67a7379a6175f00d09621cb9ea4ffd6911305a4c0a6674c74643f14dced7457a

Analysis

user interaction
yes
max time kernel
58s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Galaxy_Swapper.exe
Size 51.1MB
Sample260808-rxl12asxcs
SHA256 67a7379a6175f00d09621cb9ea4ffd6911305a4c0a6674c74643f14dced7457a
MD5 33eb60f009aea961568ab064ba4f57a9
SHA1 a7c64f5d25780e10c64e1416f9048d3479ed7629
SHA512 f81b4036996a1c280f301fa180b483b4722773593a1a2e20eae2f3a4e9804b7ffca04374d54e3cc651ad242d7242c2b55664652283393a51261fa4dc28bbf8e8
SSDEEP 786432:WMguj8Q4VfvyqFTrYZKuA1gIm7DmKaDgWz6+u67i:WiAQIHykHeAa7DU+e7i
TLSH
T119C7CE0773E601A5E5B7E2388AA75503D7B3B4635331DADF329D06111FABAD09A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.exe	Galaxy_Swapper.exe

Executes dropped EXE 1 IoCs

pid	Process
4696	screenCapture_1.3.2.exe

Loads dropped DLL 3 IoCs

pid	Process
4792	Galaxy_Swapper.exe
4792	Galaxy_Swapper.exe
4792	Galaxy_Swapper.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	api.gofile.io
4	api.gofile.io

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	api.ipify.org
3	api.ipify.org
1	api.ipify.org

