1) Gathered system info from WMI 2) Gathered the ARP table 3) Gathered a list of running processes 4) Materialized a file “OracleJavaUpdater.ps1” to disk. This file gathers passwords and web browser data from a variety of sources: Windows Credential Vault, Internet Explorer, Firefox, Chrome, Outlook. some Internet Explorer password gathering code appears to be lifted from the GPLv3-licensed QuasarRAT88) 5) Executed “OracleJavaUpdater.ps1” 6) Deleted “OracleJavaUpdater.ps1” 7) Gathered a list of running processes again