Malware Analysis Report

2025-06-16 03:47

Sample ID 220908-1675asdagj
Target 8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d
SHA256 8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d
Tags
eternity collection
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d

Threat Level: Known bad

The file 8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d was found to be: Known bad.

Malicious Activity Summary

eternity collection

Eternity

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

outlook_office_path

Suspicious use of SetWindowsHookEx

outlook_win_path

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-09-08 22:16

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-09-08 22:16

Reported

2022-09-08 22:21

Platform

win7-20220812-en

Max time kernel

293s

Max time network

40s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe"

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe

"C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.pl udp
PL 185.157.81.233:443 pastebin.pl tcp

Files

memory/1192-54-0x0000000076701000-0x0000000076703000-memory.dmp

memory/1192-55-0x0000000000CD0000-0x0000000000CD2000-memory.dmp

memory/1192-56-0x0000000000CD0000-0x00000000016F2000-memory.dmp

memory/1192-57-0x00000000FFBD0000-0x00000000FFFA1000-memory.dmp

memory/1192-58-0x0000000000CD0000-0x00000000016F2000-memory.dmp

memory/1192-59-0x0000000000CD0000-0x00000000016F2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-09-08 22:16

Reported

2022-09-08 22:22

Platform

win10-20220812-en

Max time kernel

70s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe"

Signatures

Eternity

eternity

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4820 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4820 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4000 wrote to memory of 1196 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 1196 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 1196 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\SysWOW64\cmd.exe
PID 1196 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1196 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1196 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1196 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1196 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1196 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1196 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1196 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1196 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4000 wrote to memory of 2900 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 2900 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 2900 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\SysWOW64\cmd.exe
PID 2900 wrote to memory of 3420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2900 wrote to memory of 3420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2900 wrote to memory of 3420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2900 wrote to memory of 4092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2900 wrote to memory of 4092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2900 wrote to memory of 4092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2900 wrote to memory of 3128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2900 wrote to memory of 3128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2900 wrote to memory of 3128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4000 wrote to memory of 5048 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 5048 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 5048 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\SysWOW64\cmd.exe
PID 5048 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 5048 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 5048 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 5048 wrote to memory of 2312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 5048 wrote to memory of 2312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 5048 wrote to memory of 2312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe

"C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile name="65001" key=clear

C:\Windows\SysWOW64\findstr.exe

findstr Key

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.pl udp
PL 185.157.81.233:443 pastebin.pl tcp
FR 40.79.150.121:443 tcp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
NL 104.144.69.143:6015 104.144.69.143 tcp
US 93.184.220.29:80 tcp

Files

memory/4820-116-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-117-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-118-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-119-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-120-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-121-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-122-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-123-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-124-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-125-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-126-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-127-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-128-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-130-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-129-0x0000000000910000-0x0000000001332000-memory.dmp

memory/4820-131-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-132-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-133-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-134-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-135-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-136-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-137-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-138-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-139-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-140-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-141-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-142-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-143-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-144-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-145-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-146-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-147-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-149-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-148-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-150-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-151-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-152-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-153-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-156-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-155-0x0000000000910000-0x0000000000912000-memory.dmp

memory/4820-154-0x00000000FE360000-0x00000000FE731000-memory.dmp

memory/4820-157-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-158-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-159-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-160-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-161-0x0000000000910000-0x0000000001332000-memory.dmp

memory/4820-162-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-163-0x0000000003C00000-0x0000000003C9C000-memory.dmp

memory/4820-164-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-166-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-165-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-167-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-169-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-171-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-173-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-174-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-172-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-170-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-175-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-176-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-168-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-177-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-179-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-182-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-183-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-181-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-180-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-178-0x0000000077200000-0x000000007738E000-memory.dmp

memory/4820-198-0x0000000000910000-0x0000000001332000-memory.dmp

memory/4820-201-0x0000000003750000-0x000000000378C000-memory.dmp

memory/4820-202-0x00000000037C0000-0x00000000037C6000-memory.dmp

memory/4820-204-0x000000000D2F0000-0x000000000D382000-memory.dmp

memory/4820-203-0x000000000D7F0000-0x000000000DCEE000-memory.dmp

memory/4820-206-0x0000000003CE0000-0x0000000003CEA000-memory.dmp

memory/4820-211-0x00000000FE360000-0x00000000FE731000-memory.dmp

memory/4820-212-0x000000000D520000-0x000000000D53A000-memory.dmp

memory/4820-213-0x000000000D540000-0x000000000D546000-memory.dmp

memory/4000-215-0x000000000045502E-mapping.dmp

memory/4820-223-0x0000000000910000-0x0000000001332000-memory.dmp

memory/4000-248-0x0000000000400000-0x000000000045A000-memory.dmp

memory/4000-282-0x0000000005D30000-0x0000000005D96000-memory.dmp

memory/4000-293-0x00000000062E0000-0x0000000006330000-memory.dmp

memory/1196-292-0x0000000000000000-mapping.dmp

memory/1664-302-0x0000000000000000-mapping.dmp

memory/1916-310-0x0000000000000000-mapping.dmp

memory/2116-312-0x0000000000000000-mapping.dmp

memory/2900-502-0x0000000000000000-mapping.dmp

memory/3420-508-0x0000000000000000-mapping.dmp

memory/4092-516-0x0000000000000000-mapping.dmp

memory/3128-518-0x0000000000000000-mapping.dmp

memory/5048-719-0x0000000000000000-mapping.dmp

memory/2692-725-0x0000000000000000-mapping.dmp

memory/2312-733-0x0000000000000000-mapping.dmp