f51118f0bd8aba76700e66ab2e574ef6337f2686281e591d6631bf78ec5460cc

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vexx.exe
Size 164.5MB
Sample260602-2mgzfaex21
SHA256 f51118f0bd8aba76700e66ab2e574ef6337f2686281e591d6631bf78ec5460cc
MD5 eebfa4a1cb053d61cba5e5c12311dc6c
SHA1 2dcefe5652cbcb93d8414aa4a115490d10baa511
SHA512 5dec755fcbf8a7ede764bf48348aa5d4bb3063ba3c6186667004b4a252c72d45aa31e09253ff299a4c34994e69deade12a0decc92ed8730b708d4db59058acf4
SSDEEP 1572864:6S8FIVRV+pz0o4AbRqkaGadu15dyLgOR+39jK8DKOdCisaIZtaAbJsScW8fe07ra:Ht1azadiF2E3ra
TLSH
T12C888C03F29650E9F05DD1B19B578236EA72B8864738A6DF175407292F77FE02B39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 43 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
888	powershell.exe
5552	powershell.exe
4148	powershell.exe
224	powershell.exe
4792	powershell.exe
1540	powershell.exe
2052	powershell.exe
3476	powershell.exe
2940	powershell.exe
6032	powershell.exe
5024	powershell.exe
2556	powershell.exe
5564	powershell.exe
232	powershell.exe
4656	powershell.exe
5416	powershell.exe
6084	powershell.exe
5620	powershell.exe
5288	powershell.exe
5116	powershell.exe
1936	powershell.exe
1636	powershell.exe
240	powershell.exe
3628	powershell.exe
3832	powershell.exe
3620	powershell.exe
5300	powershell.exe
2672	powershell.exe
4844	powershell.exe
5144	powershell.exe
5632	powershell.exe
5928	powershell.exe
4352	powershell.exe
1976	powershell.exe
3484	powershell.exe
3280	powershell.exe
784	powershell.exe
5996	powershell.exe
224	powershell.exe
4344	powershell.exe
4184	powershell.exe
1632	powershell.exe
3588	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2672	netsh.exe

Executes dropped EXE 10 IoCs

pid	Process
4872	python312_installer.exe
1812	python312_installer.exe
2940	python-3.12.10-amd64.exe
6112	python-3.12.10-amd64.exe
1824	python-3.12.10-amd64.exe
5544	python312_installer.exe
2476	python312_installer.exe
4612	python-3.12.10-amd64.exe
5780	python312_installer.exe
5572	python312_installer.exe

Loads dropped DLL 4 IoCs

pid	Process
1812	python312_installer.exe
2476	python312_installer.exe
1824	python-3.12.10-amd64.exe
5572	python312_installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\\python-3.12.10-amd64.exe\" /burn.runonce"	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\\python-3.12.10-amd64.exe\" /burn.runonce"	python-3.12.10-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\\python-3.12.10-amd64.exe\" /burn.runonce"	python312_installer.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
19	4152	msiexec.exe
20	4152	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
16	discord.com
17	discord.com
27	discord.com

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.12\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipapi.co
8	ipapi.co

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 6 IoCs

discovery

Process Discovery

T1057

pid	Process
4124	tasklist.exe
2904	tasklist.exe
5456	tasklist.exe
3896	tasklist.exe
4148	tasklist.exe
232	tasklist.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF74AFA11B90EECCE8.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI52A1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF8A.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8BD3404AF67B388F.TMP	msiexec.exe
File created	C:\Windows\Installer\e58f51d.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD05F6DCAF7E03EF4.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF39F90E6BE3EC0D16.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF346B8D0DA7545084.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58f53e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C87.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF735171F89D2096C.TMP	msiexec.exe
File created	C:\Windows\Installer\e58f522.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5167.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF91C87E909828599E.TMP	msiexec.exe
File created	C:\Windows\Installer\e58f539.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF28C6F1839096946.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7630CC1D2C041EA8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3C5EEEF7FB5B6ACD.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF26EF41C4F106F521.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF560B16A8FA7D022E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4205B2EE9DEA6E63.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF940.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58f539.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE7AFC969C187FA85.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5850.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58f519.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFBA948F080199BCF.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9012D31C5C492C02.TMP	msiexec.exe
File created	C:\Windows\Installer\e58f523.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF00A5A67172C9FD9C.TMP	msiexec.exe
File created	C:\Windows\Installer\e58f542.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI42E.tmp	msiexec.exe
File created	C:\Windows\Installer\e58f519.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\e58f51e.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0158093D-F809-455B-9429-6D16A4B5D118}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAAB5FD29B4BC5142.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF32BE4D5B022D520B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58f543.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5726.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB8A10FBF2FDF38A1.TMP	msiexec.exe
File created	C:\Windows\Installer\e58f543.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF283DC95AF886A0C4.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9CCA0569C81E998E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7ABBA0DB73BB5769.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9D09C9EF-A57C-422A-B79A-CC922079653A}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCAFF7E81EE246FB0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF88594BAC5D77B7E6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8ECBB0A0F5BC11ED.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF788CF4EDA7EB18E5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0DCAC91C003E56C0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB5116D0B9505AA12.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58f523.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC2E.tmp	msiexec.exe
File created	C:\Windows\Installer\e58f53e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF40B4F22A73BB6D26.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF65143E72B0C2BF9.TMP	msiexec.exe
File created	C:\Windows\Installer\e58f51e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF119DB9010675E597.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7BF68B4C7396AD6E.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2052	powershell.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3292	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.10-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.10-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python312_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.10-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python312_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python312_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python312_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python312_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python312_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.10-amd64.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2892	cmd.exe
5096	netsh.exe
1836	cmd.exe
4508	netsh.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027a96ea556b175d40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000027a96ea50000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090027a96ea5000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a27a96ea5000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d27a96ea5000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Vexx.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Vexx.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Vexx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Vexx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Vexx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Vexx.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Vexx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Vexx.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Vexx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Vexx.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Vexx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Vexx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Vexx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Vexx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Vexx.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Vexx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Vexx.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Vexx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Vexx.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Vexx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Vexx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Vexx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Vexx.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Vexx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4100	ipconfig.exe

Kills process with taskkill 21 IoCs

defense_evasion

pid	Process
5608	taskkill.exe
5156	taskkill.exe
2104	taskkill.exe
2192	taskkill.exe
3744	taskkill.exe
4112	taskkill.exe
1140	taskkill.exe
2192	taskkill.exe
4968	taskkill.exe
5560	taskkill.exe
712	taskkill.exe
3820	taskkill.exe
1964	taskkill.exe
3832	taskkill.exe
3236	taskkill.exe
940	taskkill.exe
4508	taskkill.exe
4752	taskkill.exe
3476	taskkill.exe
400	taskkill.exe
3644	taskkill.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\ = "{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}"	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.10150.0"	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}\Version = "3.12.10150.0"	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\DisplayName = "Python 3.12.10 Executables (64-bit)"	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}\Version = "3.12.10150.0"	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}\Dependents	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\DisplayName = "Python 3.12.10 Executables (64-bit)"	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}	python312_installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12	python-3.12.10-amd64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}\ = "{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}"	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\Dependents	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}\ = "{9D09C9EF-A57C-422A-B79A-CC922079653A}"	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\Version = "3.12.10150.0"	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}\DisplayName = "Python 3.12.10 Core Interpreter (64-bit)"	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}\ = "{9D09C9EF-A57C-422A-B79A-CC922079653A}"	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\ = "{0158093D-F809-455B-9429-6D16A4B5D118}"	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\Dependents	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\DisplayName = "Python 3.12.10 (64-bit)"	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\Dependents	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}\Dependents	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\Dependents	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}\DisplayName = "Python 3.12.10 Standard Library (64-bit)"	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}\Dependents	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\DisplayName = "Python 3.12.10 (64-bit)"	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\ = "{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}"	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\ = "{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}"	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python-3.12.10-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}\Version = "3.12.10150.0"	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}\Version = "3.12.10150.0"	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.10150.0"	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.10150.0"	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python-3.12.10-amd64.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4344	powershell.exe
4344	powershell.exe
3628	powershell.exe
3628	powershell.exe
4792	powershell.exe
4792	powershell.exe
4184	powershell.exe
4184	powershell.exe
224	powershell.exe
224	powershell.exe
1540	powershell.exe
1540	powershell.exe
3628	powershell.exe
4792	powershell.exe
4184	powershell.exe
224	powershell.exe
1540	powershell.exe
3832	powershell.exe
3832	powershell.exe
1936	powershell.exe
1936	powershell.exe
240	powershell.exe
240	powershell.exe
4352	powershell.exe
4352	powershell.exe
4620	powershell.exe
4620	powershell.exe
232	powershell.exe
232	powershell.exe
2940	powershell.exe
2940	powershell.exe
2672	powershell.exe
2672	powershell.exe
2052	powershell.exe
2052	powershell.exe
3588	powershell.exe
3588	powershell.exe
4844	powershell.exe
4844	powershell.exe
1636	powershell.exe
1636	powershell.exe
1632	powershell.exe
1632	powershell.exe
3588	powershell.exe
1976	powershell.exe
1976	powershell.exe
2940	powershell.exe
4844	powershell.exe
1636	powershell.exe
2052	powershell.exe
1976	powershell.exe
1632	powershell.exe
2672	powershell.exe
4656	powershell.exe
4656	powershell.exe
888	powershell.exe
888	powershell.exe
3484	powershell.exe
3484	powershell.exe
3476	powershell.exe
3476	powershell.exe
4656	powershell.exe
888	powershell.exe
3484	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4912	WMIC.exe
Token: SeSecurityPrivilege	4912	WMIC.exe
Token: SeTakeOwnershipPrivilege	4912	WMIC.exe
Token: SeLoadDriverPrivilege	4912	WMIC.exe
Token: SeSystemProfilePrivilege	4912	WMIC.exe
Token: SeSystemtimePrivilege	4912	WMIC.exe
Token: SeProfSingleProcessPrivilege	4912	WMIC.exe
Token: SeIncBasePriorityPrivilege	4912	WMIC.exe
Token: SeCreatePagefilePrivilege	4912	WMIC.exe
Token: SeBackupPrivilege	4912	WMIC.exe
Token: SeRestorePrivilege	4912	WMIC.exe
Token: SeShutdownPrivilege	4912	WMIC.exe
Token: SeDebugPrivilege	4912	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4912	WMIC.exe
Token: SeRemoteShutdownPrivilege	4912	WMIC.exe
Token: SeUndockPrivilege	4912	WMIC.exe
Token: SeManageVolumePrivilege	4912	WMIC.exe
Token: 33	4912	WMIC.exe
Token: 34	4912	WMIC.exe
Token: 35	4912	WMIC.exe
Token: 36	4912	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4912	WMIC.exe
Token: SeSecurityPrivilege	4912	WMIC.exe
Token: SeTakeOwnershipPrivilege	4912	WMIC.exe
Token: SeLoadDriverPrivilege	4912	WMIC.exe
Token: SeSystemProfilePrivilege	4912	WMIC.exe
Token: SeSystemtimePrivilege	4912	WMIC.exe
Token: SeProfSingleProcessPrivilege	4912	WMIC.exe
Token: SeIncBasePriorityPrivilege	4912	WMIC.exe
Token: SeCreatePagefilePrivilege	4912	WMIC.exe
Token: SeBackupPrivilege	4912	WMIC.exe
Token: SeRestorePrivilege	4912	WMIC.exe
Token: SeShutdownPrivilege	4912	WMIC.exe
Token: SeDebugPrivilege	4912	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4912	WMIC.exe
Token: SeRemoteShutdownPrivilege	4912	WMIC.exe
Token: SeUndockPrivilege	4912	WMIC.exe
Token: SeManageVolumePrivilege	4912	WMIC.exe
Token: 33	4912	WMIC.exe
Token: 34	4912	WMIC.exe
Token: 35	4912	WMIC.exe
Token: 36	4912	WMIC.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeShutdownPrivilege	2012	Vexx.exe
Token: SeCreatePagefilePrivilege	2012	Vexx.exe
Token: SeDebugPrivilege	3628	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	4184	powershell.exe
Token: SeDebugPrivilege	224	powershell.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	2104	taskkill.exe
Token: SeShutdownPrivilege	2012	Vexx.exe
Token: SeCreatePagefilePrivilege	2012	Vexx.exe
Token: SeIncreaseQuotaPrivilege	4792	powershell.exe
Token: SeSecurityPrivilege	4792	powershell.exe
Token: SeTakeOwnershipPrivilege	4792	powershell.exe
Token: SeLoadDriverPrivilege	4792	powershell.exe
Token: SeSystemProfilePrivilege	4792	powershell.exe
Token: SeSystemtimePrivilege	4792	powershell.exe
Token: SeProfSingleProcessPrivilege	4792	powershell.exe
Token: SeIncBasePriorityPrivilege	4792	powershell.exe
Token: SeCreatePagefilePrivilege	4792	powershell.exe
Token: SeBackupPrivilege	4792	powershell.exe
Token: SeRestorePrivilege	4792	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5572	python312_installer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 3928	2012	Vexx.exe	79
PID 3928 wrote to memory of 1648	3928	cmd.exe	81
PID 2012 wrote to memory of 2892	2012	Vexx.exe	82
PID 2892 wrote to memory of 5096	2892	cmd.exe	84
PID 2012 wrote to memory of 3968	2012	Vexx.exe	85
PID 3968 wrote to memory of 4912	3968	cmd.exe	87
PID 2012 wrote to memory of 4720	2012	Vexx.exe	88
PID 4720 wrote to memory of 4344	4720	cmd.exe	90
PID 2012 wrote to memory of 1656	2012	Vexx.exe	91
PID 2012 wrote to memory of 1364	2012	Vexx.exe	92
PID 2012 wrote to memory of 1228	2012	Vexx.exe	94
PID 2012 wrote to memory of 4032	2012	Vexx.exe	95
PID 2012 wrote to memory of 1064	2012	Vexx.exe	96
PID 2012 wrote to memory of 3176	2012	Vexx.exe	97
PID 2012 wrote to memory of 1836	2012	Vexx.exe	174
PID 2012 wrote to memory of 2476	2012	Vexx.exe	101
PID 2012 wrote to memory of 1288	2012	Vexx.exe	102
PID 2012 wrote to memory of 1736	2012	Vexx.exe	103
PID 2012 wrote to memory of 3256	2012	Vexx.exe	104
PID 2012 wrote to memory of 1920	2012	Vexx.exe	106
PID 2012 wrote to memory of 952	2012	Vexx.exe	186
PID 2012 wrote to memory of 3916	2012	Vexx.exe	109
PID 2012 wrote to memory of 2340	2012	Vexx.exe	110
PID 2012 wrote to memory of 3032	2012	Vexx.exe	111
PID 2012 wrote to memory of 3296	2012	Vexx.exe	192
PID 2012 wrote to memory of 1692	2012	Vexx.exe	113
PID 2012 wrote to memory of 1196	2012	Vexx.exe	114
PID 2012 wrote to memory of 2076	2012	Vexx.exe	115
PID 2012 wrote to memory of 712	2012	Vexx.exe	182
PID 2012 wrote to memory of 3484	2012	Vexx.exe	117
PID 2012 wrote to memory of 3080	2012	Vexx.exe	118
PID 2012 wrote to memory of 1812	2012	Vexx.exe	119
PID 2012 wrote to memory of 1864	2012	Vexx.exe	120
PID 2012 wrote to memory of 904	2012	Vexx.exe	121
PID 2012 wrote to memory of 3304	2012	Vexx.exe	122
PID 2012 wrote to memory of 984	2012	Vexx.exe	123
PID 2012 wrote to memory of 3896	2012	Vexx.exe	124
PID 2012 wrote to memory of 5076	2012	Vexx.exe	125
PID 2012 wrote to memory of 3452	2012	Vexx.exe	126
PID 2012 wrote to memory of 4184	2012	Vexx.exe	128
PID 2012 wrote to memory of 3628	2012	Vexx.exe	199
PID 2012 wrote to memory of 1540	2012	Vexx.exe	131
PID 2012 wrote to memory of 4792	2012	Vexx.exe	132
PID 2012 wrote to memory of 224	2012	Vexx.exe	134
PID 2012 wrote to memory of 1704	2012	Vexx.exe	136
PID 2012 wrote to memory of 4920	2012	Vexx.exe	165
PID 2012 wrote to memory of 4920	2012	Vexx.exe	165
PID 2012 wrote to memory of 764	2012	Vexx.exe	166
PID 1704 wrote to memory of 2104	1704	cmd.exe	241
PID 3080 wrote to memory of 4192	3080	cmd.exe	168
PID 2012 wrote to memory of 4752	2012	Vexx.exe	224
PID 1196 wrote to memory of 2052	1196	cmd.exe	171
PID 2076 wrote to memory of 4628	2076	cmd.exe	172
PID 2012 wrote to memory of 1836	2012	Vexx.exe	174
PID 1836 wrote to memory of 4508	1836	cmd.exe	215
PID 2012 wrote to memory of 4732	2012	Vexx.exe	177
PID 4732 wrote to memory of 2192	4732	cmd.exe	218
PID 2012 wrote to memory of 3772	2012	Vexx.exe	180
PID 3772 wrote to memory of 712	3772	cmd.exe	182
PID 2012 wrote to memory of 3784	2012	Vexx.exe	183
PID 3784 wrote to memory of 3744	3784	cmd.exe	185
PID 2012 wrote to memory of 952	2012	Vexx.exe	186
PID 952 wrote to memory of 940	952	cmd.exe	188
PID 2012 wrote to memory of 2652	2012	Vexx.exe	189

