67a7379a6175f00d09621cb9ea4ffd6911305a4c0a6674c74643f14dced7457a

Analysis

max time kernel
150s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Galaxy_Swapper.exe
Size 51.1MB
Sample260707-vfl69aas51
SHA256 67a7379a6175f00d09621cb9ea4ffd6911305a4c0a6674c74643f14dced7457a
MD5 33eb60f009aea961568ab064ba4f57a9
SHA1 a7c64f5d25780e10c64e1416f9048d3479ed7629
SHA512 f81b4036996a1c280f301fa180b483b4722773593a1a2e20eae2f3a4e9804b7ffca04374d54e3cc651ad242d7242c2b55664652283393a51261fa4dc28bbf8e8
SSDEEP 786432:WMguj8Q4VfvyqFTrYZKuA1gIm7DmKaDgWz6+u67i:WiAQIHykHeAa7DU+e7i
TLSH
T119C7CE0773E601A5E5B7E2388AA75503D7B3B4635331DADF329D06111FABAD09A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.exe	Galaxy_Swapper.exe

Executes dropped EXE 1 IoCs

pid	Process
3300	screenCapture_1.3.2.exe

Loads dropped DLL 3 IoCs

pid	Process
4300	Galaxy_Swapper.exe
4300	Galaxy_Swapper.exe
4300	Galaxy_Swapper.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	api.gofile.io
4	api.gofile.io

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org
1	api.ipify.org
2	api.ipify.org

