Extracted

• • Target

    https://www.unknowncheats.me/forum/downloads.php?do=file&id=42786&act=down&actionhash=1732133693-9a6c87424eb62b215029162dd65e041e37786737

  Score

  10^/10

  discoveryexecutionphishing

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing
  behavioral1behavioral2