34f2252399a696b4625c4fd7a0394ae27dd1186c2cbfc572cd71afb9e7769683

Analysis

max time kernel
299s
max time network
184s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/07/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Lumora.exe
Size 168.6MB
Sample260729-pmxzfathpg
SHA256 34f2252399a696b4625c4fd7a0394ae27dd1186c2cbfc572cd71afb9e7769683
MD5 676aff6c7d4ebff1d76c1923503cae0a
SHA1 6d626b79223e9a295d971c1d035778d326e8f886
SHA512 5dd9de006f1b9d87c0837a698f02b2d6e277a1a841bf7f4a12337030c79b95743500b7f6c084a129947318bd66ba8119189c7fafd77d553e134f6dc7a780bf91
SSDEEP 1572864:kOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF96:WgmeNxNNZxqV
TLSH
T156887B13F29651D8F09DD1B18B578236EA72B8460738A6DF2754172A2F77FE02B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3324	powershell.exe
2992	powershell.exe
4988	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3912	javaw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	checkip.amazonaws.com
3	checkip.amazonaws.com

Enumerates processes with tasklist 1 TTPs 8 IoCs

discovery

Process Discovery

T1057

pid	Process
4364	tasklist.exe
1452	tasklist.exe
2840	tasklist.exe
3984	tasklist.exe
2388	tasklist.exe
4864	tasklist.exe
1716	tasklist.exe
804	tasklist.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3884	sc.exe

