hxxps://playorionblue[.]com

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
76	ipapi.co
83	ipapi.co

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 7 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

persistence privilege_escalation

Process Discovery

T1057

pid	Process
7184	tasklist.exe
7256	tasklist.exe
1728	tasklist.exe
7220	tasklist.exe
216	tasklist.exe
7196	tasklist.exe
7188	tasklist.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59a170.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFBE8C813E4BD2D79.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{75485683-EF03-41E6-BF21-D1491694548C}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CD0A1663-DC2D-41BD-89AF-E1089E841822}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI19D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE5C4BF3C4523A697.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3500A0BC891B85F4.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4A285122-D2B5-4C35-A279-CE9BD2CA15A0}	msiexec.exe
File created	C:\Windows\Installer\e59a17c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB9CC5AF692CB6B02.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF03AFC864A0C3D69D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6D9A508F5153F1F9.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA5BC.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{665A0435-D5D5-4A49-9DE0-FBC23C5425ED}	msiexec.exe
File created	C:\Windows\Installer\e59a182.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF88E87EC993C9D9CC.TMP	msiexec.exe
File created	C:\Windows\Installer\e59a16f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC107.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7AE5181119A521A0.TMP	msiexec.exe
File created	C:\Windows\Installer\e59a4ae.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACA3.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF581DC5E23AA8EA91.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9D09C9EF-A57C-422A-B79A-CC922079653A}	msiexec.exe
File created	C:\Windows\Installer\e59a16a.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA2E040CBBD64EE41.TMP	msiexec.exe
File created	C:\Windows\Installer\e59a174.msi	msiexec.exe
File created	C:\Windows\Installer\e59a178.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59a4aa.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF864A468D9FACC0FE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC63ED6FFF540410D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59a178.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF709B8CA73FF11A10.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCAC285D2E3F968BF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C96.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0158093D-F809-455B-9429-6D16A4B5D118}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF548C737F38A4E3E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF7EB89496C33DD83.TMP	msiexec.exe
File created	C:\Windows\Installer\e59a181.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB0521C69FE051831.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0380055E33A51FB1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD9A3E679C0FD2D20.TMP	msiexec.exe
File created	C:\Windows\Installer\e59a16b.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC04BF61C62B2F0D5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59a170.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC91C8D3852C39709.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59a166.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9C985B7EF4992062.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF58D04181DBD52434.TMP	msiexec.exe
File created	C:\Windows\Installer\e59a17d.msi	msiexec.exe
File created	C:\Windows\Installer\e59a186.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7FF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59a17d.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF263891992BEA35D2.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFF7FA783309C0D41.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF029930E68E22C7E3.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6E4.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF69E9482552882A1B.TMP	msiexec.exe
File created	C:\Windows\Installer\e59a166.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBF21A4C00CE31FFB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBD2.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3732	powershell.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6848	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1608	cmd.exe
6464	cmd.exe
6564	cmd.exe
7204	cmd.exe
4944	cmd.exe
3516	cmd.exe
7964	cmd.exe
4588	cmd.exe
2084	cmd.exe
1696	cmd.exe
2860	cmd.exe
5952	cmd.exe
6736	cmd.exe
1536	cmd.exe
216	cmd.exe
2208	cmd.exe
6388	cmd.exe
4788	cmd.exe
3424	cmd.exe
1612	cmd.exe
1012	cmd.exe
6492	cmd.exe
3128	cmd.exe
2628	cmd.exe
5236	cmd.exe
1020	cmd.exe
8144	cmd.exe
332	cmd.exe
6572	cmd.exe
7884	cmd.exe
5152	cmd.exe
396	cmd.exe
1332	cmd.exe
6440	cmd.exe
8000	cmd.exe
5052	cmd.exe
6956	cmd.exe
544	cmd.exe
2012	cmd.exe
4708	cmd.exe
1080	cmd.exe
5660	cmd.exe
5156	cmd.exe
4216	cmd.exe
8116	cmd.exe
6500	cmd.exe
4180	cmd.exe
5768	cmd.exe
2248	cmd.exe
852	cmd.exe
1648	cmd.exe
4812	cmd.exe
5068	cmd.exe
6636	cmd.exe
4232	cmd.exe
4932	cmd.exe
5688	cmd.exe
6592	cmd.exe
6576	cmd.exe
4316	cmd.exe
3012	cmd.exe
5076	cmd.exe
4612	cmd.exe
5416	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.10-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python312_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.10-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OrionBlue Setup 2.1.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python312_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.10-amd64.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

T1016.002

pid	Process
5056	cmd.exe
1388	netsh.exe
6736	cmd.exe
6960	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
1836	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	OrionBlue.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	OrionBlue.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	OrionBlue.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	OrionBlue.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	OrionBlue.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OrionBlue.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	OrionBlue.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	OrionBlue.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	OrionBlue.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
5792	ipconfig.exe