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5340	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1784	reg.exe
2472	cmd.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
5980	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
988	WMIC.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
3128	WMIC.exe
3128	WMIC.exe
3128	WMIC.exe
3128	WMIC.exe
456	powershell.exe
456	powershell.exe
3096	WMIC.exe
3096	WMIC.exe
3096	WMIC.exe
3096	WMIC.exe
3160	WMIC.exe
3160	WMIC.exe
3160	WMIC.exe
3160	WMIC.exe
3416	powershell.exe
3416	powershell.exe
3416	powershell.exe
5664	WMIC.exe
5664	WMIC.exe
5664	WMIC.exe
5664	WMIC.exe
1980	WMIC.exe
1980	WMIC.exe
1980	WMIC.exe
1980	WMIC.exe
5420	WMIC.exe
5420	WMIC.exe
5420	WMIC.exe
5420	WMIC.exe
988	WMIC.exe
988	WMIC.exe
988	WMIC.exe
988	WMIC.exe
5644	WMIC.exe
5644	WMIC.exe
5644	WMIC.exe
5644	WMIC.exe
5980	WMIC.exe
5980	WMIC.exe
5980	WMIC.exe
5980	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3128	WMIC.exe
Token: SeSecurityPrivilege	3128	WMIC.exe
Token: SeTakeOwnershipPrivilege	3128	WMIC.exe
Token: SeLoadDriverPrivilege	3128	WMIC.exe
Token: SeSystemProfilePrivilege	3128	WMIC.exe
Token: SeSystemtimePrivilege	3128	WMIC.exe
Token: SeProfSingleProcessPrivilege	3128	WMIC.exe
Token: SeIncBasePriorityPrivilege	3128	WMIC.exe
Token: SeCreatePagefilePrivilege	3128	WMIC.exe
Token: SeBackupPrivilege	3128	WMIC.exe
Token: SeRestorePrivilege	3128	WMIC.exe
Token: SeShutdownPrivilege	3128	WMIC.exe
Token: SeDebugPrivilege	3128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3128	WMIC.exe
Token: SeRemoteShutdownPrivilege	3128	WMIC.exe
Token: SeUndockPrivilege	3128	WMIC.exe
Token: SeManageVolumePrivilege	3128	WMIC.exe
Token: 33	3128	WMIC.exe
Token: 34	3128	WMIC.exe
Token: 35	3128	WMIC.exe
Token: 36	3128	WMIC.exe
Token: SeDebugPrivilege	456	powershell.exe
Token: SeIncreaseQuotaPrivilege	3128	WMIC.exe
Token: SeSecurityPrivilege	3128	WMIC.exe
Token: SeTakeOwnershipPrivilege	3128	WMIC.exe
Token: SeLoadDriverPrivilege	3128	WMIC.exe
Token: SeSystemProfilePrivilege	3128	WMIC.exe
Token: SeSystemtimePrivilege	3128	WMIC.exe
Token: SeProfSingleProcessPrivilege	3128	WMIC.exe
Token: SeIncBasePriorityPrivilege	3128	WMIC.exe
Token: SeCreatePagefilePrivilege	3128	WMIC.exe
Token: SeBackupPrivilege	3128	WMIC.exe
Token: SeRestorePrivilege	3128	WMIC.exe
Token: SeShutdownPrivilege	3128	WMIC.exe
Token: SeDebugPrivilege	3128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3128	WMIC.exe
Token: SeRemoteShutdownPrivilege	3128	WMIC.exe
Token: SeUndockPrivilege	3128	WMIC.exe
Token: SeManageVolumePrivilege	3128	WMIC.exe
Token: 33	3128	WMIC.exe
Token: 34	3128	WMIC.exe
Token: 35	3128	WMIC.exe
Token: 36	3128	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3096	WMIC.exe
Token: SeSecurityPrivilege	3096	WMIC.exe
Token: SeTakeOwnershipPrivilege	3096	WMIC.exe
Token: SeLoadDriverPrivilege	3096	WMIC.exe
Token: SeSystemProfilePrivilege	3096	WMIC.exe
Token: SeSystemtimePrivilege	3096	WMIC.exe
Token: SeProfSingleProcessPrivilege	3096	WMIC.exe
Token: SeIncBasePriorityPrivilege	3096	WMIC.exe
Token: SeCreatePagefilePrivilege	3096	WMIC.exe
Token: SeBackupPrivilege	3096	WMIC.exe
Token: SeRestorePrivilege	3096	WMIC.exe
Token: SeShutdownPrivilege	3096	WMIC.exe
Token: SeDebugPrivilege	3096	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3096	WMIC.exe
Token: SeRemoteShutdownPrivilege	3096	WMIC.exe
Token: SeUndockPrivilege	3096	WMIC.exe
Token: SeManageVolumePrivilege	3096	WMIC.exe
Token: 33	3096	WMIC.exe
Token: 34	3096	WMIC.exe
Token: 35	3096	WMIC.exe
