snakekeylogger | 449bf249c170a1b3275c2a3ed45292244ecb49bf3be24ccef3809330de252d90

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29e1467e979c85abfbdd3da6b09e6c16.exe
Size

467KB
MD5

29e1467e979c85abfbdd3da6b09e6c16
SHA1

9cfa0ebefbc7ae0a2a87c255cae34c9e3ce239c5
SHA256

449bf249c170a1b3275c2a3ed45292244ecb49bf3be24ccef3809330de252d90
SHA512

00d7f1882e48222a94107b01734c4225461c28b39e7ff67597061360a1965b278962d3020406f4bcd6d38609d61e687f1b17e4f11735fc98697252bf0b17d79b
SSDEEP

6144:Ddnrsfcv+Q3KGZ+tJm5RliVL4KciREqBQPzF+eanHuU0LIyv5Vl0xq:KgkXm5zibmqBQPzEeqOUgHxB

Score

10^/10

snakekeylogger collection evasion keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot7169426142:AAG_Nuf4vFdD3YALIW-rE-UaNUDVey15SPM/sendMessage?chat_id=1545867115

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4652-691-0x0000000000480000-0x00000000016D4000-memory.dmp	family_snakekeylogger
behavioral2/memory/4652-692-0x0000000000480000-0x00000000004A6000-memory.dmp	family_snakekeylogger

Disables RegEdit via registry modification 1 IoCs
evasion

Processes:

REG.exe

description ioc process

Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" REG.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	REG.exe

Loads dropped DLL 64 IoCs

Processes:

29e1467e979c85abfbdd3da6b09e6c16.exe

pid	process
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe
4976	29e1467e979c85abfbdd3da6b09e6c16.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

29e1467e979c85abfbdd3da6b09e6c16.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	29e1467e979c85abfbdd3da6b09e6c16.exe
Key opened	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	29e1467e979c85abfbdd3da6b09e6c16.exe
Key opened	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	29e1467e979c85abfbdd3da6b09e6c16.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

35 drive.google.com
36 drive.google.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

47 checkip.dyndns.org
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

29e1467e979c85abfbdd3da6b09e6c16.exe

pid process

4652 29e1467e979c85abfbdd3da6b09e6c16.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

29e1467e979c85abfbdd3da6b09e6c16.exe29e1467e979c85abfbdd3da6b09e6c16.exe

pid process

4976 29e1467e979c85abfbdd3da6b09e6c16.exe
4652 29e1467e979c85abfbdd3da6b09e6c16.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

29e1467e979c85abfbdd3da6b09e6c16.exe

description pid process target process

PID 4976 set thread context of 4652 4976 29e1467e979c85abfbdd3da6b09e6c16.exe 29e1467e979c85abfbdd3da6b09e6c16.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

REG.exe

pid process

2076 REG.exe

flow	ioc
35	drive.google.com
36	drive.google.com

flow	ioc
47	checkip.dyndns.org

description	pid	process	target process
PID 4976 set thread context of 4652	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	29e1467e979c85abfbdd3da6b09e6c16.exe

pid	process
2076	REG.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

29e1467e979c85abfbdd3da6b09e6c16.exe

pid	process
4652	29e1467e979c85abfbdd3da6b09e6c16.exe
4652	29e1467e979c85abfbdd3da6b09e6c16.exe
4652	29e1467e979c85abfbdd3da6b09e6c16.exe
4652	29e1467e979c85abfbdd3da6b09e6c16.exe
4652	29e1467e979c85abfbdd3da6b09e6c16.exe
4652	29e1467e979c85abfbdd3da6b09e6c16.exe
4652	29e1467e979c85abfbdd3da6b09e6c16.exe
4652	29e1467e979c85abfbdd3da6b09e6c16.exe
4652	29e1467e979c85abfbdd3da6b09e6c16.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

29e1467e979c85abfbdd3da6b09e6c16.exe

pid process

4976 29e1467e979c85abfbdd3da6b09e6c16.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

29e1467e979c85abfbdd3da6b09e6c16.exe

description pid process

Token: SeDebugPrivilege 4652 29e1467e979c85abfbdd3da6b09e6c16.exe

description	pid	process
Token: SeDebugPrivilege	4652	29e1467e979c85abfbdd3da6b09e6c16.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