Kills process with taskkill 21 IoCs

defense_evasion

pid	Process
1388	taskkill.exe
4228	taskkill.exe
4852	taskkill.exe
7072	taskkill.exe
6228	taskkill.exe
6516	taskkill.exe
652	taskkill.exe
5216	taskkill.exe
2532	taskkill.exe
2744	taskkill.exe
2432	taskkill.exe
4900	taskkill.exe
4952	taskkill.exe
6696	taskkill.exe
3956	taskkill.exe
5040	taskkill.exe
6140	taskkill.exe
5596	taskkill.exe
1260	taskkill.exe
6900	taskkill.exe
7016	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322580630740569"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{665A0435-D5D5-4A49-9DE0-FBC23C5425ED}\Version = "3.12.10150.0"	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{4A285122-D2B5-4C35-A279-CE9BD2CA15A0}\Version = "3.12.10150.0"	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_CLASSES\INSTALLER\DEPENDENCIES\{0158093D-F809-455B-9429-6D16A4B5D118}\DEPENDENTS\{B6CE88EB-2CE3-4D91-8EFC-425AE1F48CAF}	python-3.12.10-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\ = "{0158093D-F809-455B-9429-6D16A4B5D118}"	python-3.12.10-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\Version = "3.12.10150.0"	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConFile	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.CompiledFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.Extension\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConArchiveFile\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConArchiveFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{75485683-EF03-41E6-BF21-D1491694548C}\Dependents	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.CompiledFile\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConArchiveFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{4A285122-D2B5-4C35-A279-CE9BD2CA15A0}	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{75485683-EF03-41E6-BF21-D1491694548C}\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.File\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.Extension\DefaultIcon	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{7A0F07B8-9B9E-44DC-91F8-0691507E7540}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}\Version = "3.12.10150.0"	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.File\Shell\editwithidle\MUIVerb = "&Edit with IDLE"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.CompiledFile\ = "Compiled Python File"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConArchiveFile\shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.File\Shell\open	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.File\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.File\shellex	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConFile\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\pyw.exe\" \"%L\" %*"	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_CLASSES\INSTALLER\DEPENDENCIES\{9D09C9EF-A57C-422A-B79A-CC922079653A}\DEPENDENTS\{B6CE88EB-2CE3-4D91-8EFC-425AE1F48CAF}	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}\DisplayName = "Python 3.12.10 Standard Library (64-bit)"	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}	python-3.12.10-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\MUIVerb = "Edit with IDLE 3.12 (64-bit)"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.ArchiveFile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\" \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\.pyz\ = "Python.ArchiveFile"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConArchiveFile\shellex	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{75485683-EF03-41E6-BF21-D1491694548C}\Dependents	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConFile\ = "Python File (no console)"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConArchiveFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",5"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}\Version = "3.12.10150.0"	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\CPython-3.12	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.CompiledFile\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConArchiveFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConArchiveFile\DefaultIcon	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_CLASSES\INSTALLER\DEPENDENCIES\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}\DEPENDENTS\{B6CE88EB-2CE3-4D91-8EFC-425AE1F48CAF}	python-3.12.10-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.File\Shell\editwithidle\Subcommands	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.File\ = "Python File"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.CompiledFile	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{665A0435-D5D5-4A49-9DE0-FBC23C5425ED}\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{4A285122-D2B5-4C35-A279-CE9BD2CA15A0}\DisplayName = "Python 3.12.10 Add to Path (64-bit)"	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\Dependents	python-3.12.10-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{75485683-EF03-41E6-BF21-D1491694548C}\Version = "3.12.10150.0"	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}\ = "{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}"	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.File\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.CompiledFile\shell\open	msiexec.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\OrionBlue_Beta_2.1.1.zip:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Local\orionblue-updater\installer.exe\:Zone.Identifier:$DATA	OrionBlue Setup 2.1.1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1112	OrionBlue Setup 2.1.1.exe