Executes a command shell one-liner 1 TTPs 33 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3220	cmd.exe
3020	cmd.exe
4800	cmd.exe
2636	cmd.exe
3472	cmd.exe
2600	cmd.exe
3468	cmd.exe
4784	cmd.exe
3716	cmd.exe
544	cmd.exe
2876	cmd.exe
2524	cmd.exe
3648	cmd.exe
4136	cmd.exe
2860	cmd.exe
4428	cmd.exe
1104	cmd.exe
672	cmd.exe
2864	cmd.exe
1948	cmd.exe
1572	cmd.exe
1188	cmd.exe
4140	cmd.exe
848	cmd.exe
1704	cmd.exe
1896	cmd.exe
3620	cmd.exe
3540	cmd.exe
4940	cmd.exe
2428	cmd.exe
3012	cmd.exe
4000	cmd.exe
5092	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1536	timeout.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4120	WMIC.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3116	ipconfig.exe
4948	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1800	systeminfo.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
1768	taskkill.exe
1228	taskkill.exe
2888	taskkill.exe
2196	taskkill.exe
3736	taskkill.exe
2732	taskkill.exe
2080	taskkill.exe
1704	taskkill.exe
3420	taskkill.exe
3140	taskkill.exe
1964	taskkill.exe
5112	taskkill.exe
932	taskkill.exe
4400	taskkill.exe
2672	taskkill.exe
2260	taskkill.exe
2516	taskkill.exe
2120	taskkill.exe
660	taskkill.exe
2264	taskkill.exe
4264	taskkill.exe
232	taskkill.exe
1944	taskkill.exe
2196	taskkill.exe
4452	taskkill.exe
1320	taskkill.exe
4596	taskkill.exe
404	taskkill.exe
492	taskkill.exe
3216	taskkill.exe
4628	taskkill.exe
1976	taskkill.exe
3676	taskkill.exe
2520	taskkill.exe
2348	taskkill.exe
1952	taskkill.exe
412	taskkill.exe
3268	taskkill.exe
1592	taskkill.exe
3644	taskkill.exe
756	taskkill.exe
3800	taskkill.exe
2332	taskkill.exe
4176	taskkill.exe
4964	taskkill.exe
4940	taskkill.exe
1428	taskkill.exe
4028	taskkill.exe
3384	taskkill.exe
2724	taskkill.exe
1292	taskkill.exe
3620	taskkill.exe
2396	taskkill.exe
4404	taskkill.exe
2588	taskkill.exe
2368	taskkill.exe
2780	taskkill.exe
3252	taskkill.exe
2736	taskkill.exe
1292	taskkill.exe
1180	taskkill.exe
236	taskkill.exe
3712	taskkill.exe
4432	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3324	powershell.exe
3324	powershell.exe
2992	powershell.exe
2992	powershell.exe
4988	powershell.exe
4988	powershell.exe
4988	powershell.exe
4988	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4120	WMIC.exe
Token: SeSecurityPrivilege	4120	WMIC.exe
Token: SeTakeOwnershipPrivilege	4120	WMIC.exe
Token: SeLoadDriverPrivilege	4120	WMIC.exe
Token: SeSystemProfilePrivilege	4120	WMIC.exe
Token: SeSystemtimePrivilege	4120	WMIC.exe
Token: SeProfSingleProcessPrivilege	4120	WMIC.exe
Token: SeIncBasePriorityPrivilege	4120	WMIC.exe
Token: SeCreatePagefilePrivilege	4120	WMIC.exe
Token: SeBackupPrivilege	4120	WMIC.exe
Token: SeRestorePrivilege	4120	WMIC.exe
Token: SeShutdownPrivilege	4120	WMIC.exe
Token: SeDebugPrivilege	4120	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4120	WMIC.exe
Token: SeRemoteShutdownPrivilege	4120	WMIC.exe
Token: SeUndockPrivilege	4120	WMIC.exe
Token: SeManageVolumePrivilege	4120	WMIC.exe
Token: 33	4120	WMIC.exe
Token: 34	4120	WMIC.exe
Token: 35	4120	WMIC.exe
Token: 36	4120	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4120	WMIC.exe
Token: SeSecurityPrivilege	4120	WMIC.exe
Token: SeTakeOwnershipPrivilege	4120	WMIC.exe
Token: SeLoadDriverPrivilege	4120	WMIC.exe
Token: SeSystemProfilePrivilege	4120	WMIC.exe
Token: SeSystemtimePrivilege	4120	WMIC.exe
Token: SeProfSingleProcessPrivilege	4120	WMIC.exe
Token: SeIncBasePriorityPrivilege	4120	WMIC.exe
Token: SeCreatePagefilePrivilege	4120	WMIC.exe
Token: SeBackupPrivilege	4120	WMIC.exe
Token: SeRestorePrivilege	4120	WMIC.exe
Token: SeShutdownPrivilege	4120	WMIC.exe
Token: SeDebugPrivilege	4120	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4120	WMIC.exe
Token: SeRemoteShutdownPrivilege	4120	WMIC.exe
Token: SeUndockPrivilege	4120	WMIC.exe
Token: SeManageVolumePrivilege	4120	WMIC.exe
Token: 33	4120	WMIC.exe
Token: 34	4120	WMIC.exe
Token: 35	4120	WMIC.exe
Token: 36	4120	WMIC.exe
Token: SeShutdownPrivilege	2296	Lumora.exe
Token: SeCreatePagefilePrivilege	2296	Lumora.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeShutdownPrivilege	2296	Lumora.exe
Token: SeCreatePagefilePrivilege	2296	Lumora.exe
Token: SeShutdownPrivilege	2296	Lumora.exe
Token: SeCreatePagefilePrivilege	2296	Lumora.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeImpersonatePrivilege	2992	powershell.exe
Token: SeBackupPrivilege	2992	powershell.exe
Token: SeRestorePrivilege	2992	powershell.exe
Token: SeTakeOwnershipPrivilege	2992	powershell.exe
Token: SeSecurityPrivilege	2992	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2992	powershell.exe
Token: SeTcbPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	4176	taskkill.exe
Token: SeDebugPrivilege	2264	taskkill.exe
Token: SeDebugPrivilege	3788	taskkill.exe
Token: SeDebugPrivilege	492	taskkill.exe
Token: SeDebugPrivilege	1952	taskkill.exe
Token: SeDebugPrivilege	4264	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 3312	2296	Lumora.exe	80
PID 2296 wrote to memory of 1784	2296	Lumora.exe	81
PID 2296 wrote to memory of 1572	2296	Lumora.exe	82
PID 1572 wrote to memory of 4120	1572	cmd.exe	84
PID 2296 wrote to memory of 1104	2296	Lumora.exe	86
PID 1104 wrote to memory of 3324	1104	cmd.exe	88
PID 3324 wrote to memory of 3912	3324	powershell.exe	89
PID 3912 wrote to memory of 1188	3912	javaw.exe	90
PID 1188 wrote to memory of 2056	1188	cmd.exe	92
PID 2056 wrote to memory of 2516	2056	net.exe	93
PID 3912 wrote to memory of 3220	3912	javaw.exe	94
PID 3220 wrote to memory of 3156	3220	cmd.exe	96
PID 3912 wrote to memory of 2992	3912	javaw.exe	97
PID 2992 wrote to memory of 1780	2992	powershell.exe	99
PID 1780 wrote to memory of 2044	1780	csc.exe	100
PID 3912 wrote to memory of 5092	3912	javaw.exe	101
PID 5092 wrote to memory of 1800	5092	cmd.exe	103
PID 3912 wrote to memory of 672	3912	javaw.exe	105
PID 672 wrote to memory of 3164	672	cmd.exe	107
PID 3912 wrote to memory of 3716	3912	javaw.exe	108
PID 3912 wrote to memory of 4140	3912	javaw.exe	109
PID 4140 wrote to memory of 2264	4140	cmd.exe	112
PID 3716 wrote to memory of 4176	3716	cmd.exe	113
PID 3716 wrote to memory of 3788	3716	cmd.exe	114
PID 4140 wrote to memory of 492	4140	cmd.exe	115
PID 4140 wrote to memory of 4264	4140	cmd.exe	116
PID 3716 wrote to memory of 1952	3716	cmd.exe	117
PID 4140 wrote to memory of 412	4140	cmd.exe	118
PID 3716 wrote to memory of 932	3716	cmd.exe	119
PID 3716 wrote to memory of 3620	3716	cmd.exe	120
PID 4140 wrote to memory of 2396	4140	cmd.exe	121
PID 4140 wrote to memory of 4404	4140	cmd.exe	166
PID 3716 wrote to memory of 4400	3716	cmd.exe	123
PID 3912 wrote to memory of 2864	3912	javaw.exe	124
PID 2864 wrote to memory of 4964	2864	cmd.exe	126
PID 2864 wrote to memory of 3216	2864	cmd.exe	127
PID 3912 wrote to memory of 544	3912	javaw.exe	128
PID 544 wrote to memory of 3168	544	cmd.exe	173
PID 2864 wrote to memory of 1808	2864	cmd.exe	131
PID 544 wrote to memory of 3736	544	cmd.exe	132
PID 2864 wrote to memory of 2732	2864	cmd.exe	133
PID 544 wrote to memory of 4740	544	cmd.exe	134
PID 2864 wrote to memory of 4572	2864	cmd.exe	135
PID 544 wrote to memory of 4940	544	cmd.exe	178
PID 2864 wrote to memory of 4780	2864	cmd.exe	137
PID 544 wrote to memory of 3268	544	cmd.exe	138
PID 544 wrote to memory of 1156	544	cmd.exe	139
PID 3912 wrote to memory of 2600	3912	javaw.exe	140
PID 2600 wrote to memory of 3336	2600	cmd.exe	142
PID 2600 wrote to memory of 2672	2600	cmd.exe	143
PID 2600 wrote to memory of 2080	2600	cmd.exe	144
PID 3912 wrote to memory of 2876	3912	javaw.exe	145
PID 2876 wrote to memory of 1592	2876	cmd.exe	193
PID 2600 wrote to memory of 2340	2600	cmd.exe	148
PID 2876 wrote to memory of 4452	2876	cmd.exe	149
PID 2600 wrote to memory of 232	2600	cmd.exe	150
PID 2876 wrote to memory of 3644	2876	cmd.exe	151
PID 2600 wrote to memory of 1704	2600	cmd.exe	198
PID 2876 wrote to memory of 4628	2876	cmd.exe	199
PID 2876 wrote to memory of 1428	2876	cmd.exe	154
PID 2876 wrote to memory of 1964	2876	cmd.exe	259
PID 3912 wrote to memory of 3020	3912	javaw.exe	156
PID 3020 wrote to memory of 2068	3020	cmd.exe	158
PID 3020 wrote to memory of 2780	3020	cmd.exe	159

C:\Users\Admin\AppData\Local\Temp\Lumora.exe
"C:\Users\Admin\AppData\Local\Temp\Lumora.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\Lumora.exe
  "C:\Users\Admin\AppData\Local\Temp\Lumora.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\lumora-platform" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1676 --field-trial-handle=1680,i,4602656789795459287,8601703125815487558,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  PID:3312
- C:\Users\Admin\AppData\Local\Temp\Lumora.exe
  "C:\Users\Admin\AppData\Local\Temp\Lumora.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\lumora-platform" --mojo-platform-channel-handle=2136 --field-trial-handle=1680,i,4602656789795459287,8601703125815487558,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
  2⤵
  PID:1784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:4120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Start-Process -FilePath 'C:\Users\Admin\Documents\javaw.exe' -WorkingDirectory 'C:\Users\Admin\Documents' -ArgumentList '667865972e5c83381b9140c43f6e753b' -Verb RunAs -WindowStyle Hidden""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Start-Process -FilePath 'C:\Users\Admin\Documents\javaw.exe' -WorkingDirectory 'C:\Users\Admin\Documents' -ArgumentList '667865972e5c83381b9140c43f6e753b' -Verb RunAs -WindowStyle Hidden"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\Users\Admin\Documents\javaw.exe
      "C:\Users\Admin\Documents\javaw.exe" 667865972e5c83381b9140c43f6e753b
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3912
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "net session >nul 2>&1 && echo Y || echo N"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1188
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:2516
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C chcp
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3220
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:3156
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -ep Bypass -NoProfile -NoLogo -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\mkqx1vbc.ps1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2992
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u2larhlz\u2larhlz.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9BDD.tmp" "c:\Users\Admin\AppData\Local\Temp\u2larhlz\CSC9C8A50C5464F45188C1AD7EDB5F5D724.TMP"
        7⤵
        
        PID:2044
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C systeminfo
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5092
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:1800
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "fsutil volume diskfree C:"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:672
      - C:\Windows\system32\fsutil.exe
        
        fsutil volume diskfree C:
        6⤵
        
        PID:3164
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "taskkill /F /IM chrome.exe /T >nul 2>&1 & taskkill /F /IM brave.exe /T >nul 2>&1 & taskkill /F /IM msedge.exe /T >nul 2>&1 & taskkill /F /IM vivaldi.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3716
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4176
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3788
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe /T
        6⤵
        Kills process with taskkill
        
        PID:932
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        Kills process with taskkill
        
        PID:3620
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        Kills process with taskkill
        