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Vexx.exe
"C:\Users\Admin\AppData\Local\Temp\Vexx.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:1648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "openssl version"
  2⤵
  PID:1656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "npm -v"
  2⤵
  PID:1364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pm2.cmd -v"
  2⤵
  PID:1228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "yarn --version"
  2⤵
  PID:4032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gulp.cmd --version"
  2⤵
  PID:1064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "brew --version"
  2⤵
  PID:3176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tsc.cmd --version"
  2⤵
  PID:1836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "grunt.cmd --version"
  2⤵
  PID:2476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "git --version"
  2⤵
  PID:1288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "apachectl -v 2>&1"
  2⤵
  PID:1736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "nginx -v 2>&1"
  2⤵
  PID:3256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mysql -V"
  2⤵
  PID:1920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "php -v"
  2⤵
  PID:952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "redis-server --version"
  2⤵
  PID:3916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "docker --version"
  2⤵
  PID:2340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "postconf -d | grep mail_version"
  2⤵
  PID:3032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mongod --version"
  2⤵
  PID:3296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "perl -v"
  2⤵
  PID:1692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python -V 2>&1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python -V
    3⤵
    PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python3 -V 2>&1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python3 -V
    3⤵
    PID:4628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip -V 2>&1"
  2⤵
  PID:712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip3 -V 2>&1"
  2⤵
  PID:3484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3080
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -version
    3⤵
    PID:4192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc -dumpversion"
  2⤵
  PID:1812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" -v 2>&1"
  2⤵
  PID:1864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bash --version"
  2⤵
  PID:904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "zsh --version"
  2⤵
  PID:3304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "fish --version"
  2⤵
  PID:984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bun -v"
  2⤵
  PID:3896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "deno -v"
  2⤵
  PID:5076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "node -v"
  2⤵
  PID:3452
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Service | select caption | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4184
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command $PSVersionTable
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3628
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gci \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -recurse | gp -name Version,Release -EA 0 | where { $_.PSChildName -match \"^(?!S)\p{L}\"} | select PSChildName, Version, Release"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4792
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- C:\Users\Admin\AppData\Local\Temp\Vexx.exe
  "C:\Users\Admin\AppData\Local\Temp\Vexx.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\vexx" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2556 --field-trial-handle=2560,i,3406128476576458177,15435678939302445998,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:4920
- C:\Users\Admin\AppData\Local\Temp\Vexx.exe
  "C:\Users\Admin\AppData\Local\Temp\Vexx.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\vexx" --mojo-platform-channel-handle=3068 --field-trial-handle=2560,i,3406128476576458177,15435678939302445998,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc --version"
  2⤵
  PID:4752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:2192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:3744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"
  2⤵
  PID:2652
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe
    3⤵
    - Kills process with taskkill
    PID:3820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"
  2⤵
  PID:3296
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe
    3⤵
    - Kills process with taskkill
    PID:4112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"
  2⤵
  PID:2420
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM centbrowser.exe
    3⤵
    - Kills process with taskkill
    PID:1964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"
  2⤵
  PID:2388
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3628
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 7star.exe
    3⤵
    - Kills process with taskkill
    PID:3832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"
  2⤵
  PID:2148
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM sputnik.exe
    3⤵
    - Kills process with taskkill
    PID:3476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
  2⤵
  PID:2452
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
  2⤵
  PID:3148
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM epicprivacybrowser.exe
    3⤵
    - Kills process with taskkill
    PID:3236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"
  2⤵
  PID:776
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe
    3⤵
    - Kills process with taskkill
    PID:1140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
  2⤵
  PID:3480
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:4508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"
  2⤵
  PID:3740
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM iridium.exe
    3⤵
    - Kills process with taskkill
    PID:2192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM tor.exe"
  2⤵
  PID:2740
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM tor.exe
    3⤵
    - Kills process with taskkill
    PID:3644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM waterfox.exe"
  2⤵
  PID:4296
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM waterfox.exe
    3⤵
    - Kills process with taskkill
    PID:4752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM arc.exe"
  2⤵
  PID:2364
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM arc.exe
    3⤵
    - Kills process with taskkill
    PID:4968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
  2⤵
  PID:2100
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
    3⤵
    PID:2612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
  2⤵
  PID:2304
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles state
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled""
  2⤵
  PID:792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn""
  2⤵
  PID:400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA"
  2⤵
  PID:1172
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2104
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA
    3⤵
    PID:5048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1""
  2⤵
  PID:436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:2908
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:3168
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')""
  2⤵
  PID:3340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA="
  2⤵
  PID:4404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled""
  2⤵
  PID:2784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:232
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2672
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_VideoController | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2940
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:2052
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_desktopmonitor | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1636
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3588
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
  2⤵
  PID:5000
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
    3⤵
    - Checks processor information in registry
    PID:4644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version,vendor,installDate /format:list"
  2⤵
  PID:2620
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product get name,version,vendor,installDate /format:list
    3⤵
    PID:700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "openssl version"
  2⤵
  PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "npm -v"
  2⤵
  PID:3720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pm2.cmd -v"
  2⤵
  PID:2392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "yarn --version"
  2⤵
  PID:1204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gulp.cmd --version"
  2⤵
  PID:1540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "brew --version"
  2⤵
  PID:4872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tsc.cmd --version"
  2⤵
  PID:1008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "grunt.cmd --version"
  2⤵
  PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "git --version"
  2⤵
  PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "apachectl -v 2>&1"
  2⤵
  PID:4876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "nginx -v 2>&1"
  2⤵
  PID:3628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mysql -V"
  2⤵
  PID:2104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "php -v"
  2⤵
  PID:684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "redis-server --version"
  2⤵
  PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "docker --version"
  2⤵
  PID:3284
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "postconf -d | grep mail_version"
  2⤵
  PID:2460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mongod --version"
  2⤵
  PID:1424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "perl -v"
  2⤵
  PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python -V 2>&1"
  2⤵
  PID:1996
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python -V
    3⤵
    PID:6092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python3 -V 2>&1"
  2⤵
  PID:1968
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python3 -V
    3⤵
    PID:6000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip -V 2>&1"
  2⤵
  PID:4556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip3 -V 2>&1"
  2⤵
  PID:1480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
  2⤵
  PID:4716
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -version
    3⤵
    PID:5696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc -dumpversion"
  2⤵
  PID:1768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" -v 2>&1"
  2⤵
  PID:1256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bash --version"
  2⤵
  PID:3184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "zsh --version"
  2⤵
  PID:5096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "fish --version"
  2⤵
  PID:332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bun -v"
  2⤵
  PID:4112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "deno -v"
  2⤵
  PID:992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "node -v"
  2⤵
  PID:2676
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Service | select caption | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4656
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command $PSVersionTable
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3484
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gci \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -recurse | gp -name Version,Release -EA 0 | where { $_.PSChildName -match \"^(?!S)\p{L}\"} | select PSChildName, Version, Release"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:888
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
  2⤵
  PID:1064
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
    3⤵
    PID:5648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
  2⤵
  PID:5388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3280
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
  2⤵
  PID:5856
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
    3⤵
    PID:1584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
  2⤵
  PID:5232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5416
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4148
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5928
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5996
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:240
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6032
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc --version"
  2⤵
  PID:4380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version,vendor,installDate /format:list"
  2⤵
  PID:2852
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product get name,version,vendor,installDate /format:list
    3⤵
    PID:5844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
  2⤵
  PID:2992
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "route print"
  2⤵
  PID:5964
- - C:\Windows\system32\ROUTE.EXE
    route print
    3⤵
    PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic service get name,displayName,state,startMode,pathName /format:list"
  2⤵
  PID:5892
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic service get name,displayName,state,startMode,pathName /format:list
    3⤵
    PID:6088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
  2⤵
  PID:5380
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
    3⤵
    - Checks processor information in registry
    PID:5164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  PID:4632
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5620
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3620
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5144
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6084
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5024
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
  2⤵
  PID:5796
- - C:\Windows\system32\findstr.exe
    findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    3⤵
    PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey""
  2⤵
  PID:5160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5632
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2556
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  PID:3060
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5300
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5564
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
  2⤵
  PID:6076
- - C:\Windows\system32\findstr.exe
    findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    3⤵
    PID:4892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "py -3 --version"
  2⤵
  PID:3744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "py --version"
  2⤵
  PID:4792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python --version"
  2⤵
  PID:2088
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python --version
    3⤵
    PID:5548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python3 --version"
  2⤵
  PID:4656
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python3 --version
    3⤵
    PID:5696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" /quiet InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0"
  2⤵
  PID:388
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\python312_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" /quiet InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4872
  - - C:\Windows\Temp\{1C74A9B3-4901-4DE7-B555-A7FF5ED67D1F}\.cr\python312_installer.exe
      "C:\Windows\Temp\{1C74A9B3-4901-4DE7-B555-A7FF5ED67D1F}\.cr\python312_installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" -burn.filehandle.attached=724 -burn.filehandle.self=732 /quiet InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" /quiet InstallAllUsers=1 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0"
  2⤵
  PID:1964
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:684
- - C:\Users\Admin\AppData\Local\Temp\python312_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" /quiet InstallAllUsers=1 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5544
  - - C:\Windows\Temp\{BD044231-AB7E-4D69-9720-0FC95B47243B}\.cr\python312_installer.exe
      "C:\Windows\Temp\{BD044231-AB7E-4D69-9720-0FC95B47243B}\.cr\python312_installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" -burn.filehandle.attached=724 -burn.filehandle.self=732 /quiet InstallAllUsers=1 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2476
    - - C:\Windows\Temp\{C15F9AAF-C23A-4906-B68D-9D6B09863EB5}\.be\python-3.12.10-amd64.exe
        
        "C:\Windows\Temp\{C15F9AAF-C23A-4906-B68D-9D6B09863EB5}\.be\python-3.12.10-amd64.exe" -q -burn.elevated BurnPipe.{4477DC5A-D617-4621-AA42-D06AAD0C42E5} {50DDBF38-895D-4D61-AB78-EE9EF54CA620} 2476
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" /passive InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0"
  2⤵
  PID:772
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2556
- - C:\Users\Admin\AppData\Local\Temp\python312_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" /passive InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5780
  - - C:\Windows\Temp\{822D8994-AFB8-40B7-BBAC-EDA3AA4AA59A}\.cr\python312_installer.exe
      "C:\Windows\Temp\{822D8994-AFB8-40B7-BBAC-EDA3AA4AA59A}\.cr\python312_installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" -burn.filehandle.attached=756 -burn.filehandle.self=760 /passive InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:5572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
  2⤵
  PID:4956
- - C:\Windows\system32\taskkill.exe
    taskkill /IM javaw.exe /F
    3⤵
    - Kills process with taskkill
    PID:5560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"
  2⤵
  PID:5472
- - C:\Windows\system32\taskkill.exe
    taskkill /IM EpicGamesLauncher.exe /F
    3⤵
    - Kills process with taskkill
    PID:5608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
  2⤵
  PID:5912
- - C:\Windows\system32\taskkill.exe
    taskkill /IM Steam.exe /F
    3⤵
    - Kills process with taskkill
    PID:5156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "sc config node DisplayName= "Time Synchronization Service""
  2⤵
  PID:5844
- - C:\Windows\system32\sc.exe
    sc config node DisplayName= "Time Synchronization Service"
    3⤵
    - Launches sc.exe
    PID:3292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i svchost.exe"
  2⤵
  PID:1216
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5456
- - C:\Windows\system32\findstr.exe
    findstr /i svchost.exe
    3⤵
    PID:5636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i winlogon.exe"
  2⤵
  PID:2580
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3896
- - C:\Windows\system32\findstr.exe
    findstr /i winlogon.exe
    3⤵
    PID:5644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i services.exe"
  2⤵
  PID:5376
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4124
- - C:\Windows\system32\findstr.exe
    findstr /i services.exe
    3⤵
    PID:1796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i explorer.exe"
  2⤵
  PID:5344
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:232
- - C:\Windows\system32\findstr.exe
    findstr /i explorer.exe
    3⤵
    PID:3308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i dllhost.exe"
  2⤵
  PID:6088
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2904
- - C:\Windows\system32\findstr.exe
    findstr /i dllhost.exe
    3⤵
    PID:804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i taskhostw.exe"
  2⤵
  PID:5928
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4148
- - C:\Windows\system32\findstr.exe
    findstr /i taskhostw.exe
    3⤵
    PID:1936
- C:\Users\Admin\AppData\Local\Temp\Vexx.exe
  "C:\Users\Admin\AppData\Local\Temp\Vexx.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\vexx" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1668 --field-trial-handle=2560,i,3406128476576458177,15435678939302445998,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:5516