1112	OrionBlue Setup 2.1.1.exe
216	tasklist.exe
216	tasklist.exe
4528	powershell.exe
4528	powershell.exe
4528	powershell.exe
4108	powershell.exe
4108	powershell.exe
4568	powershell.exe
4568	powershell.exe
3136	powershell.exe
3136	powershell.exe
1628	powershell.exe
1628	powershell.exe
2588	powershell.exe
2588	powershell.exe
4108	powershell.exe
4568	powershell.exe
3136	powershell.exe
1628	powershell.exe
2588	powershell.exe
5948	powershell.exe
5948	powershell.exe
5948	powershell.exe
1592	powershell.exe
1592	powershell.exe
4528	powershell.exe
4528	powershell.exe
5580	powershell.exe
5580	powershell.exe
5228	powershell.exe
5228	powershell.exe
3048	powershell.exe
3048	powershell.exe
2448	powershell.exe
2448	powershell.exe
1972	powershell.exe
1972	powershell.exe
4620	powershell.exe
4620	powershell.exe
2836	powershell.exe
2836	powershell.exe
432	powershell.exe
432	powershell.exe
3284	powershell.exe
3284	powershell.exe
3732	powershell.exe
3732	powershell.exe
3424	powershell.exe
3424	powershell.exe
1972	powershell.exe
2836	powershell.exe
3284	powershell.exe
2448	powershell.exe
4620	powershell.exe
3732	powershell.exe
3424	powershell.exe
432	powershell.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4488	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	216	tasklist.exe
Token: SeSecurityPrivilege	1112	OrionBlue Setup 2.1.1.exe
Token: SeIncreaseQuotaPrivilege	2576	WMIC.exe
Token: SeSecurityPrivilege	2576	WMIC.exe
Token: SeTakeOwnershipPrivilege	2576	WMIC.exe
Token: SeLoadDriverPrivilege	2576	WMIC.exe
Token: SeSystemProfilePrivilege	2576	WMIC.exe
Token: SeSystemtimePrivilege	2576	WMIC.exe
Token: SeProfSingleProcessPrivilege	2576	WMIC.exe
Token: SeIncBasePriorityPrivilege	2576	WMIC.exe
Token: SeCreatePagefilePrivilege	2576	WMIC.exe
Token: SeBackupPrivilege	2576	WMIC.exe
Token: SeRestorePrivilege	2576	WMIC.exe
Token: SeShutdownPrivilege	2576	WMIC.exe
Token: SeDebugPrivilege	2576	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2576	WMIC.exe
Token: SeRemoteShutdownPrivilege	2576	WMIC.exe
Token: SeUndockPrivilege	2576	WMIC.exe
Token: SeManageVolumePrivilege	2576	WMIC.exe
Token: 33	2576	WMIC.exe
Token: 34	2576	WMIC.exe
Token: 35	2576	WMIC.exe
Token: 36	2576	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2576	WMIC.exe
Token: SeSecurityPrivilege	2576	WMIC.exe
Token: SeTakeOwnershipPrivilege	2576	WMIC.exe
Token: SeLoadDriverPrivilege	2576	WMIC.exe
Token: SeSystemProfilePrivilege	2576	WMIC.exe
Token: SeSystemtimePrivilege	2576	WMIC.exe
Token: SeProfSingleProcessPrivilege	2576	WMIC.exe
Token: SeIncBasePriorityPrivilege	2576	WMIC.exe
Token: SeCreatePagefilePrivilege	2576	WMIC.exe
Token: SeBackupPrivilege	2576	WMIC.exe
Token: SeRestorePrivilege	2576	WMIC.exe
Token: SeShutdownPrivilege	2576	WMIC.exe
Token: SeDebugPrivilege	2576	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2576	WMIC.exe
Token: SeRemoteShutdownPrivilege	2576	WMIC.exe
Token: SeUndockPrivilege	2576	WMIC.exe
Token: SeManageVolumePrivilege	2576	WMIC.exe
Token: 33	2576	WMIC.exe
Token: 34	2576	WMIC.exe
Token: 35	2576	WMIC.exe
Token: 36	2576	WMIC.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeDebugPrivilege	4108	powershell.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeDebugPrivilege	6228	taskkill.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeShutdownPrivilege	328	OrionBlue.exe
Token: SeCreatePagefilePrivilege	328	OrionBlue.exe
Token: SeIncreaseQuotaPrivilege	4108	powershell.exe
Token: SeSecurityPrivilege	4108	powershell.exe
Token: SeTakeOwnershipPrivilege	4108	powershell.exe
Token: SeLoadDriverPrivilege	4108	powershell.exe
Token: SeSystemProfilePrivilege	4108	powershell.exe
Token: SeSystemtimePrivilege	4108	powershell.exe
Token: SeProfSingleProcessPrivilege	4108	powershell.exe
Token: SeIncBasePriorityPrivilege	4108	powershell.exe
Token: SeCreatePagefilePrivilege	4108	powershell.exe
Token: SeBackupPrivilege	4108	powershell.exe
Token: SeRestorePrivilege	4108	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe
4488	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1368	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 5028	5012	msedge.exe	80
PID 5012 wrote to memory of 1836	5012	msedge.exe	81
PID 5012 wrote to memory of 2068	5012	msedge.exe	82
PID 5012 wrote to memory of 2068	5012	msedge.exe	82
PID 5012 wrote to memory of 2068	5012	msedge.exe	82
PID 5012 wrote to memory of 2104	5012	msedge.exe	83
PID 5012 wrote to memory of 2104	5012	msedge.exe	83
PID 5012 wrote to memory of 2292	5012	msedge.exe	85
PID 5012 wrote to memory of 2292	5012	msedge.exe	85
PID 5012 wrote to memory of 2292	5012	msedge.exe	85
PID 5012 wrote to memory of 968	5012	msedge.exe	86
PID 5012 wrote to memory of 968	5012	msedge.exe	86
PID 5012 wrote to memory of 968	5012	msedge.exe	86
PID 5012 wrote to memory of 4020	5012	msedge.exe	88
PID 5012 wrote to memory of 5652	5012	msedge.exe	89
PID 5012 wrote to memory of 4020	5012	msedge.exe	88
PID 5012 wrote to memory of 5652	5012	msedge.exe	89
PID 5012 wrote to memory of 5700	5012	msedge.exe	90
PID 5700 wrote to memory of 4228	5700	msedge.exe	91
PID 5012 wrote to memory of 4064	5012	msedge.exe	93
PID 5012 wrote to memory of 1260	5012	msedge.exe	96
PID 5012 wrote to memory of 1260	5012	msedge.exe	96
PID 5012 wrote to memory of 1260	5012	msedge.exe	96
PID 5012 wrote to memory of 5408	5012	msedge.exe	97
PID 5012 wrote to memory of 4624	5012	msedge.exe	98
PID 5012 wrote to memory of 5408	5012	msedge.exe	97