29e1467e979c85abfbdd3da6b09e6c16.exe

description	pid	process	target process
PID 4976 wrote to memory of 3288	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 3288	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 3288	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 2708	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 2708	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 2708	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 3660	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 3660	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 3660	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 1168	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 1168	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 1168	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 3764	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 3764	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 3764	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 4064	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 4064	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 4064	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 1436	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 1436	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 1436	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 3492	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 3492	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 3492	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 5000	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 5000	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 5000	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 4968	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 4968	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 4968	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 4624	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 4624	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 4624	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 1344	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 1344	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 1344	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 2188	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 2188	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 2188	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 3516	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 3516	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 3516	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 2232	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 2232	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 2232	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 2388	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 2388	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 2388	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 3272	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 3272	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 3272	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 1384	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 1384	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 1384	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 884	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 884	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 884	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 560	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 560	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 560	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 212	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 212	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 212	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe
PID 4976 wrote to memory of 4544	4976	29e1467e979c85abfbdd3da6b09e6c16.exe	cmd.exe

outlook_office_path 1 IoCs

Processes:

29e1467e979c85abfbdd3da6b09e6c16.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	29e1467e979c85abfbdd3da6b09e6c16.exe

outlook_win_path 1 IoCs

Processes:

29e1467e979c85abfbdd3da6b09e6c16.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	29e1467e979c85abfbdd3da6b09e6c16.exe

C:\Users\Admin\AppData\Local\Temp\29e1467e979c85abfbdd3da6b09e6c16.exe
"C:\Users\Admin\AppData\Local\Temp\29e1467e979c85abfbdd3da6b09e6c16.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4976