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5916	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4212	cmd.exe
4088	cmd.exe
1224	cmd.exe
3964	cmd.exe
2864	cmd.exe
4980	cmd.exe
5496	cmd.exe
948	cmd.exe
5404	cmd.exe
6068	cmd.exe
2624	cmd.exe
5832	cmd.exe
6132	cmd.exe
3656	cmd.exe
1496	cmd.exe
4316	cmd.exe
3028	cmd.exe
4724	cmd.exe
3180	cmd.exe
2980	cmd.exe
5948	cmd.exe
4432	cmd.exe
2556	cmd.exe
4284	cmd.exe
3320	cmd.exe
260	cmd.exe
6080	cmd.exe
4360	cmd.exe
1240	cmd.exe
4456	cmd.exe
2420	cmd.exe
3484	cmd.exe
2220	cmd.exe
5288	cmd.exe
1156	cmd.exe
2984	cmd.exe
2736	cmd.exe
3340	cmd.exe
2960	cmd.exe
2356	cmd.exe
5040	cmd.exe
5408	cmd.exe
4520	cmd.exe
5364	cmd.exe
416	cmd.exe
5128	cmd.exe
1916	cmd.exe
2472	cmd.exe
4304	cmd.exe
5396	cmd.exe
4788	cmd.exe
2056	cmd.exe
2948	cmd.exe
5868	cmd.exe
3092	cmd.exe
6108	cmd.exe
3356	cmd.exe
4436	cmd.exe
5032	cmd.exe
2480	cmd.exe
4552	cmd.exe
3740	cmd.exe
1160	cmd.exe
1396	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1156	cmd.exe
2460	reg.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
3368	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5996	WMIC.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
2536	WMIC.exe
2536	WMIC.exe
2536	WMIC.exe
2536	WMIC.exe
2840	powershell.exe
2840	powershell.exe
3592	WMIC.exe
3592	WMIC.exe
3592	WMIC.exe
3592	WMIC.exe
924	WMIC.exe
924	WMIC.exe
924	WMIC.exe
924	WMIC.exe
5008	powershell.exe
5008	powershell.exe
5008	powershell.exe
4376	WMIC.exe
4376	WMIC.exe
4376	WMIC.exe
4376	WMIC.exe
5028	WMIC.exe
5028	WMIC.exe
5028	WMIC.exe
5028	WMIC.exe
4180	WMIC.exe
4180	WMIC.exe
4180	WMIC.exe
4180	WMIC.exe
5996	WMIC.exe
5996	WMIC.exe
5996	WMIC.exe
5996	WMIC.exe
1920	WMIC.exe
1920	WMIC.exe
1920	WMIC.exe
1920	WMIC.exe
3368	WMIC.exe
3368	WMIC.exe
3368	WMIC.exe
3368	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2536	WMIC.exe
Token: SeSecurityPrivilege	2536	WMIC.exe
Token: SeTakeOwnershipPrivilege	2536	WMIC.exe
Token: SeLoadDriverPrivilege	2536	WMIC.exe
Token: SeSystemProfilePrivilege	2536	WMIC.exe
Token: SeSystemtimePrivilege	2536	WMIC.exe
Token: SeProfSingleProcessPrivilege	2536	WMIC.exe
Token: SeIncBasePriorityPrivilege	2536	WMIC.exe
Token: SeCreatePagefilePrivilege	2536	WMIC.exe
Token: SeBackupPrivilege	2536	WMIC.exe
Token: SeRestorePrivilege	2536	WMIC.exe
Token: SeShutdownPrivilege	2536	WMIC.exe
Token: SeDebugPrivilege	2536	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2536	WMIC.exe
Token: SeRemoteShutdownPrivilege	2536	WMIC.exe
Token: SeUndockPrivilege	2536	WMIC.exe
Token: SeManageVolumePrivilege	2536	WMIC.exe
Token: 33	2536	WMIC.exe
Token: 34	2536	WMIC.exe
Token: 35	2536	WMIC.exe
Token: 36	2536	WMIC.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeIncreaseQuotaPrivilege	2536	WMIC.exe
Token: SeSecurityPrivilege	2536	WMIC.exe
Token: SeTakeOwnershipPrivilege	2536	WMIC.exe
Token: SeLoadDriverPrivilege	2536	WMIC.exe
Token: SeSystemProfilePrivilege	2536	WMIC.exe
Token: SeSystemtimePrivilege	2536	WMIC.exe
Token: SeProfSingleProcessPrivilege	2536	WMIC.exe
Token: SeIncBasePriorityPrivilege	2536	WMIC.exe
Token: SeCreatePagefilePrivilege	2536	WMIC.exe
Token: SeBackupPrivilege	2536	WMIC.exe
Token: SeRestorePrivilege	2536	WMIC.exe
Token: SeShutdownPrivilege	2536	WMIC.exe
Token: SeDebugPrivilege	2536	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2536	WMIC.exe
Token: SeRemoteShutdownPrivilege	2536	WMIC.exe
Token: SeUndockPrivilege	2536	WMIC.exe
Token: SeManageVolumePrivilege	2536	WMIC.exe
Token: 33	2536	WMIC.exe
Token: 34	2536	WMIC.exe
Token: 35	2536	WMIC.exe
Token: 36	2536	WMIC.exe
Token: SeIncreaseQuotaPrivilege	924	WMIC.exe
Token: SeSecurityPrivilege	924	WMIC.exe
Token: SeTakeOwnershipPrivilege	924	WMIC.exe
Token: SeLoadDriverPrivilege	924	WMIC.exe
Token: SeSystemProfilePrivilege	924	WMIC.exe
Token: SeSystemtimePrivilege	924	WMIC.exe
Token: SeProfSingleProcessPrivilege	924	WMIC.exe
Token: SeIncBasePriorityPrivilege	924	WMIC.exe
Token: SeCreatePagefilePrivilege	924	WMIC.exe
Token: SeBackupPrivilege	924	WMIC.exe
Token: SeRestorePrivilege	924	WMIC.exe
Token: SeShutdownPrivilege	924	WMIC.exe
Token: SeDebugPrivilege	924	WMIC.exe
Token: SeSystemEnvironmentPrivilege	924	WMIC.exe
Token: SeRemoteShutdownPrivilege	924	WMIC.exe
Token: SeUndockPrivilege	924	WMIC.exe
Token: SeManageVolumePrivilege	924	WMIC.exe
Token: 33	924	WMIC.exe
Token: 34	924	WMIC.exe
Token: 35	924	WMIC.exe
Token: 36	924	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 4724	4792	Galaxy_Swapper.exe	90
PID 4724 wrote to memory of 3916	4724	cmd.exe	91
PID 4792 wrote to memory of 5040	4792	Galaxy_Swapper.exe	92
PID 4792 wrote to memory of 4284	4792	Galaxy_Swapper.exe	93
PID 4284 wrote to memory of 2840	4284	cmd.exe	94
PID 5040 wrote to memory of 2536	5040	cmd.exe	95
PID 4792 wrote to memory of 1224	4792	Galaxy_Swapper.exe	97
PID 4792 wrote to memory of 4456	4792	Galaxy_Swapper.exe	98
PID 4792 wrote to memory of 3964	4792	Galaxy_Swapper.exe	99
PID 3964 wrote to memory of 5008	3964	cmd.exe	100
PID 4456 wrote to memory of 3592	4456	cmd.exe	101
PID 4456 wrote to memory of 1160	4456	cmd.exe	102
PID 1224 wrote to memory of 924	1224	cmd.exe	103
PID 4792 wrote to memory of 2420	4792	Galaxy_Swapper.exe	104
PID 2420 wrote to memory of 4608	2420	cmd.exe	105
PID 4792 wrote to memory of 3484	4792	Galaxy_Swapper.exe	106
PID 3484 wrote to memory of 5916	3484	cmd.exe	107
PID 4792 wrote to memory of 5032	4792	Galaxy_Swapper.exe	108
PID 4792 wrote to memory of 5868	4792	Galaxy_Swapper.exe	110
PID 4792 wrote to memory of 4432	4792	Galaxy_Swapper.exe	111
PID 5868 wrote to memory of 4376	5868	cmd.exe	113
PID 5868 wrote to memory of 4176	5868	cmd.exe	114
PID 5032 wrote to memory of 5096	5032	cmd.exe	115
PID 4432 wrote to memory of 2824	4432	cmd.exe	116
PID 4792 wrote to memory of 1240	4792	Galaxy_Swapper.exe	117
PID 1240 wrote to memory of 5028	1240	cmd.exe	118
PID 1240 wrote to memory of 3560	1240	cmd.exe	234
PID 4792 wrote to memory of 2472	4792	Galaxy_Swapper.exe	120
PID 2472 wrote to memory of 4180	2472	cmd.exe	121
PID 2472 wrote to memory of 4948	2472	cmd.exe	122
PID 4792 wrote to memory of 4088	4792	Galaxy_Swapper.exe	123
PID 4088 wrote to memory of 5996	4088	cmd.exe	124
PID 4088 wrote to memory of 2240	4088	cmd.exe	246
PID 2824 wrote to memory of 4060	2824	csc.exe	126
PID 4432 wrote to memory of 4696	4432	cmd.exe	127
PID 4792 wrote to memory of 2624	4792	Galaxy_Swapper.exe	128
PID 2624 wrote to memory of 1920	2624	cmd.exe	129
PID 2624 wrote to memory of 3460	2624	cmd.exe	130
PID 4792 wrote to memory of 2864	4792	Galaxy_Swapper.exe	131
PID 2864 wrote to memory of 3368	2864	cmd.exe	132
PID 2864 wrote to memory of 3088	2864	cmd.exe	133
PID 4792 wrote to memory of 2556	4792	Galaxy_Swapper.exe	134
PID 2556 wrote to memory of 1084	2556	cmd.exe	259
PID 4792 wrote to memory of 3092	4792	Galaxy_Swapper.exe	137
PID 3092 wrote to memory of 4172	3092	cmd.exe	139
PID 4792 wrote to memory of 2480	4792	Galaxy_Swapper.exe	140
PID 2480 wrote to memory of 1528	2480	cmd.exe	142
PID 4792 wrote to memory of 4980	4792	Galaxy_Swapper.exe	143
PID 4980 wrote to memory of 4956	4980	cmd.exe	145
PID 4792 wrote to memory of 5832	4792	Galaxy_Swapper.exe	146
PID 5832 wrote to memory of 2844	5832	cmd.exe	148
PID 4792 wrote to memory of 2356	4792	Galaxy_Swapper.exe	149
PID 2356 wrote to memory of 1756	2356	cmd.exe	151
PID 4792 wrote to memory of 5948	4792	Galaxy_Swapper.exe	152
PID 5948 wrote to memory of 1280	5948	cmd.exe	276
PID 4792 wrote to memory of 3340	4792	Galaxy_Swapper.exe	155
PID 3340 wrote to memory of 4528	3340	cmd.exe	157
PID 4792 wrote to memory of 5408	4792	Galaxy_Swapper.exe	158
PID 5408 wrote to memory of 3424	5408	cmd.exe	160
PID 4792 wrote to memory of 3320	4792	Galaxy_Swapper.exe	161
PID 3320 wrote to memory of 5476	3320	cmd.exe	163
PID 4792 wrote to memory of 6132	4792	Galaxy_Swapper.exe	164
PID 6132 wrote to memory of 4740	6132	cmd.exe	166
PID 4792 wrote to memory of 1916	4792	Galaxy_Swapper.exe	167

C:\Users\Admin\AppData\Local\Temp\Galaxy_Swapper.exe
"C:\Users\Admin\AppData\Local\Temp\Galaxy_Swapper.exe"
1⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "hostname"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\system32\HOSTNAME.EXE
    hostname
    3⤵
    PID:3916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get UUID"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get UUID
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -c "Get-WmiObject -Query \"Select * from Win32_CacheMemory\"""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "Get-WmiObject -Query \"Select * from Win32_CacheMemory\""
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get smbiosbiosversion
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic MemoryChip get /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3592
- - C:\Windows\system32\find.exe
    find /i "Speed"
    3⤵
    PID:1160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "hostname"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\system32\HOSTNAME.EXE
    hostname
    3⤵
    PID:4608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
    3⤵
    PID:5096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid | more +1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4376
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\Oxg88sxaXe7Y\screenshot.png" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES26A9.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCBBFD7FA0702F4353B749C076785A1390.TMP"
      4⤵
      PID:4060
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\Oxg88sxaXe7Y\screenshot.png"
    3⤵
    - Executes dropped EXE
    PID:4696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5028
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:3560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4180
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:5996
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get totalphysicalmemory | more +1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get totalphysicalmemory
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1920
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:3460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get size | more +1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk get size
    3⤵
    - Collects information from the system
    - Suspicious behavior: EnumeratesProcesses
    PID:3368
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:3088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip"
    3⤵
    PID:1528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook"
    3⤵
    PID:4956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
    3⤵
    PID:2844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx"
    3⤵
    PID:1756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime"
    3⤵
    PID:1280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore"
    3⤵
    PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5408
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40"
    3⤵
    PID:3424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data"
    3⤵
    PID:5476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6132
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX"
    3⤵
    PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData""
  2⤵
  - Executes a command shell one-liner
  PID:1916
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData"
    3⤵
    PID:3012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack""
  2⤵
  - Executes a command shell one-liner
  PID:3656
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack"
    3⤵
    PID:5004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 135.0 (x64 en-US)""
  2⤵
  - Executes a command shell one-liner
  PID:4552
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 135.0 (x64 en-US)"
    3⤵
    PID:2296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService""
  2⤵
  - Executes a command shell one-liner
  PID:1496
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService"
    3⤵
    PID:5428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2""
  2⤵
  - Executes a command shell one-liner
  PID:2220
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2"
    3⤵
    PID:2112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mspaint-b330ad9e-f80b-4c96-9949-4b4228be9a6e""
  2⤵
  - Executes a command shell one-liner
  PID:5496
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mspaint-b330ad9e-f80b-4c96-9949-4b4228be9a6e"
    3⤵
    PID:2768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mstsc-4b0a31aa-df6a-4307-9b47-d5cc50009643""
  2⤵
  - Executes a command shell one-liner
  PID:4304
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mstsc-4b0a31aa-df6a-4307-9b47-d5cc50009643"
    3⤵
    PID:5588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us""
  2⤵
  - Executes a command shell one-liner
  PID:5396
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"
    3⤵
    PID:6044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent""
  2⤵
  - Executes a command shell one-liner
  PID:3180
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent"
    3⤵
    PID:476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SnippingTool-ee6eb196-db28-4d99-816d-fa9a63b4a377""
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1156
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SnippingTool-ee6eb196-db28-4d99-816d-fa9a63b4a377"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player""
  2⤵
  - Executes a command shell one-liner
  PID:4316
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"
    3⤵
    PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC""
  2⤵
  - Executes a command shell one-liner
  PID:948
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC"
    3⤵
    PID:52
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}""
  2⤵
  - Executes a command shell one-liner
  PID:260
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}"
    3⤵
    PID:252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}""
  2⤵
  - Executes a command shell one-liner
  PID:3740
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}"
    3⤵
    PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}""
  2⤵
  - Executes a command shell one-liner
  PID:4520
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}"
    3⤵
    PID:3196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}""
  2⤵
  - Executes a command shell one-liner
  PID:2984
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}"
    3⤵
    PID:4272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}""
  2⤵
  - Executes a command shell one-liner
  PID:4212
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}"
    3⤵
    PID:6064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}""
  2⤵
  - Executes a command shell one-liner
  PID:1160
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}"
    3⤵
    PID:3736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}""
  2⤵
  - Executes a command shell one-liner
  PID:5364
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}"
    3⤵
    PID:1308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}""
  2⤵
  - Executes a command shell one-liner
  PID:416
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}"
    3⤵
    PID:4992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}""
  2⤵
  - Executes a command shell one-liner
  PID:4788
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}"
    3⤵
    PID:3512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}""
  2⤵
  - Executes a command shell one-liner
  PID:6080
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}"
    3⤵
    PID:4720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}""
  2⤵
  - Executes a command shell one-liner
  PID:2980
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3560
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}"
    3⤵
    PID:4752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}""
  2⤵
  - Executes a command shell one-liner
  PID:5128
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}"
    3⤵
    PID:1772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}""
  2⤵
  - Executes a command shell one-liner
  PID:6108
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}"
    3⤵
    PID:5492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}""
  2⤵
  - Executes a command shell one-liner
  PID:5404
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}"
    3⤵
    PID:2884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}""
  2⤵
  - Executes a command shell one-liner
  PID:4360
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2240
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}"
    3⤵
    PID:5664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}""
  2⤵
  - Executes a command shell one-liner
  PID:2736
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}"
    3⤵
    PID:6092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}""
  2⤵
  - Executes a command shell one-liner
  PID:3356
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}"
    3⤵
    PID:4760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}""
  2⤵
  - Executes a command shell one-liner
  PID:4436
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}"
    3⤵
    PID:692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}""
  2⤵
  - Executes a command shell one-liner
  PID:6068
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}"
    3⤵
    PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}""
  2⤵
  - Executes a command shell one-liner
  PID:5288
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}"
    3⤵
    PID:2604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}""
  2⤵
  - Executes a command shell one-liner
  PID:2960
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}"
    3⤵
    PID:2172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}""
  2⤵
  - Executes a command shell one-liner
  PID:2056
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}"
    3⤵
    PID:2524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}""
  2⤵
  - Executes a command shell one-liner
  PID:3028
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}"
    3⤵
    PID:4548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}""
  2⤵
  - Executes a command shell one-liner
  PID:1396
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}"
    3⤵
    PID:6104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}""
  2⤵
  - Executes a command shell one-liner
  PID:2948
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1280
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}"
    3⤵
    PID:4660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1644a8734b1a870853c20608b2c652c71a46e3cce6318ad116a4f9159a76d282
MD5 c104f03b2b4f3402a8cad00e56679300
SHA1 e1d3b9ab2d030f209415f08f5a8c3906bb5c86db
SHA512 d6e259d5aecf849e0b812f786147f10cfb7971150c06d1319d6907093c09ffb05f4a5559fbf4850a5f8dd99f00e9c06b994e9677baa707d549eb65a2042c9eb2
TLSH
T182215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

bookmarks.txt

Path C:\Users\Admin\AppData\Local\Temp\Oxg88sxaXe7Y\browsers\bookmarks.txt
Size 390B
SHA256 099ee28b09dfc834b2cd53c7a8a906bcfc155864cf63c28f03213f1301be1c6b
MD5 d325fd5b529f0d55c5634caaf65e8587
SHA1 855591716d475b0ddf27021ab38e5a1fc36f8639
SHA512 63fd86c2b573c0ddc1cb27e216e6abe56b90eddb5f911706187c30ea20d586f13b95d92538245b4e93b0b6abd155106fc1627e84a5c7f619053e42a0d90c9b76
TLSH
T1C6E022E361B207A80F008C583158726B6AC3D388CFE1508AE8462FF080AD3F00AED7CC
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\Oxg88sxaXe7Y\browsers\history.txt
Size 99B
SHA256 b17469500ab03208a7fd10050a836e1dcf1452698cf67c42b2f3f10dd7a6914f
MD5 b8d5efbcb024e2a23ee5292db5571cc3
SHA1 38d9ad4fff72577625156a7dc6764976ddfe4903
SHA512 feacac38d68fe0a04b86ae04d56051ea3ea13f3997c965d2f671f83495c3e60ff0c0d44dc9a664a34dc829f3b94016a8187bf31686cfa0e64741f2bd3f9086c0
TLSH
T1A0B01200822546D9131C0411388726DB7D14D1EA5280A06225C05BCDEB148570181CF7
MD5 SHA1 SHA512 TLSH

Submit Download

RES26A9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES26A9.tmp
Size 1KB
SHA256 83e4155037c8ff3d322df585adecf3d57f0edf03fbc65b4ab6604e68c8a4d4ec
MD5 f8b21b5cdc6155404dd89124c3ed9b37
SHA1 c631fb9c02c73a7b4cdf2d3ebe6c378217644a90
SHA512 52ad36beeba0009300e09e66c833b908af9bf945ecc04134213f067be1f45e801fc6492b208c24856468a378d3eb73747300394bcd64b69d9b0adb5a6485a9a5
TLSH
T19D31620493E8470EF1B3973004FAA705A638BD99DDDA536EB448412E2F12784DF926F2
MD5 SHA1 SHA512 TLSH

Submit Download

3cb442a7039ddcad2aac3f8bd5bfd6a4f9ff253ce47c1616b3a4495f11a5d0b9

Path C:\Users\Admin\AppData\Local\Temp\pkg-NiSRCV\3cb442a7039ddcad2aac3f8bd5bfd6a4f9ff253ce47c1616b3a4495f11a5d0b9
Size 1.8MB
SHA256 7fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01
MD5 3072b68e3c226aff39e6782d025f25a8
SHA1 cf559196d74fa490ac8ce192db222c9f5c5a006a
SHA512 61ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61
SSDEEP 49152:B+m+ocH2xfpTOi8stmFlZwwpx8AzdWgl+06OHULH5dsGfl:ihCTOi8sQrZwwpxTbG9
TLSH
T114858E0BA2B400BDC1EBC179861B560BE7B174051774ABEF15D48AA96F23FE3567E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b

Path C:\Users\Admin\AppData\Local\Temp\pkg-NiSRCV\4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b
Size 765B
SHA256 4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b
MD5 82703a69f6d7411dde679954c2fd9dca
SHA1 bb408e929caeb1731945b2ba54bc337edb87cc66
SHA512 3fa748e59fb3af0c5293530844faa9606d9271836489d2c8013417779d10cc180187f5e670477f9ec77d341e0ef64eab7dcfb876c6390f027bc6f869a12d0f46
TLSH
T1E401FD9FB2E26BD458D09B603DA16DC962CAB03B7803AA152468E298DB7740FA47A400
MD5 SHA1 SHA512 TLSH

Submit Download

5c906a92ac74e8c3f4f83d2e4e08f5c82413f67ef8920a79176a74baf1795927

Path C:\Users\Admin\AppData\Local\Temp\pkg-NiSRCV\5c906a92ac74e8c3f4f83d2e4e08f5c82413f67ef8920a79176a74baf1795927
Size 122KB
SHA256 1347de4fe38e85eaf6bb1ac959be1457938549605f4821f8c485c5324a589554
MD5 7c36f526d1228aed644d170d2a20c510
SHA1 8d21130f074bcc0ef95d61737f7b8b111641519b
SHA512 eaffc2340c7d43378587cd05f81a5d68747132dcc5bf9ffc1e151be119b49a5c83f37c60f783fdf14439a357a443943a773bc33c10daf6145b18854a27d87f2b
SSDEEP 3072:pR7Km4Kn1YTHbpeJ8puzho6pRWITyWIaF8aV:p5K3s1YTVZgza63uaSa
TLSH
T16EC36C0B73A540BBE17B8279C4930A05E772B8150760AFAF07F4465A1F637D19D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67855b0712a4accede482599a487eea92c62badf6940622541c04684dd2bea13

Path C:\Users\Admin\AppData\Local\Temp\pkg-NiSRCV\67855b0712a4accede482599a487eea92c62badf6940622541c04684dd2bea13
Size 15KB
SHA256 67855b0712a4accede482599a487eea92c62badf6940622541c04684dd2bea13
MD5 b4e5fee56f00a4ad701d2bace935034f
SHA1 20cbcea8f2aa54e41ecaee750b9cdb1c7fc34f63
SHA512 55e03ba479cd03081ebf654c16cc14dcb42d6745d2efc867049522bec61862efa1982e6ef8d1dd194ad248b99278838432f70b26f4003dd61ec0b94b606f7e96
SSDEEP 192:F4InsgwSDaExV8BZCt2IMAxdMxfpJ81bkJJtotj7FHh1Scb4DssgAb487d3fWcVz:eHSDaExHtjBHhxe/gAb48FfW7m
TLSH
T1A0628926C42E4F8636C47E546CD4624199818997CDA2B418732C4B5C6FEF0AFDAFB23D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

720836c9bdad386485a492ab41fe08007ecf85ca278ddd8f9333494dcac4949d

Path C:\Users\Admin\AppData\Local\Temp\pkg-NiSRCV\720836c9bdad386485a492ab41fe08007ecf85ca278ddd8f9333494dcac4949d
Size 755B
SHA256 720836c9bdad386485a492ab41fe08007ecf85ca278ddd8f9333494dcac4949d
MD5 5324d196a847002a5d476185a59cf238
SHA1 dfe418dc288edb0a4bb66af2ad88bd838c55e136
SHA512 1b4187c58bebb6378f8a04300da6f4d1f12f6fbe9a1ab7ceda8a4752e263f282daebcac1379fa0675dd78ec86fffb127dba6469f303570b9f21860454df2203f
TLSH
T1AD0125AE72F16EE478D59B902DA1B4CD51CCB0727407BA003468E394D7A704F98BE000
MD5 SHA1 SHA512 TLSH

Submit Download

907333195fbf4f8d781f2a35f7313811a8787736f8d04d2c1dc1f46c78cca38c

Path C:\Users\Admin\AppData\Local\Temp\pkg-NiSRCV\907333195fbf4f8d781f2a35f7313811a8787736f8d04d2c1dc1f46c78cca38c
Size 109KB
SHA256 f6c33cc68381426fa98422fdf9efa44beb4573e16cbee5188964fba42884ecc8
MD5 e5fe38c4ab5083afbb6311040b34fe1e
SHA1 9e6782a2545952b6631e2e64594fbd9e430ebaeb
SHA512 2e01f0552a722ce7c8d4404d8e667a517fa9c1e6dbca472aeb991523408baae299e6271cbea6f69d56f84b4f8113db2ad8880a1ab582082fca07dac77393becc
SSDEEP 1536:HabP6jajHxKriGp3sEBnQCkSbJJ6xQyaNAtwRe0fzJgsW3dP9dlz6OXYx5C:HabPpCxpQCk6zIhaNA4fSvx6Ow5C
TLSH
T119B36C1B73A510BBF43A8674C8930E46E7B6B4110761AB6F03A4839A1F637919D3FF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenCapture_1.3.2.bat

Path C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat
Size 13KB
SHA256 818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
MD5 da0f40d84d72ae3e9324ad9a040a2e58
SHA1 4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA512 30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP 384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx
TLSH
T1A95263095E1341B5183330266FCB839AFA2B417375AAED40395C8375DF26A1BC675BEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenCapture_1.3.2.exe

Path C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
Size 12KB
SHA256 6cf7b0b41be739f069648170bce37d30b389bad6ee7113d3609b18f9a6ea9ce5
MD5 e0be0a80170f0681ac545a2be1d227c7
SHA1 98057a58a488f57516a114a40397c3d9adb40226
SHA512 e8bf86a561e0ddb8feb290197b8ce7d6be098a40be70e5d6d0cb6c563b492f25dcca78448e431d8b7afd1b13e9cf2489134572b76e844bcedae39f17ab723fc5
SSDEEP 192:x0ZP9yjWewKlBNOOOP3fs3JBy775ia7SBgvuIbZa8uXZlLpwHdG2pRT/:GiW6OOOPUy75i/++XZ1pwHdG27/
TLSH
T1B1429206EBE08914F4FF7B751873071817B9B9CA9C33C75E0A9C655AAE237049A10BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCBBFD7FA0702F4353B749C076785A1390.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCBBFD7FA0702F4353B749C076785A1390.TMP
Size 1KB
SHA256 ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344
MD5 a6f2d21624678f54a2abed46e9f3ab17
SHA1 a2a6f07684c79719007d434cbd1cd2164565734a
SHA512 0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676
TLSH
T12B115B44B2E8414DF2E3973069F5A3539458BDA6CCAA43AC744C470E2F21941C6539F2
MD5 SHA1 SHA512 TLSH

Submit Download

app.manifest

Path \??\c:\Users\Admin\AppData\Local\Temp\screenCapture\app.manifest
Size 350B
SHA256 8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83
MD5 8951565428aa6644f1505edb592ab38f
SHA1 9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2
SHA512 7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5
TLSH
T150E08680A46590EDB395A0615566F280A99947FF04DD41B8B05C8C6E7F15DCAC3431F3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2840-1126-0x0000021373AA0000-0x0000021373AC2000-memory.dmp

Download

memory/4696-1160-0x0000000000410000-0x000000000041A000-memory.dmp

Download