PID 5012 wrote to memory of 4624	5012	msedge.exe	98
PID 5012 wrote to memory of 4624	5012	msedge.exe	98
PID 5012 wrote to memory of 2620	5012	msedge.exe	99
PID 5012 wrote to memory of 5384	5012	msedge.exe	102
PID 5012 wrote to memory of 5716	5012	msedge.exe	103
PID 5012 wrote to memory of 1008	5012	msedge.exe	104
PID 1112 wrote to memory of 4048	1112	OrionBlue Setup 2.1.1.exe	107
PID 4048 wrote to memory of 216	4048	cmd.exe	109
PID 4048 wrote to memory of 3720	4048	cmd.exe	110
PID 328 wrote to memory of 5528	328	OrionBlue.exe	113
PID 5528 wrote to memory of 4232	5528	cmd.exe	115
PID 328 wrote to memory of 5056	328	OrionBlue.exe	116
PID 5056 wrote to memory of 1388	5056	cmd.exe	215
PID 328 wrote to memory of 2248	328	OrionBlue.exe	119
PID 2248 wrote to memory of 2576	2248	cmd.exe	121
PID 328 wrote to memory of 5416	328	OrionBlue.exe	122
PID 5416 wrote to memory of 4528	5416	cmd.exe	278
PID 328 wrote to memory of 1532	328	OrionBlue.exe	125
PID 328 wrote to memory of 1444	328	OrionBlue.exe	126
PID 328 wrote to memory of 5688	328	OrionBlue.exe	211
PID 328 wrote to memory of 1888	328	OrionBlue.exe	129
PID 328 wrote to memory of 5952	328	OrionBlue.exe	131
PID 328 wrote to memory of 3824	328	OrionBlue.exe	132
PID 328 wrote to memory of 1080	328	OrionBlue.exe	134
PID 328 wrote to memory of 1872	328	OrionBlue.exe	135
PID 328 wrote to memory of 5776	328	OrionBlue.exe	137
PID 328 wrote to memory of 2200	328	OrionBlue.exe	138
PID 328 wrote to memory of 4852	328	OrionBlue.exe	230
PID 328 wrote to memory of 4444	328	OrionBlue.exe	140
PID 328 wrote to memory of 4812	328	OrionBlue.exe	141
PID 328 wrote to memory of 4188	328	OrionBlue.exe	142
PID 328 wrote to memory of 5040	328	OrionBlue.exe	221
PID 328 wrote to memory of 4964	328	OrionBlue.exe	145
PID 328 wrote to memory of 5972	328	OrionBlue.exe	306
PID 328 wrote to memory of 1660	328	OrionBlue.exe	148
PID 328 wrote to memory of 1612	328	OrionBlue.exe	149
PID 328 wrote to memory of 5756	328	OrionBlue.exe	151
PID 328 wrote to memory of 4480	328	OrionBlue.exe	152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://playorionblue.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffb566cc188,0x7ffb566cc194,0x7ffb566cc1a0
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,5236148690650761521,18117642093965886511,524288 --field-trial-handle=1940,i,4895571957245334932,17222925209803169866,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,5880484787069538755,16223109437467235701,262144 --field-trial-handle=1940,i,4895571957245334932,17222925209803169866,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,16705813325366774565,10574033694328216650,524288 --field-trial-handle=1940,i,4895571957245334932,17222925209803169866,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:13
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,2843514079361357871,7081415584611154391,2097152 --field-trial-handle=1940,i,4895571957245334932,17222925209803169866,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,5175505098546027014,2026214332190169289,2097152 --field-trial-handle=1940,i,4895571957245334932,17222925209803169866,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,15040989328164289356,1161515197270248371,524288 --field-trial-handle=1940,i,4895571957245334932,17222925209803169866,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,617202402299900441,11986608364374516740,524288 --field-trial-handle=1940,i,4895571957245334932,17222925209803169866,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,17414591610171039463,11310578881471406332,524288 --field-trial-handle=1940,i,4895571957245334932,17222925209803169866,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,10480338256971246485,4668703530650103884,524288 --field-trial-handle=1940,i,4895571957245334932,17222925209803169866,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,10480338256971246485,4668703530650103884,524288 --field-trial-handle=1940,i,4895571957245334932,17222925209803169866,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6300,i,18300456736674551627,16396702661801448962,2097152 --field-trial-handle=1940,i,4895571957245334932,17222925209803169866,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,4963902586755751977,10022070535137367222,524288 --field-trial-handle=1940,i,4895571957245334932,17222925209803169866,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:14
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6536,i,8630274983789515268,11920707333402328731,2097152 --field-trial-handle=1940,i,4895571957245334932,17222925209803169866,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,8078801261415166444,13190059945974595192,524288 --field-trial-handle=1940,i,4895571957245334932,17222925209803169866,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,13052675999271935492,4519447803867909567,524288 --field-trial-handle=1940,i,4895571957245334932,17222925209803169866,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:14
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,13564055509371012426,8482937836670116348,524288 --field-trial-handle=1940,i,4895571957245334932,17222925209803169866,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:14
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,2783276715408264676,8550261260607635549,524288 --field-trial-handle=1940,i,4895571957245334932,17222925209803169866,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:14
  2⤵
  PID:1008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4764

