agenttesla | 33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
Size 343KB
Sample260810-slj8qs1glc
SHA256 33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6
MD5 9a765f1c66677f75071b26ae2487b1d6
SHA1 2084f98c0a2055684b7db1063006057117e4840f
SHA512 ad656841216bfa644fb3f958ef7c9cb37fa1791b30844319bb3be278d094f535e892692e6e0c1365ce774a13e706d151b2818aebd7bf6f3b9adab184cdb738ef
SSDEEP 6144:KxFS7C/noG9vC2+J3xSfHcjrZBXe2xkESEglIQ3yBwKIeeJP:MeAnoGhC2+V4fHcjNJfkESN3yq
TLSH
T1527402A37351E443C5600774597B8F20F7E5EC686A87275B2B80BFAD7DB32C1AE0A251
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.duct-master.com
Port
21
Username
[email protected]
Password
wcEwu}VSh(pAItLY

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Loads dropped DLL 64 IoCs

pid	Process
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ImagingDevices.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4916	ImagingDevices.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
4916	ImagingDevices.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\spegesild.ini	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Enzootics106.lnk	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
File opened for modification	C:\Windows\Enzootics106.lnk	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1160	cmd.exe
1884	cmd.exe
5400	cmd.exe
4544	cmd.exe
5768	cmd.exe
5012	cmd.exe
5336	cmd.exe
4608	cmd.exe
5956	cmd.exe
3348	cmd.exe
4172	cmd.exe
5824	cmd.exe
3804	cmd.exe
2488	cmd.exe
52	cmd.exe
5000	cmd.exe
5212	cmd.exe
4236	cmd.exe
1732	cmd.exe
5648	cmd.exe
5996	cmd.exe
952	cmd.exe
6060	cmd.exe
4256	cmd.exe
4148	cmd.exe
2976	cmd.exe
6088	cmd.exe
5696	cmd.exe
1824	cmd.exe
4508	cmd.exe
2708	cmd.exe
4648	cmd.exe
964	cmd.exe
1704	cmd.exe
1132	cmd.exe
2164	cmd.exe
52	cmd.exe
5308	cmd.exe
3236	cmd.exe
4800	cmd.exe
4544	cmd.exe
5400	cmd.exe
5476	cmd.exe
5856	cmd.exe
5724	cmd.exe
5460	cmd.exe
4288	cmd.exe
2124	cmd.exe
2560	cmd.exe
2392	cmd.exe
3348	cmd.exe
2716	cmd.exe
4664	cmd.exe
5612	cmd.exe
3256	cmd.exe
4172	cmd.exe
2176	cmd.exe
4512	cmd.exe
4188	cmd.exe
3220	cmd.exe
1012	cmd.exe
792	cmd.exe
4360	cmd.exe
4620	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4916	ImagingDevices.exe
4916	ImagingDevices.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	ImagingDevices.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 4308	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	89
PID 3764 wrote to memory of 4892	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	91
PID 3764 wrote to memory of 2276	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	93
PID 3764 wrote to memory of 1516	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	95
PID 3764 wrote to memory of 4996	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	97
PID 3764 wrote to memory of 6048	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	99
PID 3764 wrote to memory of 2972	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	101
PID 3764 wrote to memory of 3296	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	103
PID 3764 wrote to memory of 5956	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	105
PID 3764 wrote to memory of 5516	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	107
PID 3764 wrote to memory of 4544	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	109
PID 3764 wrote to memory of 1692	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	111
PID 3764 wrote to memory of 3348	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	113
PID 3764 wrote to memory of 1884	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	115
PID 3764 wrote to memory of 5556	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	117
PID 3764 wrote to memory of 1932	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	119
PID 3764 wrote to memory of 4268	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	121
PID 3764 wrote to memory of 5720	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	123
PID 3764 wrote to memory of 3444	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	125
PID 3764 wrote to memory of 3220	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	127
PID 3764 wrote to memory of 2588	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	129
PID 3764 wrote to memory of 5032	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	131
PID 3764 wrote to memory of 5500	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	133
PID 3764 wrote to memory of 1092	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	135
PID 3764 wrote to memory of 5824	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	137
PID 3764 wrote to memory of 1088	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	139
PID 3764 wrote to memory of 6060	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	141
PID 3764 wrote to memory of 5212	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	143
PID 3764 wrote to memory of 4704	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	145
PID 3764 wrote to memory of 5396	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	147
PID 3764 wrote to memory of 3400	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	149
PID 3764 wrote to memory of 2424	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	151
PID 3764 wrote to memory of 4256	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	153
PID 3764 wrote to memory of 5328	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	155
PID 3764 wrote to memory of 52	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	157
PID 3764 wrote to memory of 2456	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	159
PID 3764 wrote to memory of 1012	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	161
PID 3764 wrote to memory of 4592	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	163
PID 3764 wrote to memory of 4868	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	165
PID 3764 wrote to memory of 2304	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	167
PID 3764 wrote to memory of 8	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	169
PID 3764 wrote to memory of 3904	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	171
PID 3764 wrote to memory of 5660	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	173
PID 3764 wrote to memory of 792	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	175
PID 3764 wrote to memory of 1184	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	177
PID 3764 wrote to memory of 4652	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	179
PID 3764 wrote to memory of 1232	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	181
PID 3764 wrote to memory of 3416	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	183
PID 3764 wrote to memory of 5840	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	185
PID 3764 wrote to memory of 5960	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	187
PID 3764 wrote to memory of 4288	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	189
PID 3764 wrote to memory of 5308	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	191
PID 3764 wrote to memory of 2488	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	193
PID 3764 wrote to memory of 5436	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	195
PID 3764 wrote to memory of 5400	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	197
PID 3764 wrote to memory of 4188	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	199
PID 3764 wrote to memory of 4660	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	201
PID 3764 wrote to memory of 4172	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	203
PID 3764 wrote to memory of 5644	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	205
PID 3764 wrote to memory of 2728	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	207
PID 3764 wrote to memory of 4360	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	209
PID 3764 wrote to memory of 3852	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	211
PID 3764 wrote to memory of 6036	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	213
PID 3764 wrote to memory of 964	3764	33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe	215

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ImagingDevices.exe

C:\Users\Admin\AppData\Local\Temp\33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
"C:\Users\Admin\AppData\Local\Temp\33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  PID:4308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:4892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:2276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  PID:1516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:4996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:6048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:2972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:3296
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:5956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:5516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "154^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - Executes a command shell one-liner
  PID:3348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:1884
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:1932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  PID:4268
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - Executes a command shell one-liner
  PID:3220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:5032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "180^217"
  2⤵
  PID:5500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:5824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:6060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:5212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2424
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  - Executes a command shell one-liner
  PID:4256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  PID:5328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:52
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2456
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:1012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:8
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:3904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "169^217"
  2⤵
  PID:5840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:4288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:5308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:2488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  - Executes a command shell one-liner
  PID:4188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:4172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:4360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  PID:3852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "225^217"
  2⤵
  PID:6036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:2460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5724
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2164
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:52
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:2556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:2524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1296
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:1536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  PID:5660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:2828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:5516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:5124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:1208
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "143^217"
  2⤵
  PID:1852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:4816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "172^217"
  2⤵
  PID:5684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:1200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - Executes a command shell one-liner
  PID:5400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  PID:2588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - Executes a command shell one-liner
  PID:2124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  PID:6096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "186^217"
  2⤵
  - Executes a command shell one-liner
  PID:5824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:5028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:6036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:6128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:1044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:1156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  PID:2164
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:52
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:4576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  PID:5856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "224^217"
  2⤵
  PID:5444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:3972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:4236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:1552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  PID:3900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:4664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:2420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2608
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:1732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "161^217"
  2⤵
  - Executes a command shell one-liner
  PID:5648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  - Executes a command shell one-liner
  PID:4620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:5360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:5908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "169^217"
  2⤵
  PID:4396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:1420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:4204
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  PID:3804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:5508
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:4832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  PID:4528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:2864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:4728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:4892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:4508
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:5728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "138^217"
  2⤵
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:1296
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1176
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  PID:1060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:2412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:5132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^217"
  2⤵
  - Executes a command shell one-liner
  PID:5996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "183^217"
  2⤵
  PID:2000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "173^217"
  2⤵
  PID:4280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:4288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:4936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:2180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:4276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  PID:2560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:4796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  - Executes a command shell one-liner
  PID:5476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "224^217"
  2⤵
  PID:504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  PID:3852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "238^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:3432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2424
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:3524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:1012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:1516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:5536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:4776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:1296
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:4220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:5064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "146^217"
  2⤵
  - Executes a command shell one-liner
  PID:4544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  PID:3576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "151^217"
  2⤵
  PID:1084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "156^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "149^217"
  2⤵
  PID:6092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:4288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:4936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:2180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - Executes a command shell one-liner
  PID:5612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "139^217"
  2⤵
  - Executes a command shell one-liner
  PID:3256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:4428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:5032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "189^217"
  2⤵
  - Executes a command shell one-liner
  PID:4172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "159^217"
  2⤵
  PID:3112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:4984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  - Executes a command shell one-liner
  PID:4800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:3804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - Executes a command shell one-liner
  PID:2976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:5344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:2456
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - Executes a command shell one-liner
  PID:2392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  - Executes a command shell one-liner
  PID:5768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:3664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:1368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  PID:2232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2176
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "237^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "236^217"
  2⤵
  PID:1692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "239^217"
  2⤵
  - Executes a command shell one-liner
  PID:3348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  - Executes a command shell one-liner
  PID:1884
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "224^217"
  2⤵
  PID:1432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  PID:2516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:4512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "243^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:1704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:2480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:5000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:1968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  PID:3080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:1492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - Executes a command shell one-liner
  PID:5012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "247^217"
  2⤵
  PID:1300
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  PID:5952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  PID:2672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "172^217"
  2⤵
  - Executes a command shell one-liner
  PID:5336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "170^217"
  2⤵
  PID:4832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "188^217"
  2⤵
  PID:4120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  - Executes a command shell one-liner
  PID:4608
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "234^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "235^217"
  2⤵
  - Executes a command shell one-liner
  PID:5856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  - Executes a command shell one-liner
  PID:1824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "227^217"
  2⤵
  PID:4596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "154^217"
  2⤵
  PID:4992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "184^217"
  2⤵
  PID:3860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  PID:4332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "181^217"
  2⤵
  - Executes a command shell one-liner
  PID:5956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "142^217"
  2⤵
  PID:3008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "183^217"
  2⤵
  PID:3920
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "189^217"
  2⤵
  PID:5496
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "174^217"
  2⤵
  PID:1852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "137^217"
  2⤵
  - Executes a command shell one-liner
  PID:952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:3004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "182^217"
  2⤵
  - Executes a command shell one-liner
  PID:2716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "186^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4636
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "152^217"
  2⤵
  PID:1360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "241^217"
  2⤵
  PID:3516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:6008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "171^217"
  2⤵
  PID:5500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "232^217"
  2⤵
  PID:4172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:5464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:4800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:3804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  PID:1132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:2164
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5724
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4508
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  PID:5460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "245^217"
  2⤵
  PID:4836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:2416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "176^217"
  2⤵
  PID:5932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "249^217"
  2⤵
  PID:3776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "233^217"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "240^217"
  2⤵
  PID:3588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c set /a "229^217"
  2⤵
  - Executes a command shell one-liner
  PID:4648
- C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
  "C:\Users\Admin\AppData\Local\Temp\33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe"
  2⤵
  PID:6132
- C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
  "C:\Users\Admin\AppData\Local\Temp\33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  PID:4916
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Users\Admin\AppData\Local\Temp\33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe"
    3⤵
    PID:5456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw79BC.tmp\System.dll
Size 12KB
SHA256 c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
MD5 792b6f86e296d3904285b2bf67ccd7e0
SHA1 966b16f84697552747e0ddd19a4ba8ab5083af31
SHA512 97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
SSDEEP 192:rFiQJ771Jt17C8F1A5xjGNNvgFOiLb7lrT/L93:X71Jt48F2eNvgFF/L
TLSH
T140425A0583618EF3F5962D3C00667E2F2B79BE3416F140639FE34481A99A1CFA975392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw79BC.tmp\nsExec.dll
Size 6KB
SHA256 10675f13abaee592f14382349aa35d82fb52aab4e27eef61d0c83dec1f6b73da
MD5 5aa38904acdcc21a2fb8a1d30a72d92f
SHA1 a9ce7d1456698921791db91347dba0489918d70c
SHA512 f04740da561d7cd0dea5e839c9e1c339d4a3e63944d3566c94c921a3d170a69918a32dff3f3b43f13d55cc25a2dbb4c21104f062c324308ac5104179766402a3
SSDEEP 96:AOBtEB2flLkatAthPZJoi9jpfW/er6cBbcB/NFyVOHd0+uHwEX:AhB2flXAVJtjf6cBbcB/N8Ved0PZ
TLSH
T1A3D1D53A2AD12DF3D14889702817793B8BB9D8360F604650DB6B1AE535E5CE7DB3038B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Enzootics106.lnk

Path C:\Windows\Enzootics106.lnk
Size 914B
SHA256 7ec8c7b8ba21cb04374bac406e5a7e4bf02f939bbb1475c0f947b404e19be707
MD5 96bab32ac98beb607baf48060b3885a4
SHA1 f6380cff329fc1f822683354427be0b3584d9ae0
SHA512 5fdefec8e9bbc9f17fa16d840f455fffc8fe2616ca2150bf46ac35f8e190168569c4f3fdf9f3404dece846a85111e48e11555ab74a478420f779583d01345178
TLSH
T1D5114E140BFD0115E7F38F347AF5161659757982AE248E0D0089524E1CF1631D978F6F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3764-1251-0x0000000074325000-0x0000000074326000-memory.dmp

Download

memory/4916-1258-0x0000000000800000-0x0000000001AE6000-memory.dmp

Download

memory/4916-1259-0x0000000000800000-0x0000000000842000-memory.dmp

Download

memory/4916-1260-0x0000000037540000-0x0000000037AFA000-memory.dmp

Download

memory/4916-1261-0x00000000370F0000-0x0000000037156000-memory.dmp

Download

memory/4916-1262-0x0000000037BA0000-0x0000000037C32000-memory.dmp

Download

memory/4916-1263-0x0000000037B50000-0x0000000037BA0000-memory.dmp

Download

memory/4916-1264-0x0000000037530000-0x000000003753A000-memory.dmp

Download