Malware Analysis Report

2024-10-18 23:17

Sample ID 240710-y7feka1arg
Target 82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e
SHA256 82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e
Tags
snakekeylogger collection keylogger spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e

Threat Level: Known bad

The file 82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e was found to be: Known bad.

Malicious Activity Summary

snakekeylogger collection keylogger spyware stealer

Snake Keylogger

Snake Keylogger payload

Loads dropped DLL

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtCreateThreadExHideFromDebugger

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Program crash

NSIS installer

Suspicious use of WriteProcessMemory

outlook_win_path

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

outlook_office_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-10 20:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-07-10 20:25

Reported

2024-07-10 20:29

Platform

win10v2004-20240709-en

Max time kernel

219s

Max time network

206s

Command Line

"C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe"

Signatures

Snake Keylogger

stealer keylogger snakekeylogger

Snake Keylogger payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Common Files\ideologised\responseless.hvo C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\resources\postnaris\Omsaetningen.ini C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Enumerates physical storage devices

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1068 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe

"C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "250^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "255^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "253^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "242^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "208^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "197^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "247^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "240^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "220^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "201^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "137^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "193^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "201^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "137^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "159^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "250^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "255^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "253^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "231^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "197^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "196^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "208^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "240^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "222^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "210^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "201^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "201^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "193^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "159^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "250^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "255^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "253^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "226^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "197^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "247^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "225^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "222^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "223^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "197^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "134^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "134^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "159^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "250^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "255^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "253^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "208^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "213^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "247^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "155^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "159^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "196^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "194^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "242^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "208^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "230^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "223^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "213^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "222^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "198^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "225^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "222^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "210^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "240^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe

"C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 drive.google.com udp
GB 142.250.180.14:443 drive.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 172.217.169.67:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 172.217.169.65:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 65.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
JP 132.226.8.169:80 checkip.dyndns.org tcp
US 8.8.8.8:53 169.8.226.132.in-addr.arpa udp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 104.21.67.152:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 152.67.21.104.in-addr.arpa udp
US 8.8.8.8:53 233.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nslA152.tmp\System.dll

MD5 bff2a11d26d951ec34679b8fa1ee7192
SHA1 d3de629a5a86ee35b6afa1802f6ac8b141b07062
SHA256 aec5af9c7c551c3590492b0c0120b535b55ab048e84f695b617a5ab4b1a52f54
SHA512 1dce397c9cab3cd3b58c181688286a89067c743f195403694819c2d988435268ffd01939beaaa17cfa344160c89414f28273b70de154be0def034af8c470723a

C:\Users\Admin\AppData\Local\Temp\nslA152.tmp\nsExec.dll

MD5 fdee755c4987e9859e0eec130ee22efd
SHA1 ba32823881a98da6b92eee1d866be2b3a20c6e5d
SHA256 e18984e78d58b2383f2c1e8ed0000088ee8d9d469345383618f179176fcddff6
SHA512 31ba3dad22fd9b78ab3f6017c4373c923d048cf0c010900a131c4533ef185d408a88052aa4cf6184dbe484d44aab9cfa94a052185cf0b9ad19286ed921e4723f

memory/1068-662-0x0000000074465000-0x0000000074466000-memory.dmp

memory/4580-675-0x0000000000830000-0x0000000001A84000-memory.dmp

memory/4580-676-0x0000000000830000-0x0000000000856000-memory.dmp

memory/4580-677-0x0000000035850000-0x0000000035DF4000-memory.dmp

memory/4580-678-0x0000000035E00000-0x0000000035E9C000-memory.dmp

memory/4580-680-0x00000000362B0000-0x0000000036300000-memory.dmp

memory/4580-681-0x0000000036300000-0x00000000364C2000-memory.dmp

memory/4580-682-0x00000000364D0000-0x0000000036562000-memory.dmp

memory/4580-683-0x00000000365B0000-0x00000000365BA000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-07-10 20:25

Reported

2024-07-10 20:30

Platform

win11-20240709-en

Max time kernel

299s

Max time network

281s

Command Line

"C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe"

Signatures

Snake Keylogger

stealer keylogger snakekeylogger

Snake Keylogger payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Common Files\ideologised\responseless.hvo C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\resources\postnaris\Omsaetningen.ini C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Enumerates physical storage devices

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2760 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe

"C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "250^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "255^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "253^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "242^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "208^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "197^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "247^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "240^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "220^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "201^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "137^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "193^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "201^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "137^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "159^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "250^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "255^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "253^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "231^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "197^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "196^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "208^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "240^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "222^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "210^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "201^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "201^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "193^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "159^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "250^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "255^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "253^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "226^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "197^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "247^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "225^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "222^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "223^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "197^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "134^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "134^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "159^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "250^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "255^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "253^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "208^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "213^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "247^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "155^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "159^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "196^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "194^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "242^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "208^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "230^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "223^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "213^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "222^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "198^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "225^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "222^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "210^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "240^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe

"C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 drive.google.com udp
GB 142.250.180.14:443 drive.google.com tcp
GB 172.217.169.67:80 o.pki.goog tcp
GB 172.217.169.67:80 o.pki.goog tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
GB 172.217.169.67:80 o.pki.goog tcp
GB 172.217.169.65:443 drive.usercontent.google.com tcp
JP 132.226.8.169:80 checkip.dyndns.org tcp
US 104.21.67.152:443 reallyfreegeoip.org tcp

Files

C:\Users\Admin\AppData\Local\Temp\nsx983A.tmp\System.dll

MD5 bff2a11d26d951ec34679b8fa1ee7192
SHA1 d3de629a5a86ee35b6afa1802f6ac8b141b07062
SHA256 aec5af9c7c551c3590492b0c0120b535b55ab048e84f695b617a5ab4b1a52f54
SHA512 1dce397c9cab3cd3b58c181688286a89067c743f195403694819c2d988435268ffd01939beaaa17cfa344160c89414f28273b70de154be0def034af8c470723a

C:\Users\Admin\AppData\Local\Temp\nsx983A.tmp\nsExec.dll

MD5 fdee755c4987e9859e0eec130ee22efd
SHA1 ba32823881a98da6b92eee1d866be2b3a20c6e5d
SHA256 e18984e78d58b2383f2c1e8ed0000088ee8d9d469345383618f179176fcddff6
SHA512 31ba3dad22fd9b78ab3f6017c4373c923d048cf0c010900a131c4533ef185d408a88052aa4cf6184dbe484d44aab9cfa94a052185cf0b9ad19286ed921e4723f

memory/2760-662-0x0000000073DE5000-0x0000000073DE6000-memory.dmp

memory/3096-677-0x0000000000830000-0x0000000001B47000-memory.dmp

memory/3096-678-0x0000000000830000-0x0000000000856000-memory.dmp

memory/3096-679-0x00000000359A0000-0x0000000035F46000-memory.dmp

memory/3096-680-0x0000000035F50000-0x0000000035FEC000-memory.dmp

memory/3096-682-0x0000000036440000-0x0000000036490000-memory.dmp

memory/3096-683-0x0000000036490000-0x0000000036652000-memory.dmp

memory/3096-684-0x0000000036660000-0x00000000366F2000-memory.dmp

memory/3096-685-0x0000000036740000-0x000000003674A000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-10 20:25

Reported

2024-07-10 20:30

Platform

win7-20240705-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Common Files\ideologised\responseless.hvo C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\resources\postnaris\Omsaetningen.ini C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2404 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe

"C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "250^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "255^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "253^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "242^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "208^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "197^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "247^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "240^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "220^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "201^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "137^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "193^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "201^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "137^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "159^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "250^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "255^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "253^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "231^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "197^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "196^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "208^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "240^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "222^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "210^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "201^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "201^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "193^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "159^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "250^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "255^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "253^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "226^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "197^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "247^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "225^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "222^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "223^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "197^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "134^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "134^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "159^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "250^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "255^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "253^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "208^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "213^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "247^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "155^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "159^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "196^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "194^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "242^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "208^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "230^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "223^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "213^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "222^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "198^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "225^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "222^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "210^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "240^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 540

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\nst8344.tmp\System.dll

MD5 bff2a11d26d951ec34679b8fa1ee7192
SHA1 d3de629a5a86ee35b6afa1802f6ac8b141b07062
SHA256 aec5af9c7c551c3590492b0c0120b535b55ab048e84f695b617a5ab4b1a52f54
SHA512 1dce397c9cab3cd3b58c181688286a89067c743f195403694819c2d988435268ffd01939beaaa17cfa344160c89414f28273b70de154be0def034af8c470723a

\Users\Admin\AppData\Local\Temp\nst8344.tmp\nsExec.dll

MD5 fdee755c4987e9859e0eec130ee22efd
SHA1 ba32823881a98da6b92eee1d866be2b3a20c6e5d
SHA256 e18984e78d58b2383f2c1e8ed0000088ee8d9d469345383618f179176fcddff6
SHA512 31ba3dad22fd9b78ab3f6017c4373c923d048cf0c010900a131c4533ef185d408a88052aa4cf6184dbe484d44aab9cfa94a052185cf0b9ad19286ed921e4723f

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-10 20:25

Reported

2024-07-10 20:29

Platform

win10-20240404-en

Max time kernel

212s

Max time network

194s

Command Line

"C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe"

Signatures

Snake Keylogger

stealer keylogger snakekeylogger

Snake Keylogger payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Common Files\ideologised\responseless.hvo C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\resources\postnaris\Omsaetningen.ini C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Enumerates physical storage devices

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2896 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe C:\Windows\SysWOW64\cmd.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe

"C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "250^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "255^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "253^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "242^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "208^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "197^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "247^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "240^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "220^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "201^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "137^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "193^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "201^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "137^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "159^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "250^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "255^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "253^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "231^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "197^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "196^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "208^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "240^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "222^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "210^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "201^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "201^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "193^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "159^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "250^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "255^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "253^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "226^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "197^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "247^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "225^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "222^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "223^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "197^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "134^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "134^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "159^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "250^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "255^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "244^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "253^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "227^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "208^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "213^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "247^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "132^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "135^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "133^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "155^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "159^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "196^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "194^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "212^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "130^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "131^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "139^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "242^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "208^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "221^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "230^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "223^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "213^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "222^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "198^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "225^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "222^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "210^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "240^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "153^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "195^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "128^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "157^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "216^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "145^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "129^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "152^177"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set /a "141^177"

C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe

"C:\Users\Admin\AppData\Local\Temp\82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e.exe"

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 drive.google.com udp
GB 142.250.180.14:443 drive.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 14.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
GB 172.217.169.67:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 172.217.169.65:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 65.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
BR 132.226.247.73:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 104.21.67.152:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 73.247.226.132.in-addr.arpa udp
US 8.8.8.8:53 152.67.21.104.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 169.117.168.52.in-addr.arpa udp

Files

\Users\Admin\AppData\Local\Temp\nsi80E9.tmp\System.dll

MD5 bff2a11d26d951ec34679b8fa1ee7192
SHA1 d3de629a5a86ee35b6afa1802f6ac8b141b07062
SHA256 aec5af9c7c551c3590492b0c0120b535b55ab048e84f695b617a5ab4b1a52f54
SHA512 1dce397c9cab3cd3b58c181688286a89067c743f195403694819c2d988435268ffd01939beaaa17cfa344160c89414f28273b70de154be0def034af8c470723a

\Users\Admin\AppData\Local\Temp\nsi80E9.tmp\nsExec.dll

MD5 fdee755c4987e9859e0eec130ee22efd
SHA1 ba32823881a98da6b92eee1d866be2b3a20c6e5d
SHA256 e18984e78d58b2383f2c1e8ed0000088ee8d9d469345383618f179176fcddff6
SHA512 31ba3dad22fd9b78ab3f6017c4373c923d048cf0c010900a131c4533ef185d408a88052aa4cf6184dbe484d44aab9cfa94a052185cf0b9ad19286ed921e4723f

memory/2896-662-0x0000000073485000-0x0000000073486000-memory.dmp

memory/784-677-0x0000000000830000-0x0000000001BB3000-memory.dmp

memory/784-678-0x0000000000830000-0x0000000000856000-memory.dmp

memory/784-679-0x00000000356F0000-0x0000000035BEE000-memory.dmp

memory/784-680-0x0000000035600000-0x000000003569C000-memory.dmp

memory/784-682-0x0000000036090000-0x0000000036252000-memory.dmp

memory/784-683-0x0000000036260000-0x00000000362F2000-memory.dmp

memory/784-684-0x0000000036340000-0x000000003634A000-memory.dmp