67a7379a6175f00d09621cb9ea4ffd6911305a4c0a6674c74643f14dced7457a

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 00:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Galaxy_Swapper.exe
Size 51.1MB
Sample260727-aw4e9atcpg
SHA256 67a7379a6175f00d09621cb9ea4ffd6911305a4c0a6674c74643f14dced7457a
MD5 33eb60f009aea961568ab064ba4f57a9
SHA1 a7c64f5d25780e10c64e1416f9048d3479ed7629
SHA512 f81b4036996a1c280f301fa180b483b4722773593a1a2e20eae2f3a4e9804b7ffca04374d54e3cc651ad242d7242c2b55664652283393a51261fa4dc28bbf8e8
SSDEEP 786432:WMguj8Q4VfvyqFTrYZKuA1gIm7DmKaDgWz6+u67i:WiAQIHykHeAa7DU+e7i
TLSH
T119C7CE0773E601A5E5B7E2388AA75503D7B3B4635331DADF329D06111FABAD09A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Galaxy_Swapper.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.exe	Galaxy_Swapper.exe

Executes dropped EXE 1 IoCs

pid	Process
5100	screenCapture_1.3.2.exe

Loads dropped DLL 3 IoCs

pid	Process
2568	Galaxy_Swapper.exe
2568	Galaxy_Swapper.exe
2568	Galaxy_Swapper.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org
4	api.ipify.org
5	api.ipify.org

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4996	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 61 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3504	cmd.exe
3728	cmd.exe
64	cmd.exe
4720	cmd.exe
2292	cmd.exe
4476	cmd.exe
932	cmd.exe
3220	cmd.exe
1808	cmd.exe
2436	cmd.exe
2948	cmd.exe
2500	cmd.exe
4876	cmd.exe
4888	cmd.exe
4900	cmd.exe
1580	cmd.exe
4432	cmd.exe
1204	cmd.exe
4664	cmd.exe
4660	cmd.exe
4920	cmd.exe
3492	cmd.exe
1280	cmd.exe
4400	cmd.exe
2356	cmd.exe
2536	cmd.exe
3984	cmd.exe
2924	cmd.exe
4328	cmd.exe
3916	cmd.exe
3436	cmd.exe
3880	cmd.exe
5080	cmd.exe
548	cmd.exe
2196	cmd.exe
2016	cmd.exe
3152	cmd.exe
1644	cmd.exe
3888	cmd.exe
432	cmd.exe
4448	cmd.exe
1804	cmd.exe
4296	cmd.exe
1932	cmd.exe
3348	cmd.exe
1088	cmd.exe
2068	cmd.exe
316	cmd.exe
4908	cmd.exe
1188	cmd.exe
1548	cmd.exe
540	cmd.exe
2892	cmd.exe
2376	cmd.exe
116	cmd.exe
3224	cmd.exe
3908	cmd.exe
4960	cmd.exe
3656	cmd.exe
2144	cmd.exe
4800	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
4020	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3940	WMIC.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4836	powershell.exe
4836	powershell.exe
1000	powershell.exe
1000	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1408	WMIC.exe
Token: SeSecurityPrivilege	1408	WMIC.exe
Token: SeTakeOwnershipPrivilege	1408	WMIC.exe
Token: SeLoadDriverPrivilege	1408	WMIC.exe
Token: SeSystemProfilePrivilege	1408	WMIC.exe
Token: SeSystemtimePrivilege	1408	WMIC.exe
Token: SeProfSingleProcessPrivilege	1408	WMIC.exe
Token: SeIncBasePriorityPrivilege	1408	WMIC.exe
Token: SeCreatePagefilePrivilege	1408	WMIC.exe
Token: SeBackupPrivilege	1408	WMIC.exe
Token: SeRestorePrivilege	1408	WMIC.exe
Token: SeShutdownPrivilege	1408	WMIC.exe
Token: SeDebugPrivilege	1408	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1408	WMIC.exe
Token: SeRemoteShutdownPrivilege	1408	WMIC.exe
Token: SeUndockPrivilege	1408	WMIC.exe
Token: SeManageVolumePrivilege	1408	WMIC.exe
Token: 33	1408	WMIC.exe
Token: 34	1408	WMIC.exe
Token: 35	1408	WMIC.exe
Token: 36	1408	WMIC.exe
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeIncreaseQuotaPrivilege	1408	WMIC.exe
Token: SeSecurityPrivilege	1408	WMIC.exe
Token: SeTakeOwnershipPrivilege	1408	WMIC.exe
Token: SeLoadDriverPrivilege	1408	WMIC.exe
Token: SeSystemProfilePrivilege	1408	WMIC.exe
Token: SeSystemtimePrivilege	1408	WMIC.exe
Token: SeProfSingleProcessPrivilege	1408	WMIC.exe
Token: SeIncBasePriorityPrivilege	1408	WMIC.exe
Token: SeCreatePagefilePrivilege	1408	WMIC.exe
Token: SeBackupPrivilege	1408	WMIC.exe
Token: SeRestorePrivilege	1408	WMIC.exe
Token: SeShutdownPrivilege	1408	WMIC.exe
Token: SeDebugPrivilege	1408	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1408	WMIC.exe
Token: SeRemoteShutdownPrivilege	1408	WMIC.exe
Token: SeUndockPrivilege	1408	WMIC.exe
Token: SeManageVolumePrivilege	1408	WMIC.exe
Token: 33	1408	WMIC.exe
Token: 34	1408	WMIC.exe
Token: 35	1408	WMIC.exe
Token: 36	1408	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2588	WMIC.exe
Token: SeSecurityPrivilege	2588	WMIC.exe
Token: SeTakeOwnershipPrivilege	2588	WMIC.exe
Token: SeLoadDriverPrivilege	2588	WMIC.exe
Token: SeSystemProfilePrivilege	2588	WMIC.exe
Token: SeSystemtimePrivilege	2588	WMIC.exe
Token: SeProfSingleProcessPrivilege	2588	WMIC.exe
Token: SeIncBasePriorityPrivilege	2588	WMIC.exe
Token: SeCreatePagefilePrivilege	2588	WMIC.exe
Token: SeBackupPrivilege	2588	WMIC.exe
Token: SeRestorePrivilege	2588	WMIC.exe
Token: SeShutdownPrivilege	2588	WMIC.exe
Token: SeDebugPrivilege	2588	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2588	WMIC.exe
Token: SeRemoteShutdownPrivilege	2588	WMIC.exe