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:3288

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2708

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:3660

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:1168

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:3764

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:4064

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:1436

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:3492

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:5000

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:4968

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "242^177"
2⤵
PID:4624

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1344

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:2188

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:3516

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:2232

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:2388

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
2⤵
PID:3272

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1384

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:884

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:560

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
2⤵
PID:212

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:4544

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "220^177"
2⤵
PID:3692

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2040

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1092

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:3968

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4616

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:4568

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1084

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:3476

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4984

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1056

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:2972

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:2580

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:812

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4992

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:872

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:5028

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3256

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:748

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1316

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:4588

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2780

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4796

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2628

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:4568

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1084

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "193^177"
2⤵
PID:4412

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4092

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2188

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:520

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4284

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4532

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3876

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:952

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:4564

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2504

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1856

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3400

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1204

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:2656

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:4668

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3976

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1440

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3836

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2212

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2268

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3404

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:3172

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4192

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:2832

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:4776

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:3680

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:1236

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:1388

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:3960

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:948

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:2380

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:3692

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:4144

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:5068

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:4072

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:4160

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:4824

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "231^177"
2⤵
PID:2452

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:916

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1392

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:5060

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "196^177"
2⤵
PID:1412

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:2964

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:368

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
2⤵
PID:1884

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:2232

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:3204

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:884

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "210^177"
2⤵
PID:388

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:4576

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4588

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3400

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3924

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2604

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4796

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1752

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:2988

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:2432

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:1552

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
2⤵
PID:1900

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:5072

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:4088

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "136^177"
2⤵
PID:3564

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
2⤵
PID:840

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:468

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4992

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4040

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:948

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2380

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:2112

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:3160

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:5068

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4668

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3976

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1964

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4616

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:3860

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3476

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:5060

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:3472

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:4080

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:380

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:2580

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "193^177"
2⤵
PID:812

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:3680

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:3508

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:2504

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:244

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:3764

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:1892

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:2656

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:2260

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:1852

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:4824

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:2988

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2432

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:3468

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "226^177"
2⤵
PID:3120

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:5072

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:3308

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
2⤵
PID:4988

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1360

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:4776

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:232

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "225^177"
2⤵
PID:608

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:748

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2376

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "223^177"
2⤵
PID:2112

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:3160

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:5068

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:3688

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:4460

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:516

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4924

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1536

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:3040

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1552

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1364

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4328

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3188

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
2⤵
PID:4156

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
2⤵
PID:3360

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
2⤵
PID:412

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4960

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:552

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2504

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:244

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3920

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2632

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2644

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:3688

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3168

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:2992

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:464

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:4412

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:3468

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:1900

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:3552

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:2512

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:4192

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:4920

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:1596

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:4604

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:3972

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:4652

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:908

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2740

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:4900

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:4796

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:3492

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:4084

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "213^177"
2⤵
PID:968

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
2⤵
PID:3388

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2104

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:2188

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:3912

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:4432

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:3432

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4012

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:4156

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:3360

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2584

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1524

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:552

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3972

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:4652

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:908

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2740

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2484

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:3284

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4912

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:3836

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:3816

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:3104

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
2⤵
PID:5036

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:3040

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:3164

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "136^177"
2⤵
PID:4176

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
2⤵
PID:4416

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:4284

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "155^177"
2⤵
PID:1432

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4068

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3420

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:560

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:4848

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4584

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4936

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3444

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4072

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:1144

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:3484

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:4060

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:3860

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:4824

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:4436

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "196^177"
2⤵
PID:2972

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "194^177"
2⤵
PID:2760

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:3564

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:4944

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:2512

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:1360

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:3852

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:4108

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "242^177"
2⤵
PID:4624

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:2380

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:4144

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:3924

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "230^177"
2⤵
PID:3708

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4680

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "223^177"
2⤵
PID:3060

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "213^177"
2⤵
PID:3588

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:4956

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "198^177"
2⤵
PID:1964

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "225^177"
2⤵
PID:1344

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:316

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:4092

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "210^177"
2⤵
PID:2432

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
2⤵
PID:1552

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:2156

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:5028

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3208

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:412

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:4960

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2444

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1600

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2336

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4140

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:908

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2648

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1440

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4956

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1964

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1344

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:316

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:3120

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2432

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4548

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2232

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4988

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4316

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1432

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:832

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:2804

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:560

C:\Users\Admin\AppData\Local\Temp\29e1467e979c85abfbdd3da6b09e6c16.exe
"C:\Users\Admin\AppData\Local\Temp\29e1467e979c85abfbdd3da6b09e6c16.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4652

C:\Windows\SysWOW64\REG.exe
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
3⤵
- Disables RegEdit via registry modification
- Modifies registry key
PID:2076

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nse3896.tmp\Banner.dll
Filesize
3KB

MD5
71eab837b047124129461cb97f39745b

SHA1
6af00ad38ee73303b39970c96859ab6fe7cae584

SHA256
46cbb2797870de12aaac717da5c9bb9e2fab20d42e562d6c3925865caea2e81b

SHA512
66aa810dc1cd6e8e45ddd62ac88a4999b1b9a3c61aded5054ac8374d2ef5403021fa6bb104eb75c1f6ff4fdde5bc026f00c83dcb166febaaa47bebae0366276e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse3896.tmp\System.dll
Filesize
11KB

MD5
10e8921a6e7f6a74671b07dc3bde626f

SHA1
b7961066600ef193c5319dbeed3673dc60110a50

SHA256
c85142f86e1ec02f7ef8d5ba31b22031de3de9a16bce519d5482b824afb277eb

SHA512
4c19a7e3117baeec3f6a7f9a33cfab392255741137406db87fe5ac24def7f9a28b2ed0fc26f0f46c5d43ba1bb6675dea74410a797bfd265e38812b042460aa00

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse3896.tmp\UserInfo.dll
Filesize
3KB

MD5
3840a8875ee86c83b57b6e8eca96b013

SHA1
aeb5cd350b9bcc2e2903cf35da550e1223efead6

SHA256
b99a9f1783fa8156ce4480367e7b059b949fe083dbe66c7dc03e6bcc16f83f8b

SHA512
d0d1ebe62916b2e36664256f7e3d1009f8a928bccf0775943f6416255942fb5ac016b8459fc8fb91fd2a3ffb3272e3350578f12e1b5b40a44095ba6fc6f861c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse3896.tmp\nsDialogs.dll
Filesize
9KB

MD5
800aa26b2eb417363bf7ec155cd6c845

SHA1
eaec626eefb36850a90c3ffaa7eab1b8750aad1d

SHA256
c40817e6948ff1b6e1983ef9dd4f21394a81336e9fe2aea826eafe02a8df047e

SHA512
2714bbaa04f481ac6fd83f64106688299d34e6af33d3e13b890c1ca72b0570b9867d427deaab48ae1ee3fe836976f9ac4dac12feb1624787b6fb2787c8db9577

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse3896.tmp\nsExec.dll
Filesize
6KB

MD5
520d07e4bdab538c87b797d687717639

SHA1
569e5afdeee3cd6b2a77f715828ccb97b470f5fa

SHA256
9bf2482d0cdd486e1ec6d21eec00ac95538a7513a7f3c3ba117f7bf21a2b8f2d

SHA512
2302618d7b22913b11b1127378109f476de60f4231de377c5d0509b332e47efc12ca3294f3b36621eb7eb5b62b0a9ca98b5ef9692a807de58efd753594ab0185

Download Submit
memory/4652-691-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/4652-692-0x0000000000480000-0x00000000004A6000-memory.dmp

Filesize
152KB

Download
memory/4652-693-0x0000000035000000-0x00000000355A4000-memory.dmp

Filesize
5.6MB

Download
memory/4652-694-0x0000000034F20000-0x0000000034FBC000-memory.dmp

Filesize
624KB

Download
memory/4652-695-0x0000000035B30000-0x0000000035BC2000-memory.dmp

Filesize
584KB

Download
memory/4652-697-0x0000000035BF0000-0x0000000035C40000-memory.dmp

Filesize
320KB

Download
memory/4652-698-0x0000000035C70000-0x0000000035E32000-memory.dmp

Filesize
1.8MB

Download
memory/4652-699-0x0000000035E90000-0x0000000035E9A000-memory.dmp

Filesize
40KB

Download
memory/4976-678-0x00000000747F5000-0x00000000747F6000-memory.dmp

Filesize
4KB

Download