        PID:4400
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "taskkill /F /IM chrome.exe /T >nul 2>&1 & taskkill /F /IM brave.exe /T >nul 2>&1 & taskkill /F /IM msedge.exe /T >nul 2>&1 & taskkill /F /IM vivaldi.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4140
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:492
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4264
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe /T
        6⤵
        Kills process with taskkill
        
        PID:412
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2396
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        Kills process with taskkill
        
        PID:4404
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "taskkill /F /IM chrome.exe /T >nul 2>&1 & taskkill /F /IM brave.exe /T >nul 2>&1 & taskkill /F /IM msedge.exe /T >nul 2>&1 & taskkill /F /IM vivaldi.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2864
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        Kills process with taskkill
        
        PID:4964
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        Kills process with taskkill
        
        PID:3216
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        
        PID:1808
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2732
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        
        PID:4572
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        
        PID:4780
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "taskkill /F /IM chrome.exe /T >nul 2>&1 & taskkill /F /IM brave.exe /T >nul 2>&1 & taskkill /F /IM msedge.exe /T >nul 2>&1 & taskkill /F /IM vivaldi.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:544
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        
        PID:3168
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        Kills process with taskkill
        
        PID:3736
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        
        PID:4740
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe /T
        6⤵
        Kills process with taskkill
        
        PID:4940
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        Kills process with taskkill
        
        PID:3268
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        
        PID:1156
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "taskkill /F /IM chrome.exe /T >nul 2>&1 & taskkill /F /IM brave.exe /T >nul 2>&1 & taskkill /F /IM msedge.exe /T >nul 2>&1 & taskkill /F /IM vivaldi.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2600
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        
        PID:3336
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2672
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2080
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe /T
        6⤵
        
        PID:2340
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        Kills process with taskkill
        
        PID:232
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        Kills process with taskkill
        
        PID:1704
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "taskkill /F /IM chrome.exe /T >nul 2>&1 & taskkill /F /IM brave.exe /T >nul 2>&1 & taskkill /F /IM msedge.exe /T >nul 2>&1 & taskkill /F /IM vivaldi.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2876
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        Kills process with taskkill
        
        PID:1592
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        Kills process with taskkill
        
        PID:4452
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        Kills process with taskkill
        
        PID:3644
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe /T
        6⤵
        Kills process with taskkill
        
        PID:4628
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        Kills process with taskkill
        
        PID:1428
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        
        PID:1964
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "taskkill /F /IM chrome.exe /T >nul 2>&1 & taskkill /F /IM brave.exe /T >nul 2>&1 & taskkill /F /IM msedge.exe /T >nul 2>&1 & taskkill /F /IM vivaldi.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3020
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        
        PID:2068
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2780
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        Kills process with taskkill
        
        PID:3420
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe /T
        6⤵
        Kills process with taskkill
        
        PID:1976
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        
        PID:3472
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        Kills process with taskkill
        
        PID:3252
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -ep Bypass -NoProfile -NoLogo -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\h0z31gbb.ps1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4988
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xoh1ska4\xoh1ska4.cmdline"
        6⤵
        
        PID:4404
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB4E4.tmp" "c:\Users\Admin\AppData\Local\Temp\xoh1ska4\CSC2D74F21668E94064954EB14E3A8F3C.TMP"
        7⤵
        
        PID:2604
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "taskkill /F /IM chrome.exe /T >nul 2>&1 & taskkill /F /IM brave.exe /T >nul 2>&1 & taskkill /F /IM msedge.exe /T >nul 2>&1 & taskkill /F /IM vivaldi.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        
        PID:2860
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        Kills process with taskkill
        
        PID:1944
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2260
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        
        PID:1720
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe /T
        6⤵
        Kills process with taskkill
        
        PID:1320
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        Kills process with taskkill
        
        PID:4596
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2348
    - - C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /T /IM chrome.exe
        5⤵
        Kills process with taskkill
        
        PID:1768
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3168
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "tasklist /FI \"IMAGENAME eq chrome.exe\" 2>nul | findstr /I \"chrome.exe\""
        5⤵
        Executes a command shell one-liner
        
        PID:4940
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI \"IMAGENAME eq chrome.exe\"
        6⤵
        Enumerates processes with tasklist
        
        PID:1452
      - C:\Windows\system32\findstr.exe
        
        findstr /I \"chrome.exe\"
        6⤵
        
        PID:3204
    - - C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /T /IM chrome.exe
        5⤵
        Kills process with taskkill
        
        PID:1228
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "taskkill /F /IM chrome.exe /T >nul 2>&1 & taskkill /F /IM brave.exe /T >nul 2>&1 & taskkill /F /IM msedge.exe /T >nul 2>&1 & taskkill /F /IM vivaldi.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        
        PID:2524
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        
        PID:1004
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        
        PID:2752
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        Kills process with taskkill
        
        PID:3676
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe /T
        6⤵
        
        PID:1592
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        
        PID:924
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2588
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "tasklist /FI \"IMAGENAME eq chrome.exe\" 2>nul | findstr /I \"chrome.exe\""
        5⤵
        Executes a command shell one-liner
        
        PID:848
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI \"IMAGENAME eq chrome.exe\"
        6⤵
        Enumerates processes with tasklist
        
        PID:2840
      - C:\Windows\system32\findstr.exe
        
        findstr /I \"chrome.exe\"
        6⤵
        
        PID:2208
    - - C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /T /IM chrome.exe
        5⤵
        Kills process with taskkill
        
        PID:3140
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "tasklist /FI \"IMAGENAME eq chrome.exe\" 2>nul | findstr /I \"chrome.exe\""
        5⤵
        Executes a command shell one-liner
        
        PID:1704
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4628
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI \"IMAGENAME eq chrome.exe\"
        6⤵
        Enumerates processes with tasklist
        
        PID:3984
      - C:\Windows\system32\findstr.exe
        
        findstr /I \"chrome.exe\"
        6⤵
        
        PID:4276
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "taskkill /F /IM chrome.exe /T >nul 2>&1 & taskkill /F /IM brave.exe /T >nul 2>&1 & taskkill /F /IM msedge.exe /T >nul 2>&1 & taskkill /F /IM vivaldi.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        
        PID:4800
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        Kills process with taskkill
        
        PID:1964
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2736
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2196
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe /T
        6⤵
        
        PID:2492
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        
        PID:2480
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        
        PID:1504
    - - C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /T /IM msedge.exe
        5⤵
        
        PID:3712
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "tasklist /FI \"IMAGENAME eq msedge.exe\" 2>nul | findstr /I \"msedge.exe\""
        5⤵
        Executes a command shell one-liner
        
        PID:4428
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI \"IMAGENAME eq msedge.exe\"
        6⤵
        Enumerates processes with tasklist
        
        PID:2388
      - C:\Windows\system32\findstr.exe
        
        findstr /I \"msedge.exe\"
        6⤵
        
        PID:3472
    - - C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /T /IM msedge.exe
        5⤵
        Kills process with taskkill
        
        PID:1292
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "taskkill /F /IM chrome.exe /T >nul 2>&1 & taskkill /F /IM brave.exe /T >nul 2>&1 & taskkill /F /IM msedge.exe /T >nul 2>&1 & taskkill /F /IM vivaldi.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        
        PID:3648
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        Kills process with taskkill
        
        PID:756
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        Kills process with taskkill
        
        PID:4028
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        Kills process with taskkill
        
        PID:404
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2516
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        
        PID:1864
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        Kills process with taskkill
        
        PID:3800
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "tasklist /FI \"IMAGENAME eq msedge.exe\" 2>nul | findstr /I \"msedge.exe\""
        5⤵
        Executes a command shell one-liner
        
        PID:2428
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI \"IMAGENAME eq msedge.exe\"
        6⤵
        Enumerates processes with tasklist
        
        PID:4864
      - C:\Windows\system32\findstr.exe
        
        findstr /I \"msedge.exe\"
        6⤵
        
        PID:1916
    - - C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /T /IM msedge.exe
        5⤵
        Kills process with taskkill
        
        PID:3384
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "tasklist /FI \"IMAGENAME eq msedge.exe\" 2>nul | findstr /I \"msedge.exe\""
        5⤵
        Executes a command shell one-liner
        
        PID:2636
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI \"IMAGENAME eq msedge.exe\"
        6⤵
        Enumerates processes with tasklist
        
        PID:1716
      - C:\Windows\system32\findstr.exe
        
        findstr /I \"msedge.exe\"
        6⤵
        
        PID:3540
    - - C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /T /IM firefox.exe
        5⤵
        
        PID:4908
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "taskkill /F /IM chrome.exe /T >nul 2>&1 & taskkill /F /IM brave.exe /T >nul 2>&1 & taskkill /F /IM msedge.exe /T >nul 2>&1 & taskkill /F /IM vivaldi.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        
        PID:1948
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1228
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2724
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        Kills process with taskkill
        
        PID:1180
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2368
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2888
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        Kills process with taskkill
        
        PID:236
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2332
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "tasklist /FI \"IMAGENAME eq firefox.exe\" 2>nul | findstr /I \"firefox.exe\""
        5⤵
        Executes a command shell one-liner
        
        PID:3012
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI \"IMAGENAME eq firefox.exe\"
        6⤵
        Enumerates processes with tasklist
        
        PID:804
      - C:\Windows\system32\findstr.exe
        
        findstr /I \"firefox.exe\"
        6⤵
        
        PID:1972
    - - C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /T /IM librewolf.exe
        5⤵
        
        PID:684
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "taskkill /F /IM chrome.exe /T >nul 2>&1 & taskkill /F /IM brave.exe /T >nul 2>&1 & taskkill /F /IM msedge.exe /T >nul 2>&1 & taskkill /F /IM vivaldi.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        
        PID:1896
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2520
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        
        PID:2184
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        Kills process with taskkill
        
        PID:3712
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2120
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2196
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        
        PID:3356
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "tasklist /FI \"IMAGENAME eq librewolf.exe\" 2>nul | findstr /I \"librewolf.exe\""
        5⤵
        Executes a command shell one-liner
        
        PID:4000
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI \"IMAGENAME eq librewolf.exe\"
        6⤵
        Enumerates processes with tasklist
        
        PID:4364
      - C:\Windows\system32\findstr.exe
        
        findstr /I \"librewolf.exe\"
        6⤵
        
        PID:1964
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "taskkill /F /IM chrome.exe /T >nul 2>&1 & taskkill /F /IM brave.exe /T >nul 2>&1 & taskkill /F /IM msedge.exe /T >nul 2>&1 & taskkill /F /IM vivaldi.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1 & taskkill /F /IM opera.exe /T >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        
        PID:3472
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        
        PID:4416
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        
        PID:1380
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        Kills process with taskkill
        
        PID:1292
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe /T
        6⤵
        Kills process with taskkill
        
        PID:660
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        Kills process with taskkill
        
        PID:5112
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        Kills process with taskkill
        
        PID:4432
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "ipconfig /all"
        5⤵
        Executes a command shell one-liner
        
        PID:3620
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        6⤵
        Gathers network information
        
        PID:3116
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "ipconfig /displaydns"
        5⤵
        Executes a command shell one-liner
        
        PID:4136
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /displaydns
        6⤵
        Gathers network information
        
        PID:4948
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "sc query type= service state= all"
        5⤵
        Executes a command shell one-liner
        
        PID:3468
      - C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        6⤵
        Launches sc.exe
        
        PID:3884
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /c "cmd /c timeout /t 3 /nobreak >nul & del /f /q \"C:\Users\Admin\Documents\javaw.exe\""
        5⤵
        Executes a command shell one-liner
        
        PID:4784
      - C:\Windows\system32\cmd.exe
        
        cmd /c timeout /t 3 /nobreak
        6⤵
        Executes a command shell one-liner
        
        PID:3540
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:1536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 19c9ec5a50546824bb6a3bdc81b9c4dd5aea4505f0fea626abc4acfb34abd512
MD5 93c475260b5f74a3ffa3208be0cdcfd7
SHA1 16752f7e789511af6acdfb99a469aa92f6773ef9
SHA512 1252533957bca1f698900dfe03bbd5dd2431c8330c77757c376aa9939e6e383cdc7cc7492fafbae5317e70da80680a03eba7cbe6929002916c011098117b1468
TLSH
T1D2115333B79CC235C8E915BA1088AD11B1B1C3C7049EDE8F7A84C119E67F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e1299c5457a20a3a0ddcee37c29fc652d4641f16291d33774267472759d2cbaf
MD5 ed6efad63134eaa4db3bf6e1a3287352
SHA1 43ff3e5127636e3c7491e9bbbbe8c49cce4ce96c
SHA512 95a42826918eadb94fcc28ff8610bcdb037c5eafdc095d9d14266fd64e2707e066a7f5539a863b50495ea6b0e78201d813f8fc1cf41788898cec406e76c1fdc8
TLSH
T196117A33B79CC135C8D9117A1089AD01B2B4C3C7049EDE8B7A84C509E57F58ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

RES9BDD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9BDD.tmp
Size 1KB
SHA256 61395cd0656ea2687995c597e00076af1d56a4e1f1547ec1dbe203deb9cb5df1
MD5 8a2c38bc8063fcb9082f634f2356e632
SHA1 5f2b7ecf01a2092b9af764828d98715223e7b143
SHA512 985a20c7889ae26db8a6f8397a14118f721b7465d81a33bab7bc2c6f160b54ba31edfde9eb113e85fef6e5eecd905a91df9829610b2d5326bf07175cb7179881
TLSH
T1AE218C0883FD471AF0B75B317EF6071F9264FD95EF62935F854052282C51104EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RESB4E4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB4E4.tmp
Size 1KB
SHA256 bec414c0af749a3d5f8ff3c8a4504cf04f2dfc37d5629ee24999b0dcd1c8dfef
MD5 a66bd176377dca1801979e7b6e54d90c
SHA1 4c8a403e87ffe13ac58213238c4c15cf2434560d
SHA512 74e785c78530205b3420610627d979bde17f88a4e31f6dc541c0e8b69bea231e77272a91e812052e0e49d38ee07b6e1e041b053a29632eba4da1c5025b90493c
TLSH
T12F21AA0583EA470AF07B4B326AFA476BA268FD54AFA1531A854002281C41544EEE1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_r2sl01l3.jc3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r2sl01l3.jc3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\d7j0wzi4.d\chrome\default\cookies.txt
Size 251B
SHA256 3fcd45a7a5c52d832d7ccd9e6db5c0ea648a91273d65410048f54df0ef91c77a
MD5 20004ed4a764ed46710684354449dd0d
SHA1 a409d755505a60fa510f3bb0c9b5b6f65c06e9fb
SHA512 0d5a96d10bb75724ea4180c9c8b8f0f3372d66c519c6718f65a5577b46f161387a2a258fc68a5bdb9ea918f414d201d4073363553b527ed24566bf8283962037
TLSH
T1A5D02B56D1B9D3075E00CA128A22045916512A72D006DD65B08E8D072880D55B610DC3
MD5 SHA1 SHA512 TLSH

Submit Download

h0z31gbb.ps1

Path C:\Users\Admin\AppData\Local\Temp\h0z31gbb.ps1
Size 6KB
SHA256 61b94dd71d886ebf3ad3f4406257dd3f8459f0e03cec2ebd2f06a077dbe91108
MD5 0bc6ae08f09446a08e5b398836031740
SHA1 446fcd63361db167970d4e3190f7d0be3bbb4024
SHA512 70f7408dd514340e713661fb251c73bc4a0203dabeb99754e804d0e1fda39c13ed2a7a4f65b779018e59db151cf37a93885e23a631ce9887c517089c6b29e267
SSDEEP 192:kZSsE/G1HLukTMhF1EyNHSuFuiWbUiyjnKiS4XCCZuyBLf4mS:hCykT0E1ojQ6fZugLfE
TLSH
T18DE1B5117322A6F602A3251D85F8C45EFF23803712FE5E20BA5D97E2AF45135927A70E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkqx1vbc.ps1

Path C:\Users\Admin\AppData\Local\Temp\mkqx1vbc.ps1
Size 1KB
SHA256 d2f00d1d9bfea633a8dda82e9931b51007a7ab4747f57c6c404515e2992e9814
MD5 5dcd5a8c9091a10b0316b0f6a9e98423
SHA1 80693c59e5fed3856c3b5c47ea6c12f93ed0afd3
SHA512 644eb3bc781f476243eb9edd29aae27530f2d5bd649748e195aa28d6420eda720433b13eb98fecd0385e723a47f3a2f3f958e6a8f62880fc4b761a995a02d8e7
TLSH
T1A631358963BA51B14463A55DD9DDF58BBD13003A15FFEE11F16D53A24F821268031626
MD5 SHA1 SHA512 TLSH

Submit Download

u2larhlz.dll

Path C:\Users\Admin\AppData\Local\Temp\u2larhlz\u2larhlz.dll
Size 4KB
SHA256 cd82ba917c9d890a48407675183d939be7e841237bc3fcf76238388b8760b4bf
MD5 b9ec9418fe899179303992b1549b8897
SHA1 3f95ac332207ffccf7b30a3ff7cf3c776c234b88
SHA512 73e61359ec4dad1392ee3a908477d63a8b0ba0d242f6a7dcaca7495e48fa996013c28b71c0922700a47104fd1136ffb19076a77c06552911230daf5fac8c7c7f
TLSH
T177812E07D7E84627E4B70778AEF3071262B4F8109F73972F59D053657C916645E22BB0
MD5 SHA1 SHA512 TLSH

Submit Download

xoh1ska4.dll

Path C:\Users\Admin\AppData\Local\Temp\xoh1ska4\xoh1ska4.dll
Size 5KB
SHA256 8542e26a879c68bb386c10118ed36087da1467d66058fd3240de4dcf64d83525
MD5 463bdc789e7d8d5c2f35c3c631fae8be
SHA1 4d444e4a36737b5aae8388e396c7dc03252b1b41
SHA512 d76ab19ed66ba81f70d7357c83294134de077f0a43919cdb7077dd450c4fee84e035c5579fa5238b672284d1c492b2db98281abdfdce8273d04b9b1fe65bbb2c
SSDEEP 48:6x7q2tD4ZmEoW+ueelDsdDlFv1EjDTEwPou3fgTaX+jFJgUE5E6823wLwCXByz1y:uqCZIEDlR6vIKLxLeRmybK
TLSH
T19BC1721767F80162F0BB4739DEB70712A7B0F8904B23832F119540292C7AAE48B617B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\Documents\javaw.exe
Size 33.0MB
SHA256 028267ba30a4db23ddf3b63f6b1c2a8b4d99d9947eb82928b5a03414a5c9be3a
MD5 333707588a67f9c4af0946d850d5094b
SHA1 2a752918d73a716cc4c8bec36c79bc2e5aa269a7
SHA512 31b60cfec3a889454e479d46cb1cb390c67060d8109f466882193159eb9be67e71c599830433664028c413e6c4f736ec72eeddb2b66850679edba5ff8df700d2
SSDEEP 786432:xaaMqNEFZiXXuqISIIa7qqxZaQ4QQZQZ3:jAUnYSIIaFxZaDy
TLSH
T10E772243F7A541E9C06EC074861A5233E771B88946307BEB6BD89A313F62F602F6D758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC9C8A50C5464F45188C1AD7EDB5F5D724.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\u2larhlz\CSC9C8A50C5464F45188C1AD7EDB5F5D724.TMP
Size 652B
SHA256 62ff76d1b9b7f3226bf3638f8f9c2d2d44b05e06bd9c188ce0902c720a8fc8a1
MD5 9ae6ffa33b428fda058106b594272bf8
SHA1 7c7b71bfdef2ac95e7027b929e436a16bbc57818
SHA512 5a5d26f24b52e1f5d41984bccefeb3dcd0440eb24164e8aa00a0476eca282979da670443732afe3196b3a4a5664cba7956be8367da8d03ea48f193fee6c1c86d
TLSH
T179F05E09A3F8420EF0F35B70BEF6476395A9BC65DE3293ED5580032928645149962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

u2larhlz.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\u2larhlz\u2larhlz.0.cs
Size 1KB
SHA256 a79d2d5c213d855c9a989a8b7c897221d7b44187eaa2673703d6087c21664fbb
MD5 a01b93b58e8747c6014f1faa570fc3e4
SHA1 d966ea1bea744d95b662589403e57d8a41701388
SHA512 37405d278faee562a13b62c70ec0f1c6ec7a55d66ccaab16c7ef400158178a1f6b5c14583e9fef3b1b69576035ee934347dfadcacd7e1d0d3484662a119f7943
TLSH
T18F21140863E792704493B85DCAC5F5CBBD23013625FFBD20B17C93B28F46126843172A
MD5 SHA1 SHA512 TLSH

Submit Download

u2larhlz.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\u2larhlz\u2larhlz.cmdline
Size 369B
SHA256 035e16eda60cd3eec758d13e5014bbe5690db69cdd8052452d15c643b654caaf
MD5 f5dad51188ad650f8760b3a32a9640b2
SHA1 361bce4ca71a24e454d472831b4337dab310e417
SHA512 ccffd20ba94b19567fc6106820342f0299c1bb4ad5669e56602c46b762e0e3a733de5f40dbce1d24dd7542fb564a9737fbe7ffa9b0217131ff4e3acf9017d7d5
TLSH
T15DE0682A8ECEC27E0DDD110B2569CCACC2B7064B2D813F8CD048440DF057400A7D1741
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2D74F21668E94064954EB14E3A8F3C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xoh1ska4\CSC2D74F21668E94064954EB14E3A8F3C.TMP
Size 652B
SHA256 e712718af5ba970c5b0625bcbf7db59f35fa2a5c871e9c7f2012789ab7754cd6
MD5 e9464acc7a41599790a2f0d94fb7f2ee
SHA1 564dd04077268d1f9324e69685392059e6ff0444
SHA512 ad820f26f6174679a184a6fc71cd76a2309b077ff36f915e70b98b3f33ae29ceff1464ae9af85d2d824b918bc70cabdc322f06c28bb760ba04c722f5e96c5c57
TLSH
T1A2F05E0A63F8024EF4F74B30BEF683A391A8FC64DE3293ED145007192864514CAB2FB6
MD5 SHA1 SHA512 TLSH

Submit Download

xoh1ska4.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xoh1ska4\xoh1ska4.0.cs
Size 3KB
SHA256 fef616539d744b2571db07f236d23fec963bd8ebb1f0c892da4763aae35e75a7
MD5 1c4ab291bb3f2ec64a079c53a2c67323
SHA1 3deb6af9713c6fcd67b76ef3fbf86b55ae6dd28e
SHA512 daa00cb1f858b083c479aaefdb15e8c1c77bdc64e1723ff1e5ab74a350afe9e79a8bb32a7fa6e96c2023781136f484a58a25d0b8b8b0bc6cc3a2292b9ee6961a
TLSH
T1DA812200A312B6F201A7791CD9E9D89FFA23403216FEEE21BD1C47729F46132953A71E
MD5 SHA1 SHA512 TLSH

Submit Download

xoh1ska4.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xoh1ska4\xoh1ska4.cmdline
Size 369B
SHA256 07517634a3818c869ce030997f43bb2439a3004882425d3939ded523306b957b
MD5 82e13221c5f4f11267a07e3c95707593
SHA1 1b22702466afd9dd302b41b60d8914812e91183b
SHA512 cc21334b6535f5494e2a6f2fe613a9faa9a54204b933b64d72128ad93b5065338003f0b4e179b6455be297b77b576479d300b6fbdba965a64ecea6031c7ca224
TLSH
T1BAE0262A6296C6BE16EE104B226BC5BCC3B34B8729817F8491918C6DE1274086BD2B95
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2992-37-0x0000024F1E540000-0x0000024F1E548000-memory.dmp

Download

memory/3324-8-0x000001A0D3A70000-0x000001A0D3A92000-memory.dmp

Download

memory/4988-48-0x000001E26CD70000-0x000001E26CDC0000-memory.dmp

Download

memory/4988-61-0x000001E26A8C0000-0x000001E26A8C8000-memory.dmp

Download

memory/4988-62-0x000001E26CF90000-0x000001E26D152000-memory.dmp

Download

memory/4988-63-0x000001E26D690000-0x000001E26DBB8000-memory.dmp

Download