Token: SeUndockPrivilege	2588	WMIC.exe
Token: SeManageVolumePrivilege	2588	WMIC.exe
Token: 33	2588	WMIC.exe
Token: 34	2588	WMIC.exe
Token: 35	2588	WMIC.exe
Token: 36	2588	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2436	2568	Galaxy_Swapper.exe	86
PID 2436 wrote to memory of 2180	2436	cmd.exe	87
PID 2568 wrote to memory of 1188	2568	Galaxy_Swapper.exe	88
PID 2568 wrote to memory of 2948	2568	Galaxy_Swapper.exe	89
PID 1188 wrote to memory of 1408	1188	cmd.exe	90
PID 2948 wrote to memory of 4836	2948	cmd.exe	91
PID 2568 wrote to memory of 1580	2568	Galaxy_Swapper.exe	93
PID 2568 wrote to memory of 1088	2568	Galaxy_Swapper.exe	94
PID 2568 wrote to memory of 4448	2568	Galaxy_Swapper.exe	95
PID 1088 wrote to memory of 2588	1088	cmd.exe	96
PID 1088 wrote to memory of 2192	1088	cmd.exe	97
PID 1580 wrote to memory of 4780	1580	cmd.exe	98
PID 4448 wrote to memory of 1000	4448	cmd.exe	99
PID 2568 wrote to memory of 2376	2568	Galaxy_Swapper.exe	100
PID 2376 wrote to memory of 4584	2376	cmd.exe	164
PID 2568 wrote to memory of 4432	2568	Galaxy_Swapper.exe	102
PID 4432 wrote to memory of 4996	4432	cmd.exe	103
PID 2568 wrote to memory of 2196	2568	Galaxy_Swapper.exe	104
PID 2568 wrote to memory of 3656	2568	Galaxy_Swapper.exe	106
PID 2568 wrote to memory of 1204	2568	Galaxy_Swapper.exe	107
PID 2196 wrote to memory of 2852	2196	cmd.exe	109
PID 3656 wrote to memory of 3248	3656	cmd.exe	110
PID 3656 wrote to memory of 3632	3656	cmd.exe	111
PID 2568 wrote to memory of 1644	2568	Galaxy_Swapper.exe	112
PID 1644 wrote to memory of 1748	1644	cmd.exe	113
PID 1644 wrote to memory of 2572	1644	cmd.exe	114
PID 1204 wrote to memory of 3296	1204	cmd.exe	115
PID 2568 wrote to memory of 3916	2568	Galaxy_Swapper.exe	116
PID 3916 wrote to memory of 2504	3916	cmd.exe	117
PID 3916 wrote to memory of 4100	3916	cmd.exe	118
PID 2568 wrote to memory of 64	2568	Galaxy_Swapper.exe	119
PID 64 wrote to memory of 3940	64	cmd.exe	120
PID 64 wrote to memory of 4384	64	cmd.exe	198
PID 2568 wrote to memory of 4664	2568	Galaxy_Swapper.exe	122
PID 4664 wrote to memory of 4536	4664	cmd.exe	123
PID 4664 wrote to memory of 1392	4664	cmd.exe	124
PID 2568 wrote to memory of 4400	2568	Galaxy_Swapper.exe	125
PID 4400 wrote to memory of 4020	4400	cmd.exe	126
PID 4400 wrote to memory of 2160	4400	cmd.exe	127
PID 3296 wrote to memory of 436	3296	csc.exe	128
PID 1204 wrote to memory of 5100	1204	cmd.exe	129
PID 2568 wrote to memory of 4660	2568	Galaxy_Swapper.exe	130
PID 4660 wrote to memory of 3764	4660	cmd.exe	212
PID 2568 wrote to memory of 2500	2568	Galaxy_Swapper.exe	133
PID 2500 wrote to memory of 3896	2500	cmd.exe	135
PID 2568 wrote to memory of 4876	2568	Galaxy_Swapper.exe	136
PID 4876 wrote to memory of 396	4876	cmd.exe	138
PID 2568 wrote to memory of 1548	2568	Galaxy_Swapper.exe	139
PID 1548 wrote to memory of 1080	1548	cmd.exe	141
PID 2568 wrote to memory of 116	2568	Galaxy_Swapper.exe	142
PID 116 wrote to memory of 2152	116	cmd.exe	144
PID 2568 wrote to memory of 3436	2568	Galaxy_Swapper.exe	145
PID 3436 wrote to memory of 2348	3436	cmd.exe	147
PID 2568 wrote to memory of 4720	2568	Galaxy_Swapper.exe	148
PID 4720 wrote to memory of 1360	4720	cmd.exe	150
PID 2568 wrote to memory of 3224	2568	Galaxy_Swapper.exe	151
PID 3224 wrote to memory of 2820	3224	cmd.exe	153
PID 2568 wrote to memory of 2144	2568	Galaxy_Swapper.exe	154
PID 2144 wrote to memory of 4952	2144	cmd.exe	156
PID 2568 wrote to memory of 932	2568	Galaxy_Swapper.exe	157
PID 932 wrote to memory of 1736	932	cmd.exe	159
PID 2568 wrote to memory of 3504	2568	Galaxy_Swapper.exe	160
PID 3504 wrote to memory of 3148	3504	cmd.exe	162
PID 2568 wrote to memory of 3728	2568	Galaxy_Swapper.exe	163