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
PID:4152

C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
"C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2940
- C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
  "C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20260602234540.log" InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6112
- - C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
    "C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20260602234540.log" InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1824

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4644

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:6080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58f51c.rbs

Path C:\Config.Msi\e58f51c.rbs
Size 8KB
SHA256 6d9734bbb3909040733851df9919c554302e9adbf43fe008d931a610ad5f5315
MD5 dc5fce3b6c4e66619b197d18c63dfd1c
SHA1 2a9a31d33ecaf6198ac6bee31843123f04c48c13
SHA512 f42b3d37b503f76576362357962c0d7f45eafaa93ede4c1cc196b7bab1062dbcde45530b20235fafbff83d934e77d667da1298d7dba4b27de14c9aa522e43309
SSDEEP 96:lmgJiMiifiA+rteCUWf4UgRHbXBHAZECsTlmkUgRHbXBHAZEC6jwlGIaTlmPIOrr:oAK8CFXABgZrImABgZr+eyIp3
TLSH
T1B7027281F2A8C9C5E5953B74C317172437B6E3D9EA40730B088F82345E72A9D7F698A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f521.rbs

Path C:\Config.Msi\e58f521.rbs
Size 12KB
SHA256 60ca0ef595676a6a3d32bc0e17d4f4fd39094feaaa765dc30636aa6772871b31
MD5 e4c0ebe63b70fcf10c980b5709fa08f6
SHA1 0ea6fc41ea6cba78042e0d3bafc00fa77ad46d59
SHA512 cc732b6e459f57257ee608fbf960a71cfc2b2ea6c6e8a669d9cd1be6e2363f31ab773ace88243c51c3909fc5b06d29fd8dff7d2a204bd1239017035f8694adb0
SSDEEP 192:onvUUcIA4DrQvfaPowHV3bXYgT+CXCcX43ZrIl43ZrZsFlDIpn:onvUUc14DrQvfaPowZjYm+04p44pqFlU
TLSH
T12842414272B0D1C6D45A2675873717243BFBC2D99B00B24B0A5EC1B8DF43ACF9A994CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f529.rbs

Path C:\Config.Msi\e58f529.rbs
Size 14KB
SHA256 616103f7724ec3fc5a46ebd807659e7e3d3ae5678a6d3ea6f99542ac5982bbfd
MD5 888c8f59ca8ee91369a17e5202f0fac2
SHA1 c0e0509088ca9b34028d3599ed091104b9c3ef3f
SHA512 cd39d4c077999a27b2c42da91f92669f83943e909d15cf1b2043531ab9e5c08ebd98dcdade158e5d03568a31528eb5b0c9e819d1ad7555c021cf94e8fdb4dafe
SSDEEP 192:2zYRRVbkRkVbaowIOe7A7daFq16LbbMgzpudZ:2cRRVARkV0II7kFvvMG4dZ
TLSH
T1C662320372B0D1D6C4596635873307787FF7D2989B05A287023ED1BCDF62BCBA99948A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f52b.rbf

Path C:\Config.Msi\e58f52b.rbf
Size 102KB
SHA256 4d6f5f81a4bca11191c4c7c6b43632694d0a4ce74e068619d8fdc161d469859a
MD5 0cfdf7db1b81d067d3dad75f6abb312b
SHA1 f0ef24bbb793b93c33274fadd7cba49fbda8a56e
SHA512 a6bc090e3b3f52a9588adee2f60f2ee19cc0181a031335d107fe5f240cbd853933c0e939f80e861f21148892106fd7929c80edcad651f58458f82df79811d838
SSDEEP 1536:7j1vKbuEYE+9z2wp+FavGmhMn+IhzZtzg/fZRIytH/9jfI38VMDxl:7BvKbuAs0FNmhMn+IhNC/fZRwIk
TLSH
T167A3F48A6A1E8191D5709471437B87F26B2C2F62A9C3C68DA7C17F06E97D2C1F609733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f52c.rbf