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2236

C:\Users\Admin\Downloads\OrionBlue_Beta_2.1.1\OrionBlue_Beta_2.1.1\OrionBlue Setup 2.1.1.exe
"C:\Users\Admin\Downloads\OrionBlue_Beta_2.1.1\OrionBlue_Beta_2.1.1\OrionBlue Setup 2.1.1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq OrionBlue.exe" /FO csv | "C:\Windows\system32\find.exe" "OrionBlue.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq OrionBlue.exe" /FO csv
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:216
- - C:\Windows\SysWOW64\find.exe
    "C:\Windows\system32\find.exe" "OrionBlue.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3720

C:\Users\Admin\AppData\Local\Programs\orionblue\OrionBlue.exe
"C:\Users\Admin\AppData\Local\Programs\orionblue\OrionBlue.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:4232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "openssl version"
  2⤵
  PID:1532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "npm -v"
  2⤵
  PID:1444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pm2.cmd -v"
  2⤵
  - Executes a command shell one-liner
  PID:5688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "yarn --version"
  2⤵
  PID:1888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gulp.cmd --version"
  2⤵
  - Executes a command shell one-liner
  PID:5952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "brew --version"
  2⤵
  PID:3824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tsc.cmd --version"
  2⤵
  - Executes a command shell one-liner
  PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "grunt.cmd --version"
  2⤵
  PID:1872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "git --version"
  2⤵
  PID:5776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "apachectl -v 2>&1"
  2⤵
  PID:2200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "nginx -v 2>&1"
  2⤵
  PID:4852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mysql -V"
  2⤵
  PID:4444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "php -v"
  2⤵
  - Executes a command shell one-liner
  PID:4812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "redis-server --version"
  2⤵
  PID:4188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "docker --version"
  2⤵
  PID:5040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "postconf -d | grep mail_version"
  2⤵
  PID:4964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mongod --version"
  2⤵
  PID:5972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "perl -v"
  2⤵
  PID:1660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python -V 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:1612
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python -V
    3⤵
    PID:6864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python3 -V 2>&1"
  2⤵
  PID:5756
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python3 -V
    3⤵
    PID:6788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip -V 2>&1"
  2⤵
  PID:4480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip3 -V 2>&1"
  2⤵
  PID:652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:5052
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -version
    3⤵
    PID:6400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc -dumpversion"
  2⤵
  PID:3408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" -v 2>&1"
  2⤵
  PID:4764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bash --version"
  2⤵
  PID:5564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "zsh --version"
  2⤵
  PID:216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "fish --version"
  2⤵
  - Executes a command shell one-liner
  PID:1648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bun -v"
  2⤵
  - Executes a command shell one-liner
  PID:852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "deno -v"
  2⤵
  PID:5216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "node -v"
  2⤵
  PID:2860
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Service | select caption | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2588
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command $PSVersionTable
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3136
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gci \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -recurse | gp -name Version,Release -EA 0 | where { $_.PSChildName -match \"^(?!S)\p{L}\"} | select PSChildName, Version, Release"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4108
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:5132
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6228
- C:\Users\Admin\AppData\Local\Programs\orionblue\OrionBlue.exe
  "C:\Users\Admin\AppData\Local\Programs\orionblue\OrionBlue.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\orionblue" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2524 --field-trial-handle=2564,i,13921874983281690457,6055276471841197508,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3340
- C:\Users\Admin\AppData\Local\Programs\orionblue\OrionBlue.exe
  "C:\Users\Admin\AppData\Local\Programs\orionblue\OrionBlue.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\orionblue" --mojo-platform-channel-handle=3076 --field-trial-handle=2564,i,13921874983281690457,6055276471841197508,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc --version"
  2⤵
  PID:6688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:6736
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  PID:3460
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5688
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:2432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  PID:228
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:1388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  - Executes a command shell one-liner
  PID:332
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:6516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  PID:324
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:5040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5068
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe
    3⤵
    - Kills process with taskkill
    PID:4228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"
  2⤵
  PID:5260
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe
    3⤵
    - Kills process with taskkill
    PID:652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"
  2⤵
  PID:1168
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM centbrowser.exe
    3⤵
    - Kills process with taskkill
    PID:4852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"
  2⤵
  PID:2292
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 7star.exe
    3⤵
    - Kills process with taskkill
    PID:6140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"
  2⤵
  PID:1152
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM sputnik.exe
    3⤵
    - Kills process with taskkill
    PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
  2⤵
  - Executes a command shell one-liner
  PID:6636
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:5596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
  2⤵
  PID:3716
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM epicprivacybrowser.exe
    3⤵
    - Kills process with taskkill
    PID:4952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"
  2⤵
  PID:3388
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe
    3⤵
    - Kills process with taskkill
    PID:5216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
  2⤵
  PID:2184
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:2532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"
  2⤵
  PID:2652
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM iridium.exe
    3⤵
    - Kills process with taskkill
    PID:1260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM tor.exe"
  2⤵
  PID:6760
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM tor.exe
    3⤵
    - Kills process with taskkill
    PID:6696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM waterfox.exe"
  2⤵
  PID:6944
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM waterfox.exe
    3⤵
    - Kills process with taskkill
    PID:6900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM arc.exe"
  2⤵
  PID:7040
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM arc.exe
    3⤵
    - Kills process with taskkill
    PID:7072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
  2⤵
  PID:7048
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
    3⤵
    PID:4564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
  2⤵
  PID:4344
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles state
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:7124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled""
  2⤵
  PID:2116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn""
  2⤵
  - Executes a command shell one-liner
  PID:4944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA"
  2⤵
  - Executes a command shell one-liner
  PID:6956
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA
    3⤵
    PID:4808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1""
  2⤵
  PID:6424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:1820
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:6528