C:\Users\Admin\AppData\Local\Temp\Galaxy_Swapper.exe
"C:\Users\Admin\AppData\Local\Temp\Galaxy_Swapper.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "hostname"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\system32\HOSTNAME.EXE
    hostname
    3⤵
    PID:2180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get UUID"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get UUID
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -c "Get-WmiObject -Query \"Select * from Win32_CacheMemory\"""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "Get-WmiObject -Query \"Select * from Win32_CacheMemory\""
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get smbiosbiosversion
    3⤵
    PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic MemoryChip get /format:list
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2588
- - C:\Windows\system32\find.exe
    find /i "Speed"
    3⤵
    PID:2192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "hostname"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\system32\HOSTNAME.EXE
    hostname
    3⤵
    PID:4584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
    3⤵
    PID:2852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid | more +1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:3248
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:3632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\MnmiNz96G68B\screenshot.png" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3296
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7F8B.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCBEEDFFD27D84D708BD83F1F689F249.TMP"
      4⤵
      PID:436
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\MnmiNz96G68B\screenshot.png"
    3⤵
    - Executes dropped EXE
    PID:5100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    PID:1748
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:2504
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:64
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:3940
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get totalphysicalmemory | more +1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get totalphysicalmemory
    3⤵
    PID:4536
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:1392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get size | more +1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk get size
    3⤵
    - Collects information from the system
    PID:4020
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:2160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:3764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:3896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip"
    3⤵
    PID:396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook"
    3⤵
    PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
    3⤵
    PID:2152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx"
    3⤵
    PID:2348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime"
    3⤵
    PID:1360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore"
    3⤵
    PID:2820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40"
    3⤵
    PID:4952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data"
    3⤵
    PID:1736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX"
    3⤵
    PID:3148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData""
  2⤵
  - Executes a command shell one-liner
  PID:3728
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4584
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData"
    3⤵
    PID:4392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack""
  2⤵
  - Executes a command shell one-liner
  PID:2292
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack"
    3⤵
    PID:4916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 135.0 (x64 en-US)""
  2⤵
  - Executes a command shell one-liner
  PID:4920
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 135.0 (x64 en-US)"
    3⤵
    PID:4272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService""
  2⤵
  - Executes a command shell one-liner
  PID:3908
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService"
    3⤵
    PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2""
  2⤵
  - Executes a command shell one-liner
  PID:3348
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2"
    3⤵
    PID:4260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us""
  2⤵
  - Executes a command shell one-liner
  PID:3492
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"
    3⤵
    PID:1840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent""
  2⤵
  - Executes a command shell one-liner
  PID:3220
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent"
    3⤵
    PID:1812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player""
  2⤵
  - Executes a command shell one-liner
  PID:4960
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"
    3⤵
    PID:4220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC""
  2⤵
  - Executes a command shell one-liner
  PID:4888
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC"
    3⤵
    PID:3836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}""
  2⤵
  - Executes a command shell one-liner
  PID:1804
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}"
    3⤵
    PID:1296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}""
  2⤵
  - Executes a command shell one-liner
  PID:1280
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}"
    3⤵
    PID:2840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}""
  2⤵
  - Executes a command shell one-liner
  PID:2068
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}"
    3⤵
    PID:4384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}""
  2⤵
  - Executes a command shell one-liner
  PID:1808
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}"
    3⤵
    PID:1100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}""
  2⤵
  - Executes a command shell one-liner
  PID:4908
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}"
    3⤵
    PID:892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}""
  2⤵
  - Executes a command shell one-liner
  PID:3888
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}"
    3⤵
    PID:2028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}""
  2⤵
  - Executes a command shell one-liner
  PID:4476
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}"
    3⤵
    PID:2856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}""
  2⤵
  - Executes a command shell one-liner
  PID:4296
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3764
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}"
    3⤵
    PID:1476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}""
  2⤵
  - Executes a command shell one-liner
  PID:3152
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}"
    3⤵
    PID:1108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}""
  2⤵
  - Executes a command shell one-liner
  PID:4800
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}"
    3⤵
    PID:3788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}""
  2⤵
  - Executes a command shell one-liner
  PID:4900
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}"
    3⤵
    PID:2996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}""
  2⤵
  - Executes a command shell one-liner
  PID:316
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}"
    3⤵
    PID:4896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}""
  2⤵
  - Executes a command shell one-liner
  PID:2356
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}"
    3⤵
    PID:628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}""
  2⤵
  - Executes a command shell one-liner
  PID:2536
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}"
    3⤵
    PID:2728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}""
  2⤵
  - Executes a command shell one-liner
  PID:2016
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}"
    3⤵
    PID:4748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}""
  2⤵
  - Executes a command shell one-liner
  PID:540
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}"
    3⤵
    PID:2252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}""
  2⤵
  - Executes a command shell one-liner
  PID:3984
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}"
    3⤵
    PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}""
  2⤵
  - Executes a command shell one-liner
  PID:2924
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}"
    3⤵
    PID:3644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}""
  2⤵
  - Executes a command shell one-liner
  PID:4328
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}"
    3⤵
    PID:4392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}""
  2⤵
  - Executes a command shell one-liner
  PID:3880
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}"
    3⤵
    PID:1884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}""
  2⤵
  - Executes a command shell one-liner
  PID:1932
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}"
    3⤵
    PID:4996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}""
  2⤵
  - Executes a command shell one-liner
  PID:5080
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}"
    3⤵
    PID:4184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}""
  2⤵
  - Executes a command shell one-liner
  PID:2892
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4260
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}"
    3⤵
    PID:4276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}""
  2⤵
  - Executes a command shell one-liner
  PID:548
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}"
    3⤵
    PID:1876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}""
  2⤵
  - Executes a command shell one-liner
  PID:432
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}"
    3⤵
    PID:4076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 1dd6960bc898ac34c08cc17d5f85cda872d8f8baeed24ca7d20fc550a9a1c8cb
MD5 37cf724e8a80089001bae9f27479e555
SHA1 dbe98360a2f83b5365f8cd0f8f0733e813074485
SHA512 f40b3237e9c2079b85c0f7a6f506b1350663ef178a9fa00927ef2a68c235b4f32a5a24f28492bd9fe129aeca7cafaececa37f2c3de326c6a63776e03a352e1f8
MD5 SHA1 SHA512

Submit Download

RES7F8B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7F8B.tmp
Size 1KB
SHA256 9f558e36464299d58d9cc52e2986573184fe968373576d2c43f4ea31f42acaee
MD5 1ba1e137d777df7ff6fa7995138520bd
SHA1 14d92741125cbff2824617d205041c7561aee56d
SHA512 fbb802c72cd19baa431a5313cb8b693f1e18015db2d2299baa9a73e68ea65486ca09df3c1eb43bae6a0482b504fe2abefa1bacdce7d7f7eb88391fd5412944f3
TLSH
T19C31400093E8461EF2B7973118F66306AA34BDD9DDDA936FA548413C2F127C4DF529B2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_b0ri0pwm.za5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b0ri0pwm.za5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

3cb442a7039ddcad2aac3f8bd5bfd6a4f9ff253ce47c1616b3a4495f11a5d0b9

Path C:\Users\Admin\AppData\Local\Temp\pkg-5JToJP\3cb442a7039ddcad2aac3f8bd5bfd6a4f9ff253ce47c1616b3a4495f11a5d0b9
Size 1.8MB
SHA256 7fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01
MD5 3072b68e3c226aff39e6782d025f25a8
SHA1 cf559196d74fa490ac8ce192db222c9f5c5a006a
SHA512 61ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61
SSDEEP 49152:B+m+ocH2xfpTOi8stmFlZwwpx8AzdWgl+06OHULH5dsGfl:ihCTOi8sQrZwwpxTbG9
TLSH
T114858E0BA2B400BDC1EBC179861B560BE7B174051774ABEF15D48AA96F23FE3567E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b

Path C:\Users\Admin\AppData\Local\Temp\pkg-5JToJP\4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b
Size 765B
SHA256 4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b
MD5 82703a69f6d7411dde679954c2fd9dca
SHA1 bb408e929caeb1731945b2ba54bc337edb87cc66
SHA512 3fa748e59fb3af0c5293530844faa9606d9271836489d2c8013417779d10cc180187f5e670477f9ec77d341e0ef64eab7dcfb876c6390f027bc6f869a12d0f46
TLSH
T1E401FD9FB2E26BD458D09B603DA16DC962CAB03B7803AA152468E298DB7740FA47A400
MD5 SHA1 SHA512 TLSH

Submit Download

5c906a92ac74e8c3f4f83d2e4e08f5c82413f67ef8920a79176a74baf1795927

Path C:\Users\Admin\AppData\Local\Temp\pkg-5JToJP\5c906a92ac74e8c3f4f83d2e4e08f5c82413f67ef8920a79176a74baf1795927
Size 122KB
SHA256 1347de4fe38e85eaf6bb1ac959be1457938549605f4821f8c485c5324a589554
MD5 7c36f526d1228aed644d170d2a20c510
SHA1 8d21130f074bcc0ef95d61737f7b8b111641519b
SHA512 eaffc2340c7d43378587cd05f81a5d68747132dcc5bf9ffc1e151be119b49a5c83f37c60f783fdf14439a357a443943a773bc33c10daf6145b18854a27d87f2b
SSDEEP 3072:pR7Km4Kn1YTHbpeJ8puzho6pRWITyWIaF8aV:p5K3s1YTVZgza63uaSa
TLSH
T16EC36C0B73A540BBE17B8279C4930A05E772B8150760AFAF07F4465A1F637D19D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67855b0712a4accede482599a487eea92c62badf6940622541c04684dd2bea13

Path C:\Users\Admin\AppData\Local\Temp\pkg-5JToJP\67855b0712a4accede482599a487eea92c62badf6940622541c04684dd2bea13
Size 15KB
SHA256 67855b0712a4accede482599a487eea92c62badf6940622541c04684dd2bea13
MD5 b4e5fee56f00a4ad701d2bace935034f
SHA1 20cbcea8f2aa54e41ecaee750b9cdb1c7fc34f63
SHA512 55e03ba479cd03081ebf654c16cc14dcb42d6745d2efc867049522bec61862efa1982e6ef8d1dd194ad248b99278838432f70b26f4003dd61ec0b94b606f7e96
SSDEEP 192:F4InsgwSDaExV8BZCt2IMAxdMxfpJ81bkJJtotj7FHh1Scb4DssgAb487d3fWcVz:eHSDaExHtjBHhxe/gAb48FfW7m
TLSH
T1A0628926C42E4F8636C47E546CD4624199818997CDA2B418732C4B5C6FEF0AFDAFB23D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

720836c9bdad386485a492ab41fe08007ecf85ca278ddd8f9333494dcac4949d

Path C:\Users\Admin\AppData\Local\Temp\pkg-5JToJP\720836c9bdad386485a492ab41fe08007ecf85ca278ddd8f9333494dcac4949d
Size 755B
SHA256 720836c9bdad386485a492ab41fe08007ecf85ca278ddd8f9333494dcac4949d
MD5 5324d196a847002a5d476185a59cf238
SHA1 dfe418dc288edb0a4bb66af2ad88bd838c55e136
SHA512 1b4187c58bebb6378f8a04300da6f4d1f12f6fbe9a1ab7ceda8a4752e263f282daebcac1379fa0675dd78ec86fffb127dba6469f303570b9f21860454df2203f
TLSH
T1AD0125AE72F16EE478D59B902DA1B4CD51CCB0727407BA003468E394D7A704F98BE000
MD5 SHA1 SHA512 TLSH

Submit Download

907333195fbf4f8d781f2a35f7313811a8787736f8d04d2c1dc1f46c78cca38c

Path C:\Users\Admin\AppData\Local\Temp\pkg-5JToJP\907333195fbf4f8d781f2a35f7313811a8787736f8d04d2c1dc1f46c78cca38c
Size 109KB
SHA256 f6c33cc68381426fa98422fdf9efa44beb4573e16cbee5188964fba42884ecc8
MD5 e5fe38c4ab5083afbb6311040b34fe1e
SHA1 9e6782a2545952b6631e2e64594fbd9e430ebaeb
SHA512 2e01f0552a722ce7c8d4404d8e667a517fa9c1e6dbca472aeb991523408baae299e6271cbea6f69d56f84b4f8113db2ad8880a1ab582082fca07dac77393becc
SSDEEP 1536:HabP6jajHxKriGp3sEBnQCkSbJJ6xQyaNAtwRe0fzJgsW3dP9dlz6OXYx5C:HabPpCxpQCk6zIhaNA4fSvx6Ow5C
TLSH
T119B36C1B73A510BBF43A8674C8930E46E7B6B4110761AB6F03A4839A1F637919D3FF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenCapture_1.3.2.bat

Path C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat
Size 13KB
SHA256 818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
MD5 da0f40d84d72ae3e9324ad9a040a2e58
SHA1 4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA512 30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP 384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx
TLSH
T1A95263095E1341B5183330266FCB839AFA2B417375AAED40395C8375DF26A1BC675BEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenCapture_1.3.2.exe

Path C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
Size 12KB
SHA256 d5a91177d7961f197aa11004c2cb7762a8110341e233a843fa3c50b959eab310
MD5 3a69285b9b621c838d787ed760ada586
SHA1 1735ebd46f5582b1834728a297b0ed9e70074a01
SHA512 20d54fcd4a44f076fe5e36a7be391d9d2558a67c15c9880b4b59bfe0abb7cbf0856d6df3d66526e4b49e693c18932329ff23c05998fca572251c193cc2eb3234
SSDEEP 192:N0ZP9yjWewKlBNOOOP3fs3JBy775ia7SBgvuIbZa8uXZlLpwHdGgYpRT/:aiW6OOOPUy75i/++XZ1pwHdGJ7/
TLSH
T129429306EBE08914F4FF7B751873071817B9F9CA9C33C75E0A8C655AAE237049A10BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite_tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\places.sqlite_tmp
Size 5.0MB
SHA256 e8266e1ed79774e11828dfa37c03e219d55e05224c2ea4043c492bb0b5482920
MD5 fd34c2b91db97825cf3da91e30b35af4
SHA1 b11ae170b84b72d5ab72fe7ced9798b62602a71c
SHA512 5880a531161cf491bec6c5007a2a850ec516816133642a96b1577d2e269165305e1e7914399b77bdfda0e91c23d7230e65ab84022f559df9b0214fb324079679
SSDEEP 96:D4k1e/wAaF8M9Te9kjQruHtZroSzPFRPRYoa5Af22iV7qIsFw2iwRI7c2xfXsZ8a:M8rJQaXoMXp0VW9FxWHmfsl8Q+K1Zm
TLSH
T1A836011F6A241150C4DAA232ADE35F19183F70168A7776933EA4256E4DE0723B92DCFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCBEEDFFD27D84D708BD83F1F689F249.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCBEEDFFD27D84D708BD83F1F689F249.TMP
Size 1KB
SHA256 ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344
MD5 a6f2d21624678f54a2abed46e9f3ab17
SHA1 a2a6f07684c79719007d434cbd1cd2164565734a
SHA512 0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676
TLSH
T12B115B44B2E8414DF2E3973069F5A3539458BDA6CCAA43AC744C470E2F21941C6539F2
MD5 SHA1 SHA512 TLSH

Submit Download

app.manifest

Path \??\c:\Users\Admin\AppData\Local\Temp\screenCapture\app.manifest
Size 350B
SHA256 8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83
MD5 8951565428aa6644f1505edb592ab38f
SHA1 9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2
SHA512 7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5
TLSH
T150E08680A46590EDB395A0615566F280A99947FF04DD41B8B05C8C6E7F15DCAC3431F3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4836-1131-0x000001FE32C10000-0x000001FE32C32000-memory.dmp

Download

memory/5100-1193-0x0000000000EC0000-0x0000000000ECA000-memory.dmp

Download