Token: 36	3096	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 5344	4300	Galaxy_Swapper.exe	88
PID 5344 wrote to memory of 3168	5344	cmd.exe	89
PID 4300 wrote to memory of 2300	4300	Galaxy_Swapper.exe	90
PID 4300 wrote to memory of 6064	4300	Galaxy_Swapper.exe	91
PID 6064 wrote to memory of 456	6064	cmd.exe	92
PID 2300 wrote to memory of 3128	2300	cmd.exe	93
PID 4300 wrote to memory of 1616	4300	Galaxy_Swapper.exe	95
PID 4300 wrote to memory of 4976	4300	Galaxy_Swapper.exe	96
PID 4300 wrote to memory of 4244	4300	Galaxy_Swapper.exe	97
PID 1616 wrote to memory of 3096	1616	cmd.exe	98
PID 4976 wrote to memory of 3160	4976	cmd.exe	99
PID 4976 wrote to memory of 3428	4976	cmd.exe	100
PID 4244 wrote to memory of 3416	4244	cmd.exe	101
PID 4300 wrote to memory of 2384	4300	Galaxy_Swapper.exe	102
PID 2384 wrote to memory of 2232	2384	cmd.exe	207
PID 4300 wrote to memory of 5224	4300	Galaxy_Swapper.exe	104
PID 5224 wrote to memory of 5340	5224	cmd.exe	105
PID 4300 wrote to memory of 1480	4300	Galaxy_Swapper.exe	106
PID 4300 wrote to memory of 4992	4300	Galaxy_Swapper.exe	108
PID 4300 wrote to memory of 2780	4300	Galaxy_Swapper.exe	109
PID 4992 wrote to memory of 5664	4992	cmd.exe	111
PID 4992 wrote to memory of 4116	4992	cmd.exe	112
PID 1480 wrote to memory of 3508	1480	cmd.exe	113
PID 2780 wrote to memory of 2848	2780	cmd.exe	114
PID 4300 wrote to memory of 4012	4300	Galaxy_Swapper.exe	115
PID 4012 wrote to memory of 1980	4012	cmd.exe	116
PID 4012 wrote to memory of 4864	4012	cmd.exe	117
PID 4300 wrote to memory of 5832	4300	Galaxy_Swapper.exe	118
PID 5832 wrote to memory of 5420	5832	cmd.exe	119
PID 5832 wrote to memory of 5772	5832	cmd.exe	120
PID 4300 wrote to memory of 2696	4300	Galaxy_Swapper.exe	121
PID 2696 wrote to memory of 988	2696	cmd.exe	122
PID 2696 wrote to memory of 2788	2696	cmd.exe	245
PID 2848 wrote to memory of 3004	2848	csc.exe	124
PID 2780 wrote to memory of 3300	2780	cmd.exe	125
PID 4300 wrote to memory of 2488	4300	Galaxy_Swapper.exe	126
PID 2488 wrote to memory of 5644	2488	cmd.exe	127
PID 2488 wrote to memory of 4440	2488	cmd.exe	128
PID 4300 wrote to memory of 3796	4300	Galaxy_Swapper.exe	129
PID 3796 wrote to memory of 5980	3796	cmd.exe	130
PID 3796 wrote to memory of 4432	3796	cmd.exe	131
PID 4300 wrote to memory of 748	4300	Galaxy_Swapper.exe	132
PID 748 wrote to memory of 4188	748	cmd.exe	134
PID 4300 wrote to memory of 1104	4300	Galaxy_Swapper.exe	135
PID 1104 wrote to memory of 5884	1104	cmd.exe	137
PID 4300 wrote to memory of 2916	4300	Galaxy_Swapper.exe	138
PID 2916 wrote to memory of 1152	2916	cmd.exe	250
PID 4300 wrote to memory of 5692	4300	Galaxy_Swapper.exe	141
PID 5692 wrote to memory of 2336	5692	cmd.exe	252
PID 4300 wrote to memory of 3420	4300	Galaxy_Swapper.exe	144
PID 3420 wrote to memory of 4768	3420	cmd.exe	146
PID 4300 wrote to memory of 3340	4300	Galaxy_Swapper.exe	147
PID 3340 wrote to memory of 1580	3340	cmd.exe	149
PID 4300 wrote to memory of 1432	4300	Galaxy_Swapper.exe	150
PID 1432 wrote to memory of 5024	1432	cmd.exe	152
PID 4300 wrote to memory of 1184	4300	Galaxy_Swapper.exe	153
PID 1184 wrote to memory of 2052	1184	cmd.exe	155
PID 4300 wrote to memory of 2824	4300	Galaxy_Swapper.exe	156
PID 2824 wrote to memory of 4776	2824	cmd.exe	158
PID 4300 wrote to memory of 788	4300	Galaxy_Swapper.exe	159
PID 788 wrote to memory of 2684	788	cmd.exe	161
PID 4300 wrote to memory of 5704	4300	Galaxy_Swapper.exe	162
PID 5704 wrote to memory of 4364	5704	cmd.exe	164
PID 4300 wrote to memory of 4948	4300	Galaxy_Swapper.exe	165

C:\Users\Admin\AppData\Local\Temp\Galaxy_Swapper.exe
"C:\Users\Admin\AppData\Local\Temp\Galaxy_Swapper.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "hostname"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5344
- - C:\Windows\system32\HOSTNAME.EXE
    hostname
    3⤵
    PID:3168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get UUID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get UUID
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -c "Get-WmiObject -Query \"Select * from Win32_CacheMemory\"""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "Get-WmiObject -Query \"Select * from Win32_CacheMemory\""
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get smbiosbiosversion
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic MemoryChip get /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3160
- - C:\Windows\system32\find.exe
    find /i "Speed"
    3⤵
    PID:3428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "hostname"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\system32\HOSTNAME.EXE
    hostname
    3⤵
    PID:2232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5224
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
    3⤵
    PID:3508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid | more +1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5664
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\yt46uCbGqx5i\screenshot.png" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4354.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC3AE2162C9C6743C496E6851E698C75A8.TMP"
      4⤵
      PID:3004
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\yt46uCbGqx5i\screenshot.png"
    3⤵
    - Executes dropped EXE
    PID:3300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1980
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5420
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:5772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:988
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:2788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get totalphysicalmemory | more +1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get totalphysicalmemory
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5644
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get size | more +1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk get size
    3⤵
    - Collects information from the system
    - Suspicious behavior: EnumeratesProcesses
    PID:5980
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:4188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:5884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip"
    3⤵
    PID:1152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5692
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook"
    3⤵
    PID:2336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
    3⤵
    PID:4768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx"
    3⤵
    PID:1580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime"
    3⤵
    PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore"
    3⤵
    PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40"
    3⤵
    PID:4776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data"
    3⤵
    PID:2684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5704
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX"
    3⤵
    PID:4364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData""
  2⤵
  PID:4948
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData"
    3⤵
    PID:5480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack""
  2⤵
  PID:824
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack"
    3⤵
    PID:3232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 135.0 (x64 en-US)""
  2⤵
  PID:2236
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 135.0 (x64 en-US)"
    3⤵
    PID:2544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService""
  2⤵
  PID:1948
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService"
    3⤵
    PID:1288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2""
  2⤵
  PID:1608
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2"
    3⤵
    PID:3208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mspaint-b330ad9e-f80b-4c96-9949-4b4228be9a6e""
  2⤵
  PID:5432
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mspaint-b330ad9e-f80b-4c96-9949-4b4228be9a6e"
    3⤵
    PID:3436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mstsc-4b0a31aa-df6a-4307-9b47-d5cc50009643""
  2⤵
  PID:244
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mstsc-4b0a31aa-df6a-4307-9b47-d5cc50009643"
    3⤵
    PID:240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us""
  2⤵
  PID:5056
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"
    3⤵
    PID:1112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent""
  2⤵
  PID:1808
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent"
    3⤵
    PID:2376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SnippingTool-ee6eb196-db28-4d99-816d-fa9a63b4a377""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2472
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SnippingTool-ee6eb196-db28-4d99-816d-fa9a63b4a377"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player""
  2⤵
  PID:3800
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"
    3⤵
    PID:3364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC""
  2⤵
  PID:5128
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC"
    3⤵
    PID:3624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}""
  2⤵
  PID:2496
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}"
    3⤵
    PID:5484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}""
  2⤵
  PID:4928
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}"
    3⤵
    PID:5736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}""
  2⤵
  PID:2232
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}"
    3⤵
    PID:3860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}""
  2⤵
  PID:1160
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}"
    3⤵
    PID:3496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}""
  2⤵
  PID:6020
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}"
    3⤵
    PID:5872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}""
  2⤵
  PID:4128
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}"
    3⤵
    PID:712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}""
  2⤵
  PID:2080
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}"
    3⤵
    PID:4336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}""
  2⤵
  PID:2604
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}"
    3⤵
    PID:5752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}""
  2⤵
  PID:1200
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}"
    3⤵
    PID:4884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}""
  2⤵
  PID:3484
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}"
    3⤵
    PID:2984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}""
  2⤵
  PID:4500
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}"
    3⤵
    PID:2640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}""
  2⤵
  PID:3848
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}"
    3⤵
    PID:1420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}""
  2⤵
  PID:5516
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}"
    3⤵
    PID:2068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}""
  2⤵
  PID:944
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}"
    3⤵
    PID:3184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}""
  2⤵
  PID:1436
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}"
    3⤵
    PID:2788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}""
  2⤵
  PID:4808
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}"
    3⤵
    PID:4796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}""
  2⤵
  PID:1152
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}"
    3⤵
    PID:2336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}""
  2⤵
  PID:2184
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}"
    3⤵
    PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}""
  2⤵
  PID:3688
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}"
    3⤵
    PID:5828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}""
  2⤵
  PID:2860
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}"
    3⤵
    PID:4788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}""
  2⤵
  PID:4548
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}"
    3⤵
    PID:2508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}""
  2⤵
  PID:2268
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}"
    3⤵
    PID:2672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}""
  2⤵
  PID:1172
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}"
    3⤵
    PID:3432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}""
  2⤵
  PID:2364
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}"
    3⤵
    PID:1148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}""
  2⤵
  PID:4064
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}"
    3⤵
    PID:4860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dd3e23a0f38b25911578eda470771eb68400755c8504293e7bb61cbabc292edb
MD5 2a7f0eccaee20513a16764423f163550
SHA1 2972523df4833d1cdc797fe524f30e99e4ddf991
SHA512 fd3d165f6261a85de8b1a35ab03027d0c7f9162e2cb60e6f2e5e2e392b02b92bb3dd013ff8751417e7127bc919d93a915c81d7a1a3048545959471419e3270ad
TLSH
T17B215733F3CC8624C89A413650CEAC1036B687DB419ECF6BBB84D154A43F599DF61260
MD5 SHA1 SHA512 TLSH

