff4fdde5bc026f00c83dcb166febaaa47bebae0366276e

Download Submit
\Users\Admin\AppData\Local\Temp\nst15A5.tmp\System.dll
Filesize
11KB

MD5
10e8921a6e7f6a74671b07dc3bde626f

SHA1
b7961066600ef193c5319dbeed3673dc60110a50

SHA256
c85142f86e1ec02f7ef8d5ba31b22031de3de9a16bce519d5482b824afb277eb

SHA512
4c19a7e3117baeec3f6a7f9a33cfab392255741137406db87fe5ac24def7f9a28b2ed0fc26f0f46c5d43ba1bb6675dea74410a797bfd265e38812b042460aa00

Download Submit
\Users\Admin\AppData\Local\Temp\nst15A5.tmp\UserInfo.dll
Filesize
3KB

MD5
3840a8875ee86c83b57b6e8eca96b013

SHA1
aeb5cd350b9bcc2e2903cf35da550e1223efead6

SHA256
b99a9f1783fa8156ce4480367e7b059b949fe083dbe66c7dc03e6bcc16f83f8b

SHA512
d0d1ebe62916b2e36664256f7e3d1009f8a928bccf0775943f6416255942fb5ac016b8459fc8fb91fd2a3ffb3272e3350578f12e1b5b40a44095ba6fc6f861c1

Download Submit
\Users\Admin\AppData\Local\Temp\nst15A5.tmp\nsDialogs.dll
Filesize
9KB

MD5
800aa26b2eb417363bf7ec155cd6c845

SHA1
eaec626eefb36850a90c3ffaa7eab1b8750aad1d

SHA256
c40817e6948ff1b6e1983ef9dd4f21394a81336e9fe2aea826eafe02a8df047e

SHA512
2714bbaa04f481ac6fd83f64106688299d34e6af33d3e13b890c1ca72b0570b9867d427deaab48ae1ee3fe836976f9ac4dac12feb1624787b6fb2787c8db9577

Download Submit
\Users\Admin\AppData\Local\Temp\nst15A5.tmp\nsExec.dll
Filesize
6KB

MD5
520d07e4bdab538c87b797d687717639

SHA1
569e5afdeee3cd6b2a77f715828ccb97b470f5fa

SHA256
9bf2482d0cdd486e1ec6d21eec00ac95538a7513a7f3c3ba117f7bf21a2b8f2d

SHA512
2302618d7b22913b11b1127378109f476de60f4231de377c5d0509b332e47efc12ca3294f3b36621eb7eb5b62b0a9ca98b5ef9692a807de58efd753594ab0185

Download Submit

Analysis

Sharing