67a7379a6175f00d09621cb9ea4ffd6911305a4c0a6674c74643f14dced7457a

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 00:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Galaxy_Swapper.exe
Size 51.1MB
Sample260727-aw4e9atcpg
SHA256 67a7379a6175f00d09621cb9ea4ffd6911305a4c0a6674c74643f14dced7457a
MD5 33eb60f009aea961568ab064ba4f57a9
SHA1 a7c64f5d25780e10c64e1416f9048d3479ed7629
SHA512 f81b4036996a1c280f301fa180b483b4722773593a1a2e20eae2f3a4e9804b7ffca04374d54e3cc651ad242d7242c2b55664652283393a51261fa4dc28bbf8e8
SSDEEP 786432:WMguj8Q4VfvyqFTrYZKuA1gIm7DmKaDgWz6+u67i:WiAQIHykHeAa7DU+e7i
TLSH
T119C7CE0773E601A5E5B7E2388AA75503D7B3B4635331DADF329D06111FABAD09A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.exe	Galaxy_Swapper.exe

Executes dropped EXE 1 IoCs

pid	Process
4320	screenCapture_1.3.2.exe

Loads dropped DLL 3 IoCs

pid	Process
1480	Galaxy_Swapper.exe
1480	Galaxy_Swapper.exe
1480	Galaxy_Swapper.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	api.gofile.io
9	api.gofile.io

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	api.ipify.org
1	api.ipify.org
7	api.ipify.org