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:6508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')""
  2⤵
  PID:5136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA="
  2⤵
  PID:224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled""
  2⤵
  - Executes a command shell one-liner
  PID:6572
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3048
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2836
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_VideoController | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2448
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:3732
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_desktopmonitor | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1972
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3424
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5972
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:432
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4620
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
  2⤵
  PID:6412
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
    3⤵
    - Checks processor information in registry
    PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version,vendor,installDate /format:list"
  2⤵
  - Executes a command shell one-liner
  PID:1012
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product get name,version,vendor,installDate /format:list
    3⤵
    PID:7152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "openssl version"
  2⤵
  - Executes a command shell one-liner
  PID:1020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "npm -v"
  2⤵
  - Executes a command shell one-liner
  PID:6576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pm2.cmd -v"
  2⤵
  PID:3140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "yarn --version"
  2⤵
  - Executes a command shell one-liner
  PID:5236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gulp.cmd --version"
  2⤵
  PID:6020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "brew --version"
  2⤵
  PID:4280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tsc.cmd --version"
  2⤵
  - Executes a command shell one-liner
  PID:4232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "grunt.cmd --version"
  2⤵
  PID:2356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "git --version"
  2⤵
  PID:2004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "apachectl -v 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:6592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "nginx -v 2>&1"
  2⤵
  PID:2892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mysql -V"
  2⤵
  - Executes a command shell one-liner
  PID:216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "php -v"
  2⤵
  PID:2520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "redis-server --version"
  2⤵
  PID:4692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "docker --version"
  2⤵
  PID:6596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "postconf -d | grep mail_version"
  2⤵
  PID:5584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mongod --version"
  2⤵
  PID:6632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "perl -v"
  2⤵
  PID:1232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python -V 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:2628
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python -V
    3⤵
    PID:2012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python3 -V 2>&1"
  2⤵
  PID:2592
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python3 -V
    3⤵
    PID:2824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip -V 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:5660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip3 -V 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:3128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
  2⤵
  PID:4900
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -version
    3⤵
    PID:4208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc -dumpversion"
  2⤵
  - Executes a command shell one-liner
  PID:6492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" -v 2>&1"
  2⤵
  PID:2320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bash --version"
  2⤵
  PID:1584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "zsh --version"
  2⤵
  PID:6224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "fish --version"
  2⤵
  - Executes a command shell one-liner
  PID:4932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bun -v"
  2⤵
  - Executes a command shell one-liner
  PID:1536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "deno -v"
  2⤵
  PID:6380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "node -v"
  2⤵
  PID:1192
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Service | select caption | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7084
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command $PSVersionTable
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6984
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gci \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -recurse | gp -name Version,Release -EA 0 | where { $_.PSChildName -match \"^(?!S)\p{L}\"} | select PSChildName, Version, Release"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6148
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
  2⤵
  PID:7112
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
    3⤵
    PID:5040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
  2⤵
  PID:1488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4580
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
  2⤵
  PID:2104
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
    3⤵
    PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
  2⤵
  PID:5216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2016
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1228
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4144
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4228
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3256
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc --version"
  2⤵
  PID:2876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  PID:4216
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6648
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6988
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1260
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version,vendor,installDate /format:list"
  2⤵
  PID:432
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2012
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product get name,version,vendor,installDate /format:list
    3⤵
    PID:5236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
  2⤵
  PID:816
- - C:\Windows\system32\findstr.exe
    findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    3⤵
    PID:6720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey""
  2⤵
  - Executes a command shell one-liner
  PID:544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
  2⤵
  PID:4956
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:5792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "route print"
  2⤵
  PID:7116
- - C:\Windows\system32\ROUTE.EXE
    route print
    3⤵
    PID:2060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic service get name,displayName,state,startMode,pathName /format:list"
  2⤵
  PID:6200
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic service get name,displayName,state,startMode,pathName /format:list
    3⤵
    PID:7132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
  2⤵
  PID:3604
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
    3⤵
    - Checks processor information in registry
    PID:2236
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7068
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6172
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6612
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6820
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  - Executes a command shell one-liner
  PID:4316
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1020
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2824
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7084
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4692
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6988
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
  2⤵
  PID:4204
- - C:\Windows\system32\findstr.exe
    findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    3⤵
    PID:6868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "py -3 --version"
  2⤵
  PID:4732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "py --version"
  2⤵
  PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python --version"
  2⤵
  PID:6136
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python --version
    3⤵
    PID:5348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python3 --version"
  2⤵
  - Executes a command shell one-liner
  PID:3516
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python3 --version
    3⤵
    PID:4604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" /quiet InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0"
  2⤵
  PID:4804