Path C:\Config.Msi\e58f52c.rbf
Size 101KB
SHA256 d72294fb338bc2fc8896d25a7395a4db466425427e1559e77185d5135a830681
MD5 72afbe203882951dc77a5cf6dcc07ffe
SHA1 e42f23434e8323d695cb249e686692794dba385e
SHA512 426dc0e1ab31b895f7b5ef04ee4be52f562c03e856bda4569cd7052fe0aa3f15404f240f73bf8d2bb5e87240aa6671fdf8601d8b52e3b21a858a7f2e21b089dd
SSDEEP 1536:Csef7hIxHHWMpdPa5wiE21M8kJIGFvb1Cwv/T5sCytH/9wfIW44zqrhO:CsOSwMpdCq/IM8uIGf1/T5sLW4IKh
TLSH
T1F5A30841E62DBDCDE508D4314A75D4F26D24ED727680A51EB7F37F0628312A3FA0A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f52d.rbf

Path C:\Config.Msi\e58f52d.rbf
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f52e.rbf

Path C:\Config.Msi\e58f52e.rbf
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f52f.rbf

Path C:\Config.Msi\e58f52f.rbf
Size 36KB
SHA256 e502c6b880ff58d614901495a9009c136539cd0b1e2a2abb8fc00b934c203419
MD5 b52c821c7750804295e23b9e94525085
SHA1 ee762ae623c98f53c89a0d8f4143c6c61ab807d8
SHA512 b5d680ce02ed9677ed905fa3257925bae1e80ece565d161b50a94a479b409d10b7f1b8340675b257900c856d8c3e37abacbf818287b56c5a72b97b1e5bbeaed5
SSDEEP 768:ofTr69CItDmXPkVDXz/kSsixKioLU68RfKoMlPLZ1FDYzGBAcTQgug3qfF:oX69CItQPkVDzDsioLU6EfKoILZ1FYwE
TLSH
T1D8F2D66EBF0903734AE1C2517E96A8C9F31DA13E375B1954306CD10C2B3B929A3BF569
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f530.rbf

Path C:\Config.Msi\e58f530.rbf
Size 1.7MB
SHA256 64ed57507cec59380f87c4b0ee57f202e2f54c2fc0b3fb41446a031df3ec17e4
MD5 b0fd318347035c1088e4da385aced068
SHA1 6e637c8eb30c76b8f4c8a518e1e8369f4fe396db
SHA512 7f8834ea4500e1450aac5f90e65c8dc39e9da9586ad0b23a879343c1e65e1e8c41b63c4449a47cdead8aef514c2be6cafce153fe4e9cc7bf2ab34c33580efa2a
SSDEEP 49152:hh/TF6hKWgW/zeOREp42erd+1lwVDwi/GBy4:oDg
TLSH
T16685FA5AA54F93B20673414DE1AEF39AE326C178231D15427CACE1DE2205AEC937F79C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f531.rbf

Path C:\Config.Msi\e58f531.rbf
Size 74KB
SHA256 150c470f9943b806b44312efdec85755f22f8d7d52b31f93a9af3c43e8627381
MD5 b35f68a3086562c4d5453faad5a3474e
SHA1 673904ff9b305a6600e47ad715289122ec0b046a
SHA512 6ec80921942b3bd3c85ef24a2de5454a34a3ad11a1bc69b601aea7b873e318073c0b2d78c26685999f78ec64a86282c08c53ab8d77e41c661ae968ea52c08176
SSDEEP 1536:+sNNRmOha6UEm3BL61Z4tXSZ6HTk1FaA87Gl6L:+2No6UtB+1eJ9Z
TLSH
T1CA73C3A33B9EBEDEE8A089B16B76C1D72D54FC554646200FB0B1BB1670752A3381DD32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f532.rbf

Path C:\Config.Msi\e58f532.rbf
Size 76KB
SHA256 fda28a734788a3f175cb6aed4daeb5f05f0e49f6a272ccd2051ba337f7b3b42f
MD5 b1c9980131a3f20e344aa3aa2c8dea49
SHA1 0fe02f0ed5e56bbe7e4e98b1dca061ed17fbf5c7
SHA512 84ca107ace44fa1964c6c1ea93fc767bde88363339fc426a3d660da53c84bade14f1fae99c494483bf2b5312938d84b0c1733c85e82592b8ffe8a28f76186a3a
SSDEEP 768:WNXYu6xYBxqjlETx2UjHe20dH397tiKZoZa1ABtc8Yg2zR51ZV2vL2inK/fR1:sayx2lETxN+HTo8+bil1ZqdKX
TLSH
T11A73C4473AAE92A9E9F05130577783F31B2C2DAA51A0E10AB5917B45B63C1E3790DF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f533.rbf

Path C:\Config.Msi\e58f533.rbf
Size 81KB
SHA256 c4ec1845a5724b2a83500f3bd940355e2fe26efc6b4fe6c208365359a6130da1
MD5 1a8230030d821cf8ea57ce03aaead737
SHA1 12656788b1fbe4d2375ecc2989a4d9da69caa0d6
SHA512 af6356dc67249e724ae30f65ddefb4e53c6f2703da32fd5f135598bbd6189bee70950242f52985478de99979d1271eec9f4e2981a29a9bc02c673e9b668fd0c1
SSDEEP 1536:fVLhV30CuzZO5Wf/DGsea4SNum23KXVDTEhr:f1hV3Uz447lea4muXG1TEhr
TLSH
T1B58326433B4EBEE4E89423B1647AC5971E64ED6910C2259FF0C5BB0736B95A3380CE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f536.rbs

Path C:\Config.Msi\e58f536.rbs
Size 8KB
SHA256 1e258eb1cdcba805199a762f1e9ec363b3abf785a611146e96cb4307f3463eff
MD5 a3cb5d7468a43246eab3dc20cfe986c8
SHA1 3bc41c4a2cede9b7fdb734c2918b7c3391d96536
SHA512 7f53578d8c77c5daf6db80aa9aa60d2be66882305dde128c951b92c216b9bc4e70f617f06af1044eaea32f9b7bc3bb5ad2d638afb495b9ae0a9e614eccee30c1
SSDEEP 96:XmgJiMms9SGt8RTRp2XhsbxmPt8RTRr2XhsbCjnZLlGbG0nmP0LyRHcRCxRRJboA:23BRKmbtRMmbSow6Xg
TLSH
T1A6027542F2B8C6C9E9957B34C313132037E3E2D9EB45534B105F82245E31A5DBFA98A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f537.rbf

Path C:\Config.Msi\e58f537.rbf
Size 68KB
SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
MD5 962428e9e68d43ecc16f3e33f2ea8667
SHA1 6d0f349ab2e795b138a64346b784fc7fcdb6d87f
SHA512 a925586bbc4cc9d2f58f5b6eeed82e429c23dd57d7b33609c0067fc14ed66ed165ac8121eeec1db3f993412f28ba527e961e3d6bcc201d4cda2037f85931ffc5
SSDEEP 768:BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/s:BDmF61JFn+/OulIWL0vytH/9ifITgj
TLSH
T125637042BB54F893DBFA66FC7AD199CE642B12CC572984ECA47593D30D1A310A2E334D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f538.rbf

Path C:\Config.Msi\e58f538.rbf
Size 6.6MB
SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
MD5 de50496cece613ec7ebedbf9f2aefecd
SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
TLSH
T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f53c.rbs

Path C:\Config.Msi\e58f53c.rbs
Size 8KB
SHA256 bab06ff5e2ff49dba0f08bc398df167298c5228b7266df6ba119a263b4c7c3dc
MD5 99db5ebd6fccf869a8d235bd24828524
SHA1 583ce0eccc96d2a19d704a2fef6331d491f837c9
SHA512 4a8d7600b072cdc72c73017e7e1eee439105053d66c04f7eb45a1aaf74ff24ef5ca5896bbad0465e93b070d5fe19c5666f6e55c6cfaf453170e64e4f60d5de62
SSDEEP 96:imgJiMiifiA+rteCI0kSJf4UgRHbXBHAZECsTlmkUgRHbXBHAZEC6jwlGIaTlmPB:DAK8CI0BBXABgZrImABgZr+eyIp3
TLSH
T107027281F2A8C9C5E5953B74C317172437B6E3D9EA40730B088F82345E72A9D7F698A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f541.rbs

Path C:\Config.Msi\e58f541.rbs
Size 12KB
SHA256 4bfad4c61015ebd53f05566f46efc5c084816c14925fef3c91be66f516bee4ba
MD5 ea85716e5f0acc60f906c83c8442d71b
SHA1 5f0ca16f159a5c9cdf4307436dc4acf52db8646a
SHA512 60f5e8ffaed8244e9f7f5c0ad963c20b588fc50a45d8457c3a15d169001ad8d69ff0b3d3a106ffac5a570803bb23cdb9deaaed5d82bc259588d718cd56515574
SSDEEP 192:DnvUUcIA4DrQvfaPowHV3bXYgT+CXCmX43ZrIl43ZrZsFlDIpn:DnvUUc14DrQvfaPowZjYm+24p44pqFlU
TLSH
T12A42414272B0D1C6D45A2675873717243BFBC2D99B00B24B0A5EC1B8DF43ACF9A994DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f548.rbs

Path C:\Config.Msi\e58f548.rbs
Size 14KB
SHA256 b6697349b73c82257b18ad3a703dc49e3ffb12e53d397ffa6dc265fc668b795b
MD5 a98e1b68c9e5bc104f99fade11e1bdec
SHA1 94b931dde0be21218ed641ae1b01d759f2a3d8f8
SHA512 0e00c3318171b3b6ba318ad1513b3004cd48522bea060b5b5710c65bfbe340289ed32aac7a017e0b9e6de240f389aac404589f7356e11b2987ef5ea3b4298216
SSDEEP 192:6ziRDVbkRkVbaowIOe7A7daFq16LbbMgzp2pZ:6ORDVARkV0II7kFvvMG8pZ
TLSH
T11A62424372B0D1D6C4496235873307787FF7C1989B05A28B063ED1BCDF62BCBA99909A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f555.rbs

Path C:\Config.Msi\e58f555.rbs
Size 8KB
SHA256 bb6f639d07627b8104070b00890c8fad8d19586dafbf54f37cce98e79cef0b68
MD5 6675957b95b89d2c59da2283c853e2d7
SHA1 f76aa67bf99bce7d337ba9de82712dc631419e68
SHA512 00deb95ea358b30e38f83cfee4c1240b22da96fbe41b42018f26ba48e4d9362cb9d46c4111f746aa0435c780016d78b64017c9526266b6152aa98bba826a8e66
SSDEEP 96:jmgJiMms9XcGt8RTRj72XhsbxmPt8RTRr2XhsbCjnZLlGbG0nmP0LyRHcRCxRRJj:63cWRp+mbtRMmbSowuXg
TLSH
T1A1027642F2B8C6C9E9957B34C313132037E3E2D9EB45534B105F82245E31A5CBFA98A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 dc83599dbc95c086d8a5cb83f33077913f3df5b5b85821f22109edfe7cfe9b0f
MD5 6d43d5a9b2d571a6ab061e96082848dd
SHA1 e7879968ed84ddf92fc6d8a2f746f9225510d092
SHA512 f1ba33431272cddd06cc31542aee6bbcc600e160e8fde3f039692f4a1256671b60af443f75722316182b845c31f7097f723d97f93105c690bee2ae4987c3c59c
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download