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2972	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3660	cmd.exe
1936	cmd.exe
3392	cmd.exe
3740	cmd.exe
4704	cmd.exe
3544	cmd.exe
2016	cmd.exe
1636	cmd.exe
1960	cmd.exe
4232	cmd.exe
5584	cmd.exe
3220	cmd.exe
4356	cmd.exe
3192	cmd.exe
6108	cmd.exe
3480	cmd.exe
1840	cmd.exe
4064	cmd.exe
3188	cmd.exe
5512	cmd.exe
2240	cmd.exe
2492	cmd.exe
5344	cmd.exe
4168	cmd.exe
5364	cmd.exe
5252	cmd.exe
4112	cmd.exe
2764	cmd.exe
2948	cmd.exe
4628	cmd.exe
3792	cmd.exe
5224	cmd.exe
1324	cmd.exe
5348	cmd.exe
996	cmd.exe
5552	cmd.exe
2556	cmd.exe
4240	cmd.exe
2800	cmd.exe
2756	cmd.exe
3776	cmd.exe
1384	cmd.exe
2892	cmd.exe
4936	cmd.exe
4576	cmd.exe
4656	cmd.exe
5824	cmd.exe
2324	cmd.exe
5800	cmd.exe
1464	cmd.exe
3904	cmd.exe
5356	cmd.exe
1056	cmd.exe
1432	cmd.exe
5444	cmd.exe
5840	cmd.exe
1132	cmd.exe
1148	cmd.exe
1336	cmd.exe
5756	cmd.exe
4448	cmd.exe
120	cmd.exe
5708	cmd.exe
4996	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2948	cmd.exe
4944	reg.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
4980	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4164	WMIC.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3172	WMIC.exe
3172	WMIC.exe
3172	WMIC.exe
3172	WMIC.exe
2952	powershell.exe
2952	powershell.exe
2952	powershell.exe
3904	WMIC.exe
3904	WMIC.exe
3904	WMIC.exe
3904	WMIC.exe
1148	WMIC.exe
1148	WMIC.exe
1148	WMIC.exe
1148	WMIC.exe
4044	powershell.exe
4044	powershell.exe
4044	powershell.exe
1796	WMIC.exe
1796	WMIC.exe
1796	WMIC.exe
1796	WMIC.exe
544	WMIC.exe
544	WMIC.exe
544	WMIC.exe
544	WMIC.exe
2912	WMIC.exe
2912	WMIC.exe
2912	WMIC.exe
2912	WMIC.exe
4164	WMIC.exe
4164	WMIC.exe
4164	WMIC.exe
4164	WMIC.exe
4920	WMIC.exe
4920	WMIC.exe
4920	WMIC.exe
4920	WMIC.exe
4980	WMIC.exe
4980	WMIC.exe
4980	WMIC.exe
4980	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3172	WMIC.exe
Token: SeSecurityPrivilege	3172	WMIC.exe
Token: SeTakeOwnershipPrivilege	3172	WMIC.exe
Token: SeLoadDriverPrivilege	3172	WMIC.exe
Token: SeSystemProfilePrivilege	3172	WMIC.exe
Token: SeSystemtimePrivilege	3172	WMIC.exe
Token: SeProfSingleProcessPrivilege	3172	WMIC.exe
Token: SeIncBasePriorityPrivilege	3172	WMIC.exe
Token: SeCreatePagefilePrivilege	3172	WMIC.exe
Token: SeBackupPrivilege	3172	WMIC.exe
Token: SeRestorePrivilege	3172	WMIC.exe
Token: SeShutdownPrivilege	3172	WMIC.exe
Token: SeDebugPrivilege	3172	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3172	WMIC.exe
Token: SeRemoteShutdownPrivilege	3172	WMIC.exe
Token: SeUndockPrivilege	3172	WMIC.exe
Token: SeManageVolumePrivilege	3172	WMIC.exe
Token: 33	3172	WMIC.exe
Token: 34	3172	WMIC.exe
Token: 35	3172	WMIC.exe
Token: 36	3172	WMIC.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeIncreaseQuotaPrivilege	3172	WMIC.exe
Token: SeSecurityPrivilege	3172	WMIC.exe
Token: SeTakeOwnershipPrivilege	3172	WMIC.exe
Token: SeLoadDriverPrivilege	3172	WMIC.exe
Token: SeSystemProfilePrivilege	3172	WMIC.exe
Token: SeSystemtimePrivilege	3172	WMIC.exe
Token: SeProfSingleProcessPrivilege	3172	WMIC.exe
Token: SeIncBasePriorityPrivilege	3172	WMIC.exe
Token: SeCreatePagefilePrivilege	3172	WMIC.exe
Token: SeBackupPrivilege	3172	WMIC.exe
Token: SeRestorePrivilege	3172	WMIC.exe
Token: SeShutdownPrivilege	3172	WMIC.exe
Token: SeDebugPrivilege	3172	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3172	WMIC.exe
Token: SeRemoteShutdownPrivilege	3172	WMIC.exe
Token: SeUndockPrivilege	3172	WMIC.exe
Token: SeManageVolumePrivilege	3172	WMIC.exe
Token: 33	3172	WMIC.exe
Token: 34	3172	WMIC.exe
Token: 35	3172	WMIC.exe
Token: 36	3172	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3904	WMIC.exe
Token: SeSecurityPrivilege	3904	WMIC.exe
Token: SeTakeOwnershipPrivilege	3904	WMIC.exe
Token: SeLoadDriverPrivilege	3904	WMIC.exe
Token: SeSystemProfilePrivilege	3904	WMIC.exe
Token: SeSystemtimePrivilege	3904	WMIC.exe
Token: SeProfSingleProcessPrivilege	3904	WMIC.exe
Token: SeIncBasePriorityPrivilege	3904	WMIC.exe
Token: SeCreatePagefilePrivilege	3904	WMIC.exe
Token: SeBackupPrivilege	3904	WMIC.exe
Token: SeRestorePrivilege	3904	WMIC.exe
Token: SeShutdownPrivilege	3904	WMIC.exe
Token: SeDebugPrivilege	3904	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3904	WMIC.exe
Token: SeRemoteShutdownPrivilege	3904	WMIC.exe
Token: SeUndockPrivilege	3904	WMIC.exe
Token: SeManageVolumePrivilege	3904	WMIC.exe
Token: 33	3904	WMIC.exe
Token: 34	3904	WMIC.exe
Token: 35	3904	WMIC.exe
Token: 36	3904	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 5252	1480	Galaxy_Swapper.exe	90
PID 5252 wrote to memory of 1184	5252	cmd.exe	91
PID 1480 wrote to memory of 2492	1480	Galaxy_Swapper.exe	92
PID 1480 wrote to memory of 4628	1480	Galaxy_Swapper.exe	93
PID 2492 wrote to memory of 3172	2492	cmd.exe	94
PID 4628 wrote to memory of 2952	4628	cmd.exe	95
PID 1480 wrote to memory of 4064	1480	Galaxy_Swapper.exe	97
PID 1480 wrote to memory of 996	1480	Galaxy_Swapper.exe	98
PID 1480 wrote to memory of 5552	1480	Galaxy_Swapper.exe	99
PID 5552 wrote to memory of 4044	5552	cmd.exe	100
PID 996 wrote to memory of 3904	996	cmd.exe	101
PID 996 wrote to memory of 3404	996	cmd.exe	102
PID 4064 wrote to memory of 1148	4064	cmd.exe	103
PID 1480 wrote to memory of 5344	1480	Galaxy_Swapper.exe	104
PID 5344 wrote to memory of 3884	5344	cmd.exe	105
PID 1480 wrote to memory of 3192	1480	Galaxy_Swapper.exe	106
PID 3192 wrote to memory of 2972	3192	cmd.exe	107
PID 1480 wrote to memory of 6108	1480	Galaxy_Swapper.exe	108
PID 1480 wrote to memory of 4576	1480	Galaxy_Swapper.exe	110
PID 4576 wrote to memory of 1796	4576	cmd.exe	111
PID 4576 wrote to memory of 1408	4576	cmd.exe	112
PID 1480 wrote to memory of 5840	1480	Galaxy_Swapper.exe	113
PID 6108 wrote to memory of 6124	6108	cmd.exe	115
PID 1480 wrote to memory of 2756	1480	Galaxy_Swapper.exe	116
PID 5840 wrote to memory of 2564	5840	cmd.exe	117
PID 2756 wrote to memory of 544	2756	cmd.exe	118
PID 2756 wrote to memory of 4120	2756	cmd.exe	119
PID 1480 wrote to memory of 3792	1480	Galaxy_Swapper.exe	120
PID 3792 wrote to memory of 2912	3792	cmd.exe	121
PID 3792 wrote to memory of 4784	3792	cmd.exe	234
PID 1480 wrote to memory of 5444	1480	Galaxy_Swapper.exe	123
PID 5444 wrote to memory of 4164	5444	cmd.exe	124
PID 5444 wrote to memory of 4620	5444	cmd.exe	125
PID 2564 wrote to memory of 2308	2564	csc.exe	126
PID 1480 wrote to memory of 3660	1480	Galaxy_Swapper.exe	127
PID 5840 wrote to memory of 4320	5840	cmd.exe	128
PID 3660 wrote to memory of 4920	3660	cmd.exe	246
PID 3660 wrote to memory of 1788	3660	cmd.exe	130
PID 1480 wrote to memory of 3480	1480	Galaxy_Swapper.exe	131
PID 3480 wrote to memory of 4980	3480	cmd.exe	132
PID 3480 wrote to memory of 5820	3480	cmd.exe	133
PID 1480 wrote to memory of 1132	1480	Galaxy_Swapper.exe	134
PID 1132 wrote to memory of 620	1132	cmd.exe	136
PID 1480 wrote to memory of 4656	1480	Galaxy_Swapper.exe	137
PID 4656 wrote to memory of 2544	4656	cmd.exe	139
PID 1480 wrote to memory of 1636	1480	Galaxy_Swapper.exe	140
PID 1636 wrote to memory of 3432	1636	cmd.exe	142
PID 1480 wrote to memory of 1840	1480	Galaxy_Swapper.exe	143
PID 1840 wrote to memory of 4396	1840	cmd.exe	145
PID 1480 wrote to memory of 4448	1480	Galaxy_Swapper.exe	146
PID 4448 wrote to memory of 2104	4448	cmd.exe	267
PID 1480 wrote to memory of 5224	1480	Galaxy_Swapper.exe	149
PID 5224 wrote to memory of 2652	5224	cmd.exe	151
PID 1480 wrote to memory of 1324	1480	Galaxy_Swapper.exe	152
PID 1324 wrote to memory of 4672	1324	cmd.exe	154
PID 1480 wrote to memory of 3188	1480	Galaxy_Swapper.exe	155
PID 3188 wrote to memory of 4468	3188	cmd.exe	157
PID 1480 wrote to memory of 1936	1480	Galaxy_Swapper.exe	158
PID 1936 wrote to memory of 5576	1936	cmd.exe	160
PID 1480 wrote to memory of 1960	1480	Galaxy_Swapper.exe	161
PID 1960 wrote to memory of 1496	1960	cmd.exe	163
PID 1480 wrote to memory of 1464	1480	Galaxy_Swapper.exe	164
PID 1464 wrote to memory of 2752	1464	cmd.exe	166
PID 1480 wrote to memory of 2556	1480	Galaxy_Swapper.exe	167

C:\Users\Admin\AppData\Local\Temp\Galaxy_Swapper.exe
"C:\Users\Admin\AppData\Local\Temp\Galaxy_Swapper.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "hostname"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5252
- - C:\Windows\system32\HOSTNAME.EXE
    hostname
    3⤵
    PID:1184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get UUID"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get UUID
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -c "Get-WmiObject -Query \"Select * from Win32_CacheMemory\"""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "Get-WmiObject -Query \"Select * from Win32_CacheMemory\""
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get smbiosbiosversion
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic MemoryChip get /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3904
- - C:\Windows\system32\find.exe
    find /i "Speed"
    3⤵
    PID:3404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "hostname"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5344
- - C:\Windows\system32\HOSTNAME.EXE
    hostname
    3⤵
    PID:3884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
    3⤵
    PID:6124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid | more +1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1796
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:1408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\AbJeOfhuhjdD\screenshot.png" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5840
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6CF9.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC2DA5D7DAD9B744CDB2585E4B2D8B7D.TMP"
      4⤵
      PID:2308
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\AbJeOfhuhjdD\screenshot.png"
    3⤵
    - Executes dropped EXE
    PID:4320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:544
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2912
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5444
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:4164
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get totalphysicalmemory | more +1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get totalphysicalmemory
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4920
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:1788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get size | more +1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk get size
    3⤵
    - Collects information from the system
    - Suspicious behavior: EnumeratesProcesses
    PID:4980
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:5820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip"
    3⤵
    PID:3432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook"
    3⤵
    PID:4396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
    3⤵
    PID:2104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5224
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx"
    3⤵
    PID:2652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime"
    3⤵
    PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore"
    3⤵
    PID:4468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40"
    3⤵
    PID:5576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data"
    3⤵
    PID:1496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX"
    3⤵
    PID:2752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData""
  2⤵
  - Executes a command shell one-liner
  PID:2556
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData"
    3⤵
    PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack""
  2⤵
  - Executes a command shell one-liner
  PID:5824
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack"
    3⤵
    PID:2860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 135.0 (x64 en-US)""
  2⤵
  - Executes a command shell one-liner
  PID:4232
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 135.0 (x64 en-US)"
    3⤵
    PID:4296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService""
  2⤵
  - Executes a command shell one-liner
  PID:4240
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService"
    3⤵
    PID:4960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2""
  2⤵
  - Executes a command shell one-liner
  PID:4112
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2"
    3⤵
    PID:108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mspaint-b330ad9e-f80b-4c96-9949-4b4228be9a6e""
  2⤵
  - Executes a command shell one-liner
  PID:120
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mspaint-b330ad9e-f80b-4c96-9949-4b4228be9a6e"
    3⤵
    PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mstsc-4b0a31aa-df6a-4307-9b47-d5cc50009643""
  2⤵
  - Executes a command shell one-liner
  PID:2764
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mstsc-4b0a31aa-df6a-4307-9b47-d5cc50009643"
    3⤵
    PID:3564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us""
  2⤵
  - Executes a command shell one-liner
  PID:3776
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"
    3⤵
    PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent""
  2⤵
  - Executes a command shell one-liner
  PID:2016
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent"
    3⤵
    PID:1520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SnippingTool-ee6eb196-db28-4d99-816d-fa9a63b4a377""
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2948
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SnippingTool-ee6eb196-db28-4d99-816d-fa9a63b4a377"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player""
  2⤵
  - Executes a command shell one-liner
  PID:1384
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"
    3⤵
    PID:3056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC""
  2⤵
  - Executes a command shell one-liner
  PID:1336
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC"
    3⤵
    PID:3576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}""
  2⤵
  - Executes a command shell one-liner
  PID:3904
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}"
    3⤵
    PID:1088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}""
  2⤵
  - Executes a command shell one-liner
  PID:2892
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}"
    3⤵
    PID:2516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}""
  2⤵
  - Executes a command shell one-liner
  PID:3392
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}"
    3⤵
    PID:3940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}""
  2⤵
  - Executes a command shell one-liner
  PID:4936
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}"
    3⤵
    PID:888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}""
  2⤵
  - Executes a command shell one-liner
  PID:1148
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}"
    3⤵
    PID:6008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}""
  2⤵
  - Executes a command shell one-liner
  PID:5356
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}"
    3⤵
    PID:5084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}""
  2⤵
  - Executes a command shell one-liner
  PID:3740
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}"
    3⤵
    PID:1288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}""
  2⤵
  - Executes a command shell one-liner
  PID:5512
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}"
    3⤵
    PID:4888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}""
  2⤵
  - Executes a command shell one-liner
  PID:4704
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}"
    3⤵
    PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}""
  2⤵
  - Executes a command shell one-liner
  PID:5708
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}"
    3⤵
    PID:1824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}""
  2⤵
  - Executes a command shell one-liner
  PID:2800
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4784
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}"
    3⤵
    PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}""
  2⤵
  - Executes a command shell one-liner
  PID:1056
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}"
    3⤵
    PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}""
  2⤵
  - Executes a command shell one-liner
  PID:2324
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}"
    3⤵
    PID:4184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}""
  2⤵
  - Executes a command shell one-liner
  PID:5756
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}"
    3⤵
    PID:1292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}""
  2⤵
  - Executes a command shell one-liner
  PID:5584
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4920
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}"
    3⤵
    PID:2512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}""
  2⤵
  - Executes a command shell one-liner
  PID:2240
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}"
    3⤵
    PID:5692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}""
  2⤵
  - Executes a command shell one-liner
  PID:5348
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}"
    3⤵
    PID:5312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}""
  2⤵
  - Executes a command shell one-liner
  PID:3220
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}"
    3⤵
    PID:748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}""
  2⤵
  - Executes a command shell one-liner
  PID:5800
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}"
    3⤵
    PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}""
  2⤵
  - Executes a command shell one-liner
  PID:4168
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}"
    3⤵
    PID:5304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}""
  2⤵
  - Executes a command shell one-liner
  PID:4356
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}"
    3⤵
    PID:4504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}""
  2⤵
  - Executes a command shell one-liner
  PID:1432
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2104
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}"
    3⤵
    PID:5436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}""
  2⤵
  - Executes a command shell one-liner
  PID:4996
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}"
    3⤵
    PID:5432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}""
  2⤵
  - Executes a command shell one-liner
  PID:5364
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}"
    3⤵
    PID:3624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}""
  2⤵
  - Executes a command shell one-liner
  PID:3544
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}"
    3⤵
    PID:5600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 aef8b020212d19e8c6e52e5f91f96126439e9399bc7e0a9ef369ab991df7b2fa
MD5 4d8c99ec83cd2a6919efa144d162b027
SHA1 aa79e7a4511aa03d04a00461627392e33733308a
SHA512 e2c555eaa487db38d46c7c71c27955d64337d43d856b29f38c5204517b0a26ce2ab04a2b516a42882338f09be09f9a5f7fedfb1e1071c4b92bac40dc7ef7fd09
TLSH
T165215733F3CC8624CC9A403650CEAC1036B687DB419EDF6BBB84D154A43F599DF61260
MD5 SHA1 SHA512 TLSH

Submit Download

bookmarks.txt

Path C:\Users\Admin\AppData\Local\Temp\AbJeOfhuhjdD\browsers\bookmarks.txt
Size 390B
SHA256 099ee28b09dfc834b2cd53c7a8a906bcfc155864cf63c28f03213f1301be1c6b
MD5 d325fd5b529f0d55c5634caaf65e8587
SHA1 855591716d475b0ddf27021ab38e5a1fc36f8639
SHA512 63fd86c2b573c0ddc1cb27e216e6abe56b90eddb5f911706187c30ea20d586f13b95d92538245b4e93b0b6abd155106fc1627e84a5c7f619053e42a0d90c9b76
TLSH
T1C6E022E361B207A80F008C583158726B6AC3D388CFE1508AE8462FF080AD3F00AED7CC
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\AbJeOfhuhjdD\browsers\history.txt
Size 99B
SHA256 a8c75702f48beca6a51de38c196bc4bee41cbdc2cd5bb25bbcb1d996bd5511c2
MD5 feb5335e23df8c375090d2ffff869d5d
SHA1 eb2b0f81622620f9bc71630b0d9afcd87bad5fe8
SHA512 73f1d20f3d71a2077dc7b984554e85f22e7dcf17ce44455783d4a1278ff4472a09311de313b994945f072cab53f29b8f40af4c5e6f53e70ab2bc378ac1f2fbec
TLSH
T150B01204833A4ED9131C041138D7ABDA6D55E1971240707211C15BC6AE10D370181DFA
MD5 SHA1 SHA512 TLSH

Submit Download

RES6CF9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6CF9.tmp
Size 1KB
SHA256 489f8bb66950a19f7c31466d038e305d56d7c4c7dbc482b7e47b2782f1efe301
MD5 91e4c354739bbee65cdd0bb931cc79f9
SHA1 8fdfb76d4ce0871c1034a4d1796e93b75c7eef27
SHA512 5808a07e589a170b876a984aa0d4e31351c3cfc7d7f492636066ceab56e73c44ea4b49b6413f7e0d4742e78694e1a1a537746c5ba2cee09fa9169a14961bdf7d
TLSH
T1A431620093E8070FF1B3933104F6A305AA74BD9ADDDA936EA548412D2F12BC4CF925B2
MD5 SHA1 SHA512 TLSH

Submit Download

3cb442a7039ddcad2aac3f8bd5bfd6a4f9ff253ce47c1616b3a4495f11a5d0b9

Path C:\Users\Admin\AppData\Local\Temp\pkg-RNkHC5\3cb442a7039ddcad2aac3f8bd5bfd6a4f9ff253ce47c1616b3a4495f11a5d0b9
Size 1.8MB
SHA256 7fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01
MD5 3072b68e3c226aff39e6782d025f25a8
SHA1 cf559196d74fa490ac8ce192db222c9f5c5a006a
SHA512 61ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61
SSDEEP 49152:B+m+ocH2xfpTOi8stmFlZwwpx8AzdWgl+06OHULH5dsGfl:ihCTOi8sQrZwwpxTbG9
TLSH
T114858E0BA2B400BDC1EBC179861B560BE7B174051774ABEF15D48AA96F23FE3567E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b

Path C:\Users\Admin\AppData\Local\Temp\pkg-RNkHC5\4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b
Size 765B
SHA256 4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b
MD5 82703a69f6d7411dde679954c2fd9dca
SHA1 bb408e929caeb1731945b2ba54bc337edb87cc66
SHA512 3fa748e59fb3af0c5293530844faa9606d9271836489d2c8013417779d10cc180187f5e670477f9ec77d341e0ef64eab7dcfb876c6390f027bc6f869a12d0f46
TLSH
T1E401FD9FB2E26BD458D09B603DA16DC962CAB03B7803AA152468E298DB7740FA47A400
MD5 SHA1 SHA512 TLSH

Submit Download

5c906a92ac74e8c3f4f83d2e4e08f5c82413f67ef8920a79176a74baf1795927

Path C:\Users\Admin\AppData\Local\Temp\pkg-RNkHC5\5c906a92ac74e8c3f4f83d2e4e08f5c82413f67ef8920a79176a74baf1795927
Size 122KB
SHA256 1347de4fe38e85eaf6bb1ac959be1457938549605f4821f8c485c5324a589554
MD5 7c36f526d1228aed644d170d2a20c510
SHA1 8d21130f074bcc0ef95d61737f7b8b111641519b
SHA512 eaffc2340c7d43378587cd05f81a5d68747132dcc5bf9ffc1e151be119b49a5c83f37c60f783fdf14439a357a443943a773bc33c10daf6145b18854a27d87f2b
SSDEEP 3072:pR7Km4Kn1YTHbpeJ8puzho6pRWITyWIaF8aV:p5K3s1YTVZgza63uaSa
TLSH
T16EC36C0B73A540BBE17B8279C4930A05E772B8150760AFAF07F4465A1F637D19D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67855b0712a4accede482599a487eea92c62badf6940622541c04684dd2bea13

Path C:\Users\Admin\AppData\Local\Temp\pkg-RNkHC5\67855b0712a4accede482599a487eea92c62badf6940622541c04684dd2bea13
Size 15KB
SHA256 67855b0712a4accede482599a487eea92c62badf6940622541c04684dd2bea13
MD5 b4e5fee56f00a4ad701d2bace935034f
SHA1 20cbcea8f2aa54e41ecaee750b9cdb1c7fc34f63
SHA512 55e03ba479cd03081ebf654c16cc14dcb42d6745d2efc867049522bec61862efa1982e6ef8d1dd194ad248b99278838432f70b26f4003dd61ec0b94b606f7e96
SSDEEP 192:F4InsgwSDaExV8BZCt2IMAxdMxfpJ81bkJJtotj7FHh1Scb4DssgAb487d3fWcVz:eHSDaExHtjBHhxe/gAb48FfW7m
TLSH
T1A0628926C42E4F8636C47E546CD4624199818997CDA2B418732C4B5C6FEF0AFDAFB23D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

720836c9bdad386485a492ab41fe08007ecf85ca278ddd8f9333494dcac4949d

Path C:\Users\Admin\AppData\Local\Temp\pkg-RNkHC5\720836c9bdad386485a492ab41fe08007ecf85ca278ddd8f9333494dcac4949d
Size 755B
SHA256 720836c9bdad386485a492ab41fe08007ecf85ca278ddd8f9333494dcac4949d
MD5 5324d196a847002a5d476185a59cf238
SHA1 dfe418dc288edb0a4bb66af2ad88bd838c55e136
SHA512 1b4187c58bebb6378f8a04300da6f4d1f12f6fbe9a1ab7ceda8a4752e263f282daebcac1379fa0675dd78ec86fffb127dba6469f303570b9f21860454df2203f
TLSH
T1AD0125AE72F16EE478D59B902DA1B4CD51CCB0727407BA003468E394D7A704F98BE000
MD5 SHA1 SHA512 TLSH

Submit Download

907333195fbf4f8d781f2a35f7313811a8787736f8d04d2c1dc1f46c78cca38c

Path C:\Users\Admin\AppData\Local\Temp\pkg-RNkHC5\907333195fbf4f8d781f2a35f7313811a8787736f8d04d2c1dc1f46c78cca38c
Size 109KB
SHA256 f6c33cc68381426fa98422fdf9efa44beb4573e16cbee5188964fba42884ecc8
MD5 e5fe38c4ab5083afbb6311040b34fe1e
SHA1 9e6782a2545952b6631e2e64594fbd9e430ebaeb
SHA512 2e01f0552a722ce7c8d4404d8e667a517fa9c1e6dbca472aeb991523408baae299e6271cbea6f69d56f84b4f8113db2ad8880a1ab582082fca07dac77393becc
SSDEEP 1536:HabP6jajHxKriGp3sEBnQCkSbJJ6xQyaNAtwRe0fzJgsW3dP9dlz6OXYx5C:HabPpCxpQCk6zIhaNA4fSvx6Ow5C
TLSH
T119B36C1B73A510BBF43A8674C8930E46E7B6B4110761AB6F03A4839A1F637919D3FF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenCapture_1.3.2.bat

Path C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat
Size 13KB
SHA256 818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
MD5 da0f40d84d72ae3e9324ad9a040a2e58
SHA1 4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA512 30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP 384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx
TLSH
T1A95263095E1341B5183330266FCB839AFA2B417375AAED40395C8375DF26A1BC675BEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenCapture_1.3.2.exe

Path C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
Size 12KB
SHA256 199bd331b78a1829630c30c1152bad109506ead7f34444b8e26f848b2a7fc428
MD5 8711196af665e0995b4587032c27d7ea
SHA1 77778076849389d4021f339e41e6477cfde3dadf
SHA512 6ebbb52f1696a1fefbef3c2a5286cc8d146a75330947e21251b3b32ff952497dab8eacd6d1d4e860f0cfad4952fde733c59e9eb5c5b2ed8ccdb98773509fcec7
SSDEEP 192:s0ZP9yjWewKlBNOOOP3fs3JBy775ia7SBgvuIbZa8uXZlLpwHdGCpRT/:jiW6OOOPUy75i/++XZ1pwHdGC7/
TLSH
T165429306EBE08914F4FF7B751873071817B9F9CA9C33C75E0A8C655AAE237049A10BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC2DA5D7DAD9B744CDB2585E4B2D8B7D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC2DA5D7DAD9B744CDB2585E4B2D8B7D.TMP
Size 1KB
SHA256 ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344
MD5 a6f2d21624678f54a2abed46e9f3ab17
SHA1 a2a6f07684c79719007d434cbd1cd2164565734a
SHA512 0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676
TLSH
T12B115B44B2E8414DF2E3973069F5A3539458BDA6CCAA43AC744C470E2F21941C6539F2
MD5 SHA1 SHA512 TLSH

Submit Download

app.manifest

Path \??\c:\Users\Admin\AppData\Local\Temp\screenCapture\app.manifest
Size 350B
SHA256 8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83
MD5 8951565428aa6644f1505edb592ab38f
SHA1 9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2
SHA512 7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5
TLSH
T150E08680A46590EDB395A0615566F280A99947FF04DD41B8B05C8C6E7F15DCAC3431F3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2952-1126-0x0000023D8C720000-0x0000023D8C742000-memory.dmp

Download

memory/4320-1160-0x0000000000A60000-0x0000000000A6A000-memory.dmp

Download