Submit Download

RES4354.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4354.tmp
Size 1KB
SHA256 55fa105e85cc99aaaaf07c29d3f60a172ab99933bfbd94d7e3c539c31b8c1cbe
MD5 7578540405acb7470da639fa68a447f0
SHA1 fc2f034bc8fdf4e64ced7c1d60de152dbc4dd281
SHA512 6d082d3e4ad9a3df07df1e51f2b58c5b83d94e6f6609299b3c3e20e4cc9a9111db61029dd775c9cdc90fbd6ae6af42cba1a13bda1a215fdc4f05ff565cd501c3
TLSH
T12031850493F8470EF1B3933114F6A709A634BD99DDDA536EA448412D2F12784DF926F2
MD5 SHA1 SHA512 TLSH

Submit Download

3cb442a7039ddcad2aac3f8bd5bfd6a4f9ff253ce47c1616b3a4495f11a5d0b9

Path C:\Users\Admin\AppData\Local\Temp\pkg-RzB31a\3cb442a7039ddcad2aac3f8bd5bfd6a4f9ff253ce47c1616b3a4495f11a5d0b9
Size 1.8MB
SHA256 7fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01
MD5 3072b68e3c226aff39e6782d025f25a8
SHA1 cf559196d74fa490ac8ce192db222c9f5c5a006a
SHA512 61ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61
SSDEEP 49152:B+m+ocH2xfpTOi8stmFlZwwpx8AzdWgl+06OHULH5dsGfl:ihCTOi8sQrZwwpxTbG9
TLSH
T114858E0BA2B400BDC1EBC179861B560BE7B174051774ABEF15D48AA96F23FE3567E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b

Path C:\Users\Admin\AppData\Local\Temp\pkg-RzB31a\4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b
Size 765B
SHA256 4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b
MD5 82703a69f6d7411dde679954c2fd9dca
SHA1 bb408e929caeb1731945b2ba54bc337edb87cc66
SHA512 3fa748e59fb3af0c5293530844faa9606d9271836489d2c8013417779d10cc180187f5e670477f9ec77d341e0ef64eab7dcfb876c6390f027bc6f869a12d0f46
TLSH
T1E401FD9FB2E26BD458D09B603DA16DC962CAB03B7803AA152468E298DB7740FA47A400
MD5 SHA1 SHA512 TLSH

Submit Download

5c906a92ac74e8c3f4f83d2e4e08f5c82413f67ef8920a79176a74baf1795927

Path C:\Users\Admin\AppData\Local\Temp\pkg-RzB31a\5c906a92ac74e8c3f4f83d2e4e08f5c82413f67ef8920a79176a74baf1795927
Size 122KB
SHA256 1347de4fe38e85eaf6bb1ac959be1457938549605f4821f8c485c5324a589554
MD5 7c36f526d1228aed644d170d2a20c510
SHA1 8d21130f074bcc0ef95d61737f7b8b111641519b
SHA512 eaffc2340c7d43378587cd05f81a5d68747132dcc5bf9ffc1e151be119b49a5c83f37c60f783fdf14439a357a443943a773bc33c10daf6145b18854a27d87f2b
SSDEEP 3072:pR7Km4Kn1YTHbpeJ8puzho6pRWITyWIaF8aV:p5K3s1YTVZgza63uaSa
TLSH
T16EC36C0B73A540BBE17B8279C4930A05E772B8150760AFAF07F4465A1F637D19D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67855b0712a4accede482599a487eea92c62badf6940622541c04684dd2bea13

Path C:\Users\Admin\AppData\Local\Temp\pkg-RzB31a\67855b0712a4accede482599a487eea92c62badf6940622541c04684dd2bea13
Size 15KB
SHA256 67855b0712a4accede482599a487eea92c62badf6940622541c04684dd2bea13
MD5 b4e5fee56f00a4ad701d2bace935034f
SHA1 20cbcea8f2aa54e41ecaee750b9cdb1c7fc34f63
SHA512 55e03ba479cd03081ebf654c16cc14dcb42d6745d2efc867049522bec61862efa1982e6ef8d1dd194ad248b99278838432f70b26f4003dd61ec0b94b606f7e96
SSDEEP 192:F4InsgwSDaExV8BZCt2IMAxdMxfpJ81bkJJtotj7FHh1Scb4DssgAb487d3fWcVz:eHSDaExHtjBHhxe/gAb48FfW7m
TLSH
T1A0628926C42E4F8636C47E546CD4624199818997CDA2B418732C4B5C6FEF0AFDAFB23D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

720836c9bdad386485a492ab41fe08007ecf85ca278ddd8f9333494dcac4949d

Path C:\Users\Admin\AppData\Local\Temp\pkg-RzB31a\720836c9bdad386485a492ab41fe08007ecf85ca278ddd8f9333494dcac4949d
Size 755B
SHA256 720836c9bdad386485a492ab41fe08007ecf85ca278ddd8f9333494dcac4949d
MD5 5324d196a847002a5d476185a59cf238
SHA1 dfe418dc288edb0a4bb66af2ad88bd838c55e136
SHA512 1b4187c58bebb6378f8a04300da6f4d1f12f6fbe9a1ab7ceda8a4752e263f282daebcac1379fa0675dd78ec86fffb127dba6469f303570b9f21860454df2203f
TLSH
T1AD0125AE72F16EE478D59B902DA1B4CD51CCB0727407BA003468E394D7A704F98BE000
MD5 SHA1 SHA512 TLSH

Submit Download

907333195fbf4f8d781f2a35f7313811a8787736f8d04d2c1dc1f46c78cca38c

Path C:\Users\Admin\AppData\Local\Temp\pkg-RzB31a\907333195fbf4f8d781f2a35f7313811a8787736f8d04d2c1dc1f46c78cca38c
Size 109KB
SHA256 f6c33cc68381426fa98422fdf9efa44beb4573e16cbee5188964fba42884ecc8
MD5 e5fe38c4ab5083afbb6311040b34fe1e
SHA1 9e6782a2545952b6631e2e64594fbd9e430ebaeb
SHA512 2e01f0552a722ce7c8d4404d8e667a517fa9c1e6dbca472aeb991523408baae299e6271cbea6f69d56f84b4f8113db2ad8880a1ab582082fca07dac77393becc
SSDEEP 1536:HabP6jajHxKriGp3sEBnQCkSbJJ6xQyaNAtwRe0fzJgsW3dP9dlz6OXYx5C:HabPpCxpQCk6zIhaNA4fSvx6Ow5C
TLSH
T119B36C1B73A510BBF43A8674C8930E46E7B6B4110761AB6F03A4839A1F637919D3FF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenCapture_1.3.2.bat

Path C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat
Size 13KB
SHA256 818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
MD5 da0f40d84d72ae3e9324ad9a040a2e58
SHA1 4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA512 30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP 384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx
TLSH
T1A95263095E1341B5183330266FCB839AFA2B417375AAED40395C8375DF26A1BC675BEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenCapture_1.3.2.exe

Path C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
Size 12KB
SHA256 f0cf180243fb636ebe50807efa72b3a78fb1f901fb88e4ef2126408d23181d17
MD5 477aa6264827745584d8f4ae39947bca
SHA1 d0d6c8f0fe53aad956db9a38bba616009609a298
SHA512 30bd5526923db979496d32e8e7ff9151b3c8069c565161498e37c90a1d398badd78463e0fd35c43864e78fe5588723600a38a375b6b5e71747dcca0c2e0793c9
SSDEEP 192:20ZP9yjWewKlBNOOOP3fs3JBy775ia7SBgvuIbZa8uXZlLpwHdGXpRT/:9iW6OOOPUy75i/++XZ1pwHdGX7/
TLSH
T155429307EBE08914F4FF7B751873071817B9B9CA9C33C75E1A8C655AAE237049A10BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchPing.txt

Path C:\Users\Admin\AppData\Local\Temp\yt46uCbGqx5i\.txt\SearchPing.txt
Size 754KB
SHA256 160d3f1eeef86c4218141a556e4edf0cda79a11210d05f96d45d07a971aeaf9c
MD5 29b08c9f4313a41497f553c80805d099
SHA1 ec3927a1a76425b7691f7829aef1767c41984d9a
SHA512 36e06554a3c2fa55ddd323943ca03c5e0e4273e1822e0ac20f17e2d3296b042a46a34397b8683997b008d0dadb67672231a02344d803da29efdaeb3eda5fc94c
SSDEEP 12288:R4BmmpnmogydhNs/YcTQxzqarojxtE0Cm3Bdt83+wCMwsXcZm5PES2zeUNeNu17K:Pi3NMY/zqaixu0V3Nw5+ZmB8kNql3k
TLSH
T1E5F433571F4CBBAE662BFB4A15DA14BFCB09B10D50EA86931C24F0F5171FE9880E84E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bookmarks.txt

Path C:\Users\Admin\AppData\Local\Temp\yt46uCbGqx5i\browsers\bookmarks.txt
Size 390B
SHA256 099ee28b09dfc834b2cd53c7a8a906bcfc155864cf63c28f03213f1301be1c6b
MD5 d325fd5b529f0d55c5634caaf65e8587
SHA1 855591716d475b0ddf27021ab38e5a1fc36f8639
SHA512 63fd86c2b573c0ddc1cb27e216e6abe56b90eddb5f911706187c30ea20d586f13b95d92538245b4e93b0b6abd155106fc1627e84a5c7f619053e42a0d90c9b76
TLSH
T1C6E022E361B207A80F008C583158726B6AC3D388CFE1508AE8462FF080AD3F00AED7CC
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\yt46uCbGqx5i\browsers\history.txt
Size 99B
SHA256 ee28266165593d546a487977fd7cd5d7f5f12b1c1b50e9ce30f8d409937dc742
MD5 343e79c43d8d3b5dd67a1b64f9126a67
SHA1 3cc93736f3c2b2ccef684e0abac010c5f3ab5874
SHA512 8c2fd3f09cb7061d465254fa4ec15b890674fb75234cfb208c70e0c52bb915a8a2b996e3d3699d4b168accd81daa474432bc117f5f43fe672ab7e59c5352db99
TLSH
T129B01200822586DA070DC45178A725DF6D65D4E61350706210C46FCAAB048560142DFE
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3AE2162C9C6743C496E6851E698C75A8.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC3AE2162C9C6743C496E6851E698C75A8.TMP
Size 1KB
SHA256 ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344
MD5 a6f2d21624678f54a2abed46e9f3ab17
SHA1 a2a6f07684c79719007d434cbd1cd2164565734a
SHA512 0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676
TLSH
T12B115B44B2E8414DF2E3973069F5A3539458BDA6CCAA43AC744C470E2F21941C6539F2
MD5 SHA1 SHA512 TLSH

Submit Download

app.manifest

Path \??\c:\Users\Admin\AppData\Local\Temp\screenCapture\app.manifest
Size 350B
SHA256 8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83
MD5 8951565428aa6644f1505edb592ab38f
SHA1 9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2
SHA512 7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5
TLSH
T150E08680A46590EDB395A0615566F280A99947FF04DD41B8B05C8C6E7F15DCAC3431F3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/456-1129-0x000001FBC1570000-0x000001FBC1672000-memory.dmp

Download

memory/456-1128-0x000001FBA8CE0000-0x000001FBA8CF0000-memory.dmp

Download

memory/456-1127-0x000001FBA8D00000-0x000001FBA8D22000-memory.dmp

Download

memory/456-1124-0x000001FBC12D0000-0x000001FBC1352000-memory.dmp

Download

memory/3300-1168-0x0000000000310000-0x000000000031A000-memory.dmp

Download