- - C:\Users\Admin\AppData\Local\Temp\python312_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" /quiet InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1664
  - - C:\Windows\Temp\{0AECA646-AF7C-4739-8EE0-7642BD9C937C}\.cr\python312_installer.exe
      "C:\Windows\Temp\{0AECA646-AF7C-4739-8EE0-7642BD9C937C}\.cr\python312_installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" -burn.filehandle.attached=580 -burn.filehandle.self=732 /quiet InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:6976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" --version"
  2⤵
  PID:7828
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:7868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"
  2⤵
  - Executes a command shell one-liner
  PID:7884
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:7928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"
  2⤵
  - Executes a command shell one-liner
  PID:7964
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:8008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"
  2⤵
  PID:8024
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"
  2⤵
  PID:8080
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:8124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\check_deps.py""
  2⤵
  - Executes a command shell one-liner
  PID:8144
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\check_deps.py"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:8184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"
  2⤵
  PID:1160
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"
  2⤵
  - Executes a command shell one-liner
  PID:5156
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"
  2⤵
  PID:2904
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"
  2⤵
  PID:1536
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome
    3⤵
    - Executes dropped EXE
    PID:5204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"
  2⤵
  - Executes a command shell one-liner
  PID:5152
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome
    3⤵
    - Executes dropped EXE
    PID:5396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""
  2⤵
  PID:1388
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"
    3⤵
    - Executes dropped EXE
    PID:5304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"
  2⤵
  - Executes a command shell one-liner
  PID:1608
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip
    3⤵
    - Executes dropped EXE
    PID:3348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"
  2⤵
  - Executes a command shell one-liner
  PID:396
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows
    3⤵
    - Executes dropped EXE
    PID:6052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"
  2⤵
  PID:5292
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows
    3⤵
    - Executes dropped EXE
    PID:3408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"
  2⤵
  PID:4064
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome
    3⤵
    - Executes dropped EXE
    PID:7136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"
  2⤵
  - Executes a command shell one-liner
  PID:4216
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome
    3⤵
    - Executes dropped EXE
    PID:6868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""
  2⤵
  PID:7160
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"
    3⤵
    - Executes dropped EXE
    PID:4416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"
  2⤵
  PID:3824
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6148
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip
    3⤵
    - Executes dropped EXE
    PID:6660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"
  2⤵
  PID:2636
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows
    3⤵
    - Executes dropped EXE
    PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"
  2⤵
  - Executes a command shell one-liner
  PID:2012
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows
    3⤵
    - Executes dropped EXE
    PID:5344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"
  2⤵
  PID:3324
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome
    3⤵
    - Executes dropped EXE
    PID:3132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"
  2⤵
  PID:6632
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome
    3⤵
    - Executes dropped EXE
    PID:3116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""
  2⤵
  - Executes a command shell one-liner
  PID:1332
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"
    3⤵
    - Executes dropped EXE
    PID:6420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\check_deps.py""
  2⤵
  - Executes a command shell one-liner
  PID:6464
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\check_deps.py"
    3⤵
    - Executes dropped EXE
    PID:6936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"
  2⤵
  PID:852
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip
    3⤵
    - Executes dropped EXE
    PID:4584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"
  2⤵
  PID:6884
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows
    3⤵
    - Executes dropped EXE
    PID:5272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"
  2⤵
  - Executes a command shell one-liner
  PID:6564
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows
    3⤵
    - Executes dropped EXE
    PID:2892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"
  2⤵
  - Executes a command shell one-liner
  PID:2208
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome
    3⤵
    - Executes dropped EXE
    PID:3804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"
  2⤵
  - Executes a command shell one-liner
  PID:6440
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome
    3⤵
    - Executes dropped EXE
    PID:4544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""
  2⤵
  PID:6080
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"
    3⤵
    - Executes dropped EXE
    PID:1512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"
  2⤵
  PID:5224
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip
    3⤵
    - Executes dropped EXE
    PID:4952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"
  2⤵
  - Executes a command shell one-liner
  PID:3012
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows
    3⤵
    - Executes dropped EXE
    PID:6576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"
  2⤵
  - Executes a command shell one-liner
  PID:4588
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows
    3⤵
    - Executes dropped EXE
    PID:5472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"
  2⤵
  PID:1860
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome
    3⤵
    - Executes dropped EXE
    PID:6896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"
  2⤵
  PID:6592
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome
    3⤵
    - Executes dropped EXE
    PID:3740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""
  2⤵
  - Executes a command shell one-liner
  PID:6388
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"
    3⤵
    - Executes dropped EXE
    PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"
  2⤵
  PID:4200
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip
    3⤵
    - Executes dropped EXE
    PID:3952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"
  2⤵
  - Executes a command shell one-liner
  PID:2084
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows
    3⤵
    - Executes dropped EXE
    PID:3440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"
  2⤵
  - Executes a command shell one-liner
  PID:4788
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows
    3⤵
    - Executes dropped EXE
    PID:4728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"
  2⤵
  PID:6744
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome
    3⤵
    - Executes dropped EXE
    PID:7184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"
  2⤵
  - Executes a command shell one-liner
  PID:7204
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome
    3⤵
    - Executes dropped EXE
    PID:7244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""
  2⤵
  PID:7264
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"
    3⤵
    - Executes dropped EXE
    PID:7304
- C:\Users\Admin\AppData\Local\Programs\orionblue\OrionBlue.exe
  "C:\Users\Admin\AppData\Local\Programs\orionblue\OrionBlue.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\orionblue" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3340 --field-trial-handle=2564,i,13921874983281690457,6055276471841197508,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  PID:7352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\check_deps.py""
  2⤵
  PID:7640
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\check_deps.py"
    3⤵
    - Executes dropped EXE
    PID:7680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"
  2⤵
  PID:6876
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip
    3⤵
    - Executes dropped EXE
    PID:1064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"
  2⤵
  PID:6820
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows
    3⤵
    - Executes dropped EXE
    PID:7712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"
  2⤵
  PID:7748
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows
    3⤵
    - Executes dropped EXE
    PID:7776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"
  2⤵
  PID:7796
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome
    3⤵
    - Executes dropped EXE
    PID:4632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"
  2⤵
  PID:7876
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome
    3⤵
    - Executes dropped EXE
    PID:7888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""
  2⤵
  PID:7908
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"
    3⤵
    - Executes dropped EXE
    PID:7968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"
  2⤵
  - Executes a command shell one-liner
  PID:8000
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip
    3⤵
    - Executes dropped EXE
    PID:5144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"
  2⤵
  PID:1868
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows
    3⤵
    - Executes dropped EXE
    PID:8044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"
  2⤵
  PID:8032
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows
    3⤵
    - Executes dropped EXE
    PID:6680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"
  2⤵
  - Executes a command shell one-liner
  PID:8116
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome
    3⤵
    PID:8176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"
  2⤵
  PID:8160
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome
    3⤵
    PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""
  2⤵
  PID:6796
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"
    3⤵
    PID:6156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"
  2⤵
  PID:6872
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip
    3⤵
    PID:1284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"
  2⤵
  - Executes a command shell one-liner
  PID:6500
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows
    3⤵
    PID:1584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"
  2⤵
  - Executes a command shell one-liner
  PID:4180
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows
    3⤵
    PID:5396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"
  2⤵
  PID:1000
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome
    3⤵
    PID:5304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"
  2⤵
  - Executes a command shell one-liner
  PID:5076
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome
    3⤵
    PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""
  2⤵
  PID:4128
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"
    3⤵
    PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\check_deps.py""
  2⤵
  - Executes a command shell one-liner
  PID:1696
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3408
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\check_deps.py"
    3⤵
    PID:6648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"
  2⤵
  PID:2196
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip
    3⤵
    PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"
  2⤵
  PID:8
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows
    3⤵
    PID:6804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"
  2⤵
  PID:4756
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows
    3⤵
    PID:5876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"
  2⤵
  - Executes a command shell one-liner
  PID:5768
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome
    3⤵
    PID:5036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"
  2⤵
  - Executes a command shell one-liner
  PID:2860
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome
    3⤵
    PID:1140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""
  2⤵
  PID:880
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"
    3⤵
    PID:6788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"
  2⤵
  PID:6948
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6660
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip
    3⤵
    PID:6148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"
  2⤵
  PID:5000
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows
    3⤵
    PID:5568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"
  2⤵
  PID:5048
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows
    3⤵
    PID:6712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"
  2⤵
  PID:5704
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome
    3⤵
    PID:6968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"
  2⤵
  PID:2100
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome
    3⤵
    PID:6216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""
  2⤵
  PID:3428
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"
    3⤵
    PID:6716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"
  2⤵
  PID:968
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip
    3⤵
    PID:5780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"
  2⤵
  PID:6836
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows
    3⤵
    PID:5880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"
  2⤵
  PID:4584
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows
    3⤵
    PID:5496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"
  2⤵
  PID:6088
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome
    3⤵
    PID:4108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"
  2⤵
  PID:7012
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome
    3⤵
    PID:6960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""
  2⤵
  - Executes a command shell one-liner
  PID:3424
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"
    3⤵
    PID:4544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
  2⤵
  PID:3848
- - C:\Windows\system32\taskkill.exe
    taskkill /IM javaw.exe /F
    3⤵
    - Kills process with taskkill
    PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"
  2⤵
  - Executes a command shell one-liner
  PID:4708
- - C:\Windows\system32\taskkill.exe
    taskkill /IM EpicGamesLauncher.exe /F
    3⤵
    - Kills process with taskkill
    PID:7016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
  2⤵
  - Executes a command shell one-liner
  PID:4612
- - C:\Windows\system32\taskkill.exe
    taskkill /IM Steam.exe /F
    3⤵
    - Kills process with taskkill
    PID:3956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "sc config node DisplayName= "Time Synchronization Service""
  2⤵
  PID:3196
- - C:\Windows\system32\sc.exe
    sc config node DisplayName= "Time Synchronization Service"
    3⤵
    - Launches sc.exe
    PID:6848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i svchost.exe"
  2⤵
  PID:4476
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1728
- - C:\Windows\system32\findstr.exe
    findstr /i svchost.exe
    3⤵
    PID:3632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i winlogon.exe"
  2⤵
  PID:5572
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:7196
- - C:\Windows\system32\findstr.exe
    findstr /i winlogon.exe
    3⤵
    PID:7172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i services.exe"
  2⤵
  PID:5732
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:7256
- - C:\Windows\system32\findstr.exe
    findstr /i services.exe
    3⤵
    PID:7240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i explorer.exe"
  2⤵
  PID:7132
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:7188
- - C:\Windows\system32\findstr.exe
    findstr /i explorer.exe
    3⤵
    PID:7248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i dllhost.exe"
  2⤵
  PID:4136
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:7184
- - C:\Windows\system32\findstr.exe
    findstr /i dllhost.exe
    3⤵
    PID:7176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i taskhostw.exe"
  2⤵
  PID:2464
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:7220
- - C:\Windows\system32\findstr.exe
    findstr /i taskhostw.exe
    3⤵
    PID:7260

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1368

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
PID:4936
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 12167186E48C943A2D350EABBA84DC40
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:7088
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -I -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5404
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -I -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp76f4m6tq\\pip-25.0.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp76f4m6tq', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4540

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4488

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2448

C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
"C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7004
- C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
  "C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20260826234908.log" InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3948
- - C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
    "C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20260826234908.log" InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:6444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery