65ca9701781bcad90a719b79c578acb21976f1de1a3d37b1ccb3117b6b7c4060

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dx9ware crack/dx9injector.exe
Size 858KB
Sample260908-2xa9msyvcs
SHA256 65ca9701781bcad90a719b79c578acb21976f1de1a3d37b1ccb3117b6b7c4060
MD5 0a332f7ca0b4d68347446065ee09cccd
SHA1 a4da63ef02c73cdb11ab65f1dfd4856318c0e593
SHA512 6d5476721ca01f742925ce9c521b7f88f053075fd8bac7b40f0e2ad962f17a08a0dc269d7f140ebbb9fba4f0f26794b671c68651e0e63a91477da42080ec785c
SSDEEP 24576:db3399J3lhnRBgEsZ7mnm4ksJwnlLiTNm:d3399J3lhnRBgE9HIiTNm
TLSH
T1CC15BF62BD81D0B3E5E10074097EA73A4D3DF5290B2099DBA3D05ABD9B202D16F3B79D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4536	cmd.exe
3696	cmd.exe
5216	cmd.exe
3176	cmd.exe
1268	cmd.exe
6048	cmd.exe
4684	cmd.exe
5980	cmd.exe
1948	cmd.exe
2740	cmd.exe
3472	cmd.exe
4520	cmd.exe
5828	cmd.exe
2528	cmd.exe
1720	cmd.exe
2620	cmd.exe
5172	cmd.exe
6064	cmd.exe
2324	cmd.exe
2080	cmd.exe
1084	cmd.exe
1104	cmd.exe
2608	cmd.exe
5452	cmd.exe
4360	cmd.exe
1704	cmd.exe
2592	cmd.exe
4848	cmd.exe
3924	cmd.exe
1512	cmd.exe
3744	cmd.exe
6040	cmd.exe
5384	cmd.exe
6020	cmd.exe
708	cmd.exe
3692	cmd.exe
2700	cmd.exe
3544	cmd.exe
4308	cmd.exe
3400	cmd.exe
2176	cmd.exe
5900	cmd.exe
4612	cmd.exe
1840	cmd.exe
3180	cmd.exe
4604	cmd.exe
124	cmd.exe
5500	cmd.exe
2108	cmd.exe
2584	cmd.exe
952	cmd.exe
4560	cmd.exe
5892	cmd.exe
3964	cmd.exe
3624	cmd.exe
4212	cmd.exe
5600	cmd.exe
3152	cmd.exe
5764	cmd.exe
2680	cmd.exe
4900	cmd.exe
4696	cmd.exe
4748	cmd.exe
5024	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dx9injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 4900	1172	dx9injector.exe	90
PID 1172 wrote to memory of 4612	1172	dx9injector.exe	91
PID 1172 wrote to memory of 4520	1172	dx9injector.exe	92
PID 1172 wrote to memory of 5828	1172	dx9injector.exe	93
PID 1172 wrote to memory of 3696	1172	dx9injector.exe	94
PID 1172 wrote to memory of 4696	1172	dx9injector.exe	95
PID 1172 wrote to memory of 2584	1172	dx9injector.exe	96
PID 1172 wrote to memory of 2620	1172	dx9injector.exe	97
PID 1172 wrote to memory of 4748	1172	dx9injector.exe	98
PID 1172 wrote to memory of 6048	1172	dx9injector.exe	99
PID 1172 wrote to memory of 2700	1172	dx9injector.exe	100
PID 1172 wrote to memory of 1512	1172	dx9injector.exe	101
PID 1172 wrote to memory of 3544	1172	dx9injector.exe	102
PID 1172 wrote to memory of 3924	1172	dx9injector.exe	103
PID 1172 wrote to memory of 5024	1172	dx9injector.exe	104
PID 1172 wrote to memory of 5216	1172	dx9injector.exe	105
PID 1172 wrote to memory of 4848	1172	dx9injector.exe	106
PID 1172 wrote to memory of 2528	1172	dx9injector.exe	107
PID 1172 wrote to memory of 3624	1172	dx9injector.exe	108
PID 1172 wrote to memory of 952	1172	dx9injector.exe	109
PID 1172 wrote to memory of 4660	1172	dx9injector.exe	110
PID 1172 wrote to memory of 4684	1172	dx9injector.exe	111
PID 1172 wrote to memory of 1104	1172	dx9injector.exe	112
PID 1172 wrote to memory of 5900	1172	dx9injector.exe	113
PID 1172 wrote to memory of 124	1172	dx9injector.exe	114
PID 1172 wrote to memory of 3744	1172	dx9injector.exe	115
PID 1172 wrote to memory of 6060	1172	dx9injector.exe	116
PID 1172 wrote to memory of 6040	1172	dx9injector.exe	117
PID 1172 wrote to memory of 5500	1172	dx9injector.exe	118
PID 1172 wrote to memory of 5384	1172	dx9injector.exe	119
PID 1172 wrote to memory of 5172	1172	dx9injector.exe	120
PID 1172 wrote to memory of 1380	1172	dx9injector.exe	121
PID 1172 wrote to memory of 2108	1172	dx9injector.exe	122
PID 1172 wrote to memory of 4560	1172	dx9injector.exe	123
PID 1172 wrote to memory of 6020	1172	dx9injector.exe	124
PID 1172 wrote to memory of 4212	1172	dx9injector.exe	125
PID 1172 wrote to memory of 2524	1172	dx9injector.exe	126
PID 1172 wrote to memory of 6064	1172	dx9injector.exe	127
PID 1172 wrote to memory of 708	1172	dx9injector.exe	128
PID 1172 wrote to memory of 5980	1172	dx9injector.exe	129
PID 1172 wrote to memory of 5892	1172	dx9injector.exe	130
PID 1172 wrote to memory of 1704	1172	dx9injector.exe	131
PID 1172 wrote to memory of 2460	1172	dx9injector.exe	132
PID 1172 wrote to memory of 3692	1172	dx9injector.exe	133
PID 1172 wrote to memory of 5600	1172	dx9injector.exe	134
PID 1172 wrote to memory of 2324	1172	dx9injector.exe	135
PID 1172 wrote to memory of 3152	1172	dx9injector.exe	136
PID 1172 wrote to memory of 2080	1172	dx9injector.exe	137
PID 1172 wrote to memory of 1948	1172	dx9injector.exe	138
PID 1172 wrote to memory of 2608	1172	dx9injector.exe	139
PID 1172 wrote to memory of 3964	1172	dx9injector.exe	140
PID 1172 wrote to memory of 5764	1172	dx9injector.exe	141
PID 1172 wrote to memory of 1840	1172	dx9injector.exe	142
PID 1172 wrote to memory of 2640	1172	dx9injector.exe	143
PID 1172 wrote to memory of 4536	1172	dx9injector.exe	144
PID 1172 wrote to memory of 1720	1172	dx9injector.exe	145
PID 1172 wrote to memory of 2740	1172	dx9injector.exe	146
PID 1172 wrote to memory of 2680	1172	dx9injector.exe	147
PID 1172 wrote to memory of 3472	1172	dx9injector.exe	148
PID 1172 wrote to memory of 4308	1172	dx9injector.exe	149
PID 1172 wrote to memory of 4292	1172	dx9injector.exe	150
PID 1172 wrote to memory of 3180	1172	dx9injector.exe	151
PID 1172 wrote to memory of 3400	1172	dx9injector.exe	152
PID 1172 wrote to memory of 3176	1172	dx9injector.exe	153

C:\Users\Admin\AppData\Local\Temp\dx9ware crack\dx9injector.exe
"C:\Users\Admin\AppData\Local\Temp\dx9ware crack\dx9injector.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  PID:5828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  PID:3624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  PID:5980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  PID:5892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  PID:3692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  PID:3472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  PID:3180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  PID:3176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads