hexon | 7410df3bf88e63503d20b65415fcbca83893ab9d320e33abde333ae0ae6accd3

Processes:

msedge.exechrome.exechrome.exemsedge.exemsedge.exemsedge.exechrome.exemsedge.exemsedge.exemsedge.exechrome.exechrome.exemsedge.exemsedge.exemsedge.exechrome.exemsedge.exechrome.exemsedge.exechrome.exemsedge.exechrome.exemsedge.exechrome.exechrome.exemsedge.exechrome.exe

pid	process
6104	msedge.exe
4564	chrome.exe
5036	chrome.exe
2120	msedge.exe
5916	msedge.exe
6060	msedge.exe
1208	chrome.exe
6040	msedge.exe
5076	msedge.exe
2836	msedge.exe
2004	chrome.exe
3332	chrome.exe
5300	msedge.exe
5172	msedge.exe
4592	msedge.exe
1636	chrome.exe
5280	msedge.exe
1352	chrome.exe
5820	msedge.exe
6052	chrome.exe
5324	msedge.exe
1032	chrome.exe
2192	msedge.exe
2416	chrome.exe
3136	chrome.exe
5264	msedge.exe
1620	chrome.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

KametaV14.exeKametaV14.execscript.exehexon_b0eb3cf3abcc1583.exeKametaV14.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	KametaV14.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	KametaV14.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	cscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	hexon_b0eb3cf3abcc1583.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	KametaV14.exe

Drops startup file 1 IoCs

Processes:

KametaV14.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startup.vbs KametaV14.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startup.vbs	KametaV14.exe

Executes dropped EXE 13 IoCs

Processes:

KametaV14 1.0.0.exeKametaV14.exeKametaV14.exeKametaV14.exehexon_b0eb3cf3abcc1583.exescreenCapture_1.3.2.exeKametaV14.exeKametaV14.exeKametaV14.exeKametaV14.exeKametaV14.exeKametaV14.exeKametaV14.exe

pid	process
1484	KametaV14 1.0.0.exe
4536	KametaV14.exe
4152	KametaV14.exe
1120	KametaV14.exe
5212	hexon_b0eb3cf3abcc1583.exe
5932	screenCapture_1.3.2.exe
3912	KametaV14.exe
5016	KametaV14.exe
3552	KametaV14.exe
5944	KametaV14.exe
5292	KametaV14.exe
216	KametaV14.exe
4588	KametaV14.exe

Loads dropped DLL 34 IoCs

Processes:

KametaV14 1.0.0.exeKametaV14.exeKametaV14.exeKametaV14.exehexon_b0eb3cf3abcc1583.exeKametaV14.exeKametaV14.exeKametaV14.exeKametaV14.exeKametaV14.exeKametaV14.exeKametaV14.exe

pid	process
1484	KametaV14 1.0.0.exe
1484	KametaV14 1.0.0.exe
1484	KametaV14 1.0.0.exe
4536	KametaV14.exe
4536	KametaV14.exe
4536	KametaV14.exe
4152	KametaV14.exe
1120	KametaV14.exe
4152	KametaV14.exe
4152	KametaV14.exe
4152	KametaV14.exe
4152	KametaV14.exe
5212	hexon_b0eb3cf3abcc1583.exe
5212	hexon_b0eb3cf3abcc1583.exe
3912	KametaV14.exe
3912	KametaV14.exe
5016	KametaV14.exe
5016	KametaV14.exe
5016	KametaV14.exe
5944	KametaV14.exe
3552	KametaV14.exe
3552	KametaV14.exe
3552	KametaV14.exe
3552	KametaV14.exe
3552	KametaV14.exe
5292	KametaV14.exe
5292	KametaV14.exe
5292	KametaV14.exe
216	KametaV14.exe
4588	KametaV14.exe
216	KametaV14.exe
216	KametaV14.exe
216	KametaV14.exe
216	KametaV14.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates processes with tasklist 1 TTPs 21 IoCs

discovery

Process Discovery

T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid	process
3192	tasklist.exe
3212	tasklist.exe
4136	tasklist.exe
1736	tasklist.exe
5852	tasklist.exe
5468	tasklist.exe
844	tasklist.exe
4580	tasklist.exe
4888	tasklist.exe
3720	tasklist.exe
4852	tasklist.exe
4572	tasklist.exe
5176	tasklist.exe
3064	tasklist.exe
5372	tasklist.exe
5220	tasklist.exe
4176	tasklist.exe
5048	tasklist.exe
3580	tasklist.exe
4312	tasklist.exe
1988	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

KametaV14 1.0.0.execsc.execvtres.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KametaV14 1.0.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 21 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exemsedge.exechrome.exemsedge.exemsedge.exemsedge.exechrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 28 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4832	taskkill.exe
5324	taskkill.exe
2608	taskkill.exe
4020	taskkill.exe
4728	taskkill.exe
3716	taskkill.exe
1736	taskkill.exe
5216	taskkill.exe
2628	taskkill.exe
5944	taskkill.exe
5928	taskkill.exe
1736	taskkill.exe
5180	taskkill.exe
5568	taskkill.exe
1664	taskkill.exe
4356	taskkill.exe
2456	taskkill.exe
4476	taskkill.exe
2712	taskkill.exe
5656	taskkill.exe
3108	taskkill.exe
6124	taskkill.exe
2660	taskkill.exe
5160	taskkill.exe
5064	taskkill.exe
2596	taskkill.exe
2484	taskkill.exe
5572	taskkill.exe

Modifies registry class 1 IoCs

Processes:

OpenWith.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings OpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

Processes:

KametaV14.exechrome.exemsedge.exemsedge.exemsedge.exeKametaV14.exeKametaV14.exechrome.exemsedge.exemsedge.exeKametaV14.exechrome.exetaskmgr.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
1120	KametaV14.exe
1120	KametaV14.exe
1032	chrome.exe
1032	chrome.exe
5976	msedge.exe
5976	msedge.exe
5720	msedge.exe
5720	msedge.exe
5264	msedge.exe
5264	msedge.exe
5264	msedge.exe
3912	KametaV14.exe
3912	KametaV14.exe
3912	KametaV14.exe
3912	KametaV14.exe
5944	KametaV14.exe
5944	KametaV14.exe
6052	chrome.exe
6052	chrome.exe
1072	msedge.exe
1072	msedge.exe
2836	msedge.exe
2836	msedge.exe
4588	KametaV14.exe
4588	KametaV14.exe
2416	chrome.exe
2416	chrome.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
1992	msedge.exe
1992	msedge.exe
6060	msedge.exe
6060	msedge.exe
1988	msedge.exe
1988	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

7zFM.exeOpenWith.exe7zFM.exe

pid process

4692 7zFM.exe
5840 OpenWith.exe
5924 7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

Processes:

chrome.exemsedge.exechrome.exemsedge.exechrome.exemsedge.exemsedge.exe

pid	process
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
5264	msedge.exe
5264	msedge.exe
5264	msedge.exe
5264	msedge.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zFM.exeKametaV14 1.0.0.exeWMIC.exetasklist.exeKametaV14.exetasklist.exetasklist.exechrome.exe

description	pid	process
Token: SeRestorePrivilege	4692	7zFM.exe
Token: 35	4692	7zFM.exe
Token: SeSecurityPrivilege	4692	7zFM.exe
Token: SeSecurityPrivilege	1484	KametaV14 1.0.0.exe
Token: SeIncreaseQuotaPrivilege	3244	WMIC.exe
Token: SeSecurityPrivilege	3244	WMIC.exe
Token: SeTakeOwnershipPrivilege	3244	WMIC.exe
Token: SeLoadDriverPrivilege	3244	WMIC.exe
Token: SeSystemProfilePrivilege	3244	WMIC.exe
Token: SeSystemtimePrivilege	3244	WMIC.exe
Token: SeProfSingleProcessPrivilege	3244	WMIC.exe
Token: SeIncBasePriorityPrivilege	3244	WMIC.exe
Token: SeCreatePagefilePrivilege	3244	WMIC.exe
Token: SeBackupPrivilege	3244	WMIC.exe
Token: SeRestorePrivilege	3244	WMIC.exe
Token: SeShutdownPrivilege	3244	WMIC.exe
Token: SeDebugPrivilege	3244	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3244	WMIC.exe
Token: SeRemoteShutdownPrivilege	3244	WMIC.exe
Token: SeUndockPrivilege	3244	WMIC.exe
Token: SeManageVolumePrivilege	3244	WMIC.exe
Token: 33	3244	WMIC.exe
Token: 34	3244	WMIC.exe
Token: 35	3244	WMIC.exe
Token: 36	3244	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3244	WMIC.exe
Token: SeSecurityPrivilege	3244	WMIC.exe
Token: SeTakeOwnershipPrivilege	3244	WMIC.exe
Token: SeLoadDriverPrivilege	3244	WMIC.exe
Token: SeSystemProfilePrivilege	3244	WMIC.exe
Token: SeSystemtimePrivilege	3244	WMIC.exe
Token: SeProfSingleProcessPrivilege	3244	WMIC.exe
Token: SeIncBasePriorityPrivilege	3244	WMIC.exe
Token: SeCreatePagefilePrivilege	3244	WMIC.exe
Token: SeBackupPrivilege	3244	WMIC.exe
Token: SeRestorePrivilege	3244	WMIC.exe
Token: SeShutdownPrivilege	3244	WMIC.exe
Token: SeDebugPrivilege	3244	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3244	WMIC.exe
Token: SeRemoteShutdownPrivilege	3244	WMIC.exe
Token: SeUndockPrivilege	3244	WMIC.exe
Token: SeManageVolumePrivilege	3244	WMIC.exe
Token: 33	3244	WMIC.exe
Token: 34	3244	WMIC.exe
Token: 35	3244	WMIC.exe
Token: 36	3244	WMIC.exe
Token: SeDebugPrivilege	4580	tasklist.exe
Token: SeShutdownPrivilege	4536	KametaV14.exe
Token: SeCreatePagefilePrivilege	4536	KametaV14.exe
Token: SeDebugPrivilege	3580	tasklist.exe
Token: SeShutdownPrivilege	4536	KametaV14.exe
Token: SeCreatePagefilePrivilege	4536	KametaV14.exe
Token: SeDebugPrivilege	4312	tasklist.exe
Token: SeShutdownPrivilege	4536	KametaV14.exe
Token: SeCreatePagefilePrivilege	4536	KametaV14.exe
Token: SeShutdownPrivilege	4536	KametaV14.exe
Token: SeCreatePagefilePrivilege	4536	KametaV14.exe
Token: SeShutdownPrivilege	4536	KametaV14.exe
Token: SeCreatePagefilePrivilege	4536	KametaV14.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	4536	KametaV14.exe
Token: SeCreatePagefilePrivilege	4536	KametaV14.exe
Token: SeShutdownPrivilege	1032	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

Processes:

7zFM.exechrome.exemsedge.exe7zG.exe7zFM.exechrome.exemsedge.exechrome.exetaskmgr.exemsedge.exemsedge.exe

pid	process
4692	7zFM.exe
4692	7zFM.exe
1032	chrome.exe
5264	msedge.exe
5448	7zG.exe
5924	7zFM.exe
5924	7zFM.exe
6052	chrome.exe
2836	msedge.exe
2416	chrome.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
6060	msedge.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
4292	msedge.exe

Suspicious use of SendNotifyMessage 30 IoCs

Processes:

taskmgr.exe

pid	process
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe
5576	taskmgr.exe

Suspicious use of SetWindowsHookEx 23 IoCs

Processes:

OpenWith.exe

pid	process
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

KametaV14 1.0.0.exeKametaV14.execmd.execmd.execmd.execmd.execmd.exechrome.exe

description	pid	process	target process
PID 1484 wrote to memory of 4536	1484	KametaV14 1.0.0.exe	KametaV14.exe
PID 1484 wrote to memory of 4536	1484	KametaV14 1.0.0.exe	KametaV14.exe
PID 4536 wrote to memory of 4436	4536	KametaV14.exe	cmd.exe
PID 4536 wrote to memory of 4436	4536	KametaV14.exe	cmd.exe
PID 4436 wrote to memory of 3244	4436	cmd.exe	WMIC.exe
PID 4436 wrote to memory of 3244	4436	cmd.exe	WMIC.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 4152	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 1120	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 1120	4536	KametaV14.exe	KametaV14.exe
PID 4536 wrote to memory of 1660	4536	KametaV14.exe	cmd.exe
PID 4536 wrote to memory of 1660	4536	KametaV14.exe	cmd.exe
PID 1660 wrote to memory of 4580	1660	cmd.exe	tasklist.exe
PID 1660 wrote to memory of 4580	1660	cmd.exe	tasklist.exe
PID 4536 wrote to memory of 4256	4536	KametaV14.exe	cmd.exe
PID 4536 wrote to memory of 4256	4536	KametaV14.exe	cmd.exe
PID 4256 wrote to memory of 5076	4256	cmd.exe	where.exe
PID 4256 wrote to memory of 5076	4256	cmd.exe	where.exe
PID 4536 wrote to memory of 1860	4536	KametaV14.exe	cmd.exe
PID 4536 wrote to memory of 1860	4536	KametaV14.exe	cmd.exe
PID 1860 wrote to memory of 3580	1860	cmd.exe	tasklist.exe
PID 1860 wrote to memory of 3580	1860	cmd.exe	tasklist.exe
PID 4536 wrote to memory of 2836	4536	KametaV14.exe	cmd.exe
PID 4536 wrote to memory of 2836	4536	KametaV14.exe	cmd.exe
PID 2836 wrote to memory of 4312	2836	cmd.exe	tasklist.exe
PID 2836 wrote to memory of 4312	2836	cmd.exe	tasklist.exe
PID 4536 wrote to memory of 1032	4536	KametaV14.exe	chrome.exe
PID 4536 wrote to memory of 1032	4536	KametaV14.exe	chrome.exe
PID 1032 wrote to memory of 4724	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 4724	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 1408	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 1408	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 1408	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 1408	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 1408	1032	chrome.exe	chrome.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\KametaGame.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4692

C:\Users\Admin\Desktop\KametaV14 1.0.0.exe
"C:\Users\Admin\Desktop\KametaV14 1.0.0.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Users\Admin\AppData\Local\Temp\2ofrRLzpsewy24lvM3imeciRSUt\KametaV14.exe
  C:\Users\Admin\AppData\Local\Temp\2ofrRLzpsewy24lvM3imeciRSUt\KametaV14.exe
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3244
- - C:\Users\Admin\AppData\Local\Temp\2ofrRLzpsewy24lvM3imeciRSUt\KametaV14.exe
    "C:\Users\Admin\AppData\Local\Temp\2ofrRLzpsewy24lvM3imeciRSUt\KametaV14.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1800,i,1720580469324774033,877356598521983663,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4152
- - C:\Users\Admin\AppData\Local\Temp\2ofrRLzpsewy24lvM3imeciRSUt\KametaV14.exe
    "C:\Users\Admin\AppData\Local\Temp\2ofrRLzpsewy24lvM3imeciRSUt\KametaV14.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2012 --field-trial-handle=1800,i,1720580469324774033,877356598521983663,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "where /r . cookies.sqlite"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\system32\where.exe
      where /r . cookies.sqlite
      4⤵
      PID:5076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1860
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdd242cc40,0x7ffdd242cc4c,0x7ffdd242cc58
      4⤵
      PID:4724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2084,i,5975711560726906945,13875339055484201855,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2080 /prefetch:2
      4⤵
      PID:1408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1936,i,5975711560726906945,13875339055484201855,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2148 /prefetch:3
      4⤵
      PID:4740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2292,i,5975711560726906945,13875339055484201855,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2660 /prefetch:8
      4⤵
      PID:3312
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,5975711560726906945,13875339055484201855,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3228 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1352
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3248,i,5975711560726906945,13875339055484201855,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3280 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4476,i,5975711560726906945,13875339055484201855,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4464 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4612,i,5975711560726906945,13875339055484201855,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4636 /prefetch:8
      4⤵
      PID:5168
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4328,i,5975711560726906945,13875339055484201855,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3844 /prefetch:8
      4⤵
      PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcc1a46f8,0x7ffdcc1a4708,0x7ffdcc1a4718
      4⤵
      PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,928585131672592716,18333908394537805934,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,928585131672592716,18333908394537805934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,928585131672592716,18333908394537805934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2116,928585131672592716,18333908394537805934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2116,928585131672592716,18333908394537805934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2116,928585131672592716,18333908394537805934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2116,928585131672592716,18333908394537805934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4416 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3472
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4588
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3952
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
    3⤵
    PID:4932
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:4020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
    3⤵
    PID:724
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:2608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "where /r . *.sqlite"
    3⤵
    PID:5108
  - - C:\Windows\system32\where.exe
      where /r . *.sqlite
      4⤵
      PID:6072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2980
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
    3⤵
    PID:4416
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:5180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
    3⤵
    PID:4188
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:6124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
    3⤵
    PID:4184
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:5216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
    3⤵
    PID:5540
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"
    3⤵
    PID:1152
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM EpicGamesLauncher.exe /F
      4⤵
      Kills process with taskkill
      PID:5928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
    3⤵
    PID:5728
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM javaw.exe /F
      4⤵
      Kills process with taskkill
      PID:2660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
    3⤵
    PID:2044
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Steam.exe /F
      4⤵
      Kills process with taskkill
      PID:4476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //B "C:\Users\Admin\AppData\Local\Temp\open.vbs""
    3⤵
    PID:5048
  - - C:\Windows\system32\cscript.exe
      cscript //B "C:\Users\Admin\AppData\Local\Temp\open.vbs"
      4⤵
      Checks computer location settings
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\hexon_b0eb3cf3abcc1583.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hexon_b0eb3cf3abcc1583.exe" HXN-LIFETIME-1FABD05CD028 discord
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5212
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
        6⤵
        
        PID:5124
        
        C:\Windows\System32\reg.exe
        
        C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        7⤵
        
        PID:4436
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\20241012-5212-15wy7mj.iy19.png" "
        6⤵
        
        PID:5428
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1448
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF29.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCDF479D1E7B44F91B5601C82D4D65F0.TMP"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\20241012-5212-15wy7mj.iy19.png"
        7⤵
        Executes dropped EXE
        
        PID:5932
- - C:\Users\Admin\AppData\Local\Temp\2ofrRLzpsewy24lvM3imeciRSUt\KametaV14.exe
    "C:\Users\Admin\AppData\Local\Temp\2ofrRLzpsewy24lvM3imeciRSUt\KametaV14.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1800,i,1720580469324774033,877356598521983663,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3912

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault2bdedb17h7a57h4a53h95bdh961873b0148c
1⤵
PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffdcc1a46f8,0x7ffdcc1a4708,0x7ffdcc1a4718
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,3888017757583489392,2811007128249086275,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,3888017757583489392,2811007128249086275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,3888017757583489392,2811007128249086275,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:6060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1228

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap32083:88:7zEvent14280
1⤵
- Suspicious use of FindShellTrayWindow
PID:5448

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5808

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5840

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\$PLUGINSDIR\app-64.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:5924

C:\Users\Admin\Desktop\Kameta\KametaV14.exe
"C:\Users\Admin\Desktop\Kameta\KametaV14.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  PID:6072
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:2024
- C:\Users\Admin\Desktop\Kameta\KametaV14.exe
  "C:\Users\Admin\Desktop\Kameta\KametaV14.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1876 --field-trial-handle=1880,i,10217867039159371378,905373224335533761,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3552
- C:\Users\Admin\Desktop\Kameta\KametaV14.exe
  "C:\Users\Admin\Desktop\Kameta\KametaV14.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2112 --field-trial-handle=1880,i,10217867039159371378,905373224335533761,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:5588
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where /r . cookies.sqlite"
  2⤵
  PID:5916
- - C:\Windows\system32\where.exe
    where /r . cookies.sqlite
    3⤵
    PID:744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:5860
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4216
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:6052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffde1bdcc40,0x7ffde1bdcc4c,0x7ffde1bdcc58
    3⤵
    PID:1084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,7579590154929412963,1855229406582252090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1836 /prefetch:2
    3⤵
    PID:1952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2196,i,7579590154929412963,1855229406582252090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    PID:1240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2324,i,7579590154929412963,1855229406582252090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2364 /prefetch:8
    3⤵
    PID:3148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3236,i,7579590154929412963,1855229406582252090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3264,i,7579590154929412963,1855229406582252090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4552,i,7579590154929412963,1855229406582252090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4548 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4736,i,7579590154929412963,1855229406582252090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4580 /prefetch:8
    3⤵
    PID:2152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4836,i,7579590154929412963,1855229406582252090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4852 /prefetch:8
    3⤵
    PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffde1e546f8,0x7ffde1e54708,0x7ffde1e54718
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12812320384663419486,17500703312267813729,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,12812320384663419486,17500703312267813729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,12812320384663419486,17500703312267813729,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2128,12812320384663419486,17500703312267813729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2128,12812320384663419486,17500703312267813729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2128,12812320384663419486,17500703312267813729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2128,12812320384663419486,17500703312267813729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2436
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4540
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2800
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
  2⤵
  PID:2296
- - C:\Windows\system32\taskkill.exe
    taskkill /F /T /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:2712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
  2⤵
  PID:3584
- - C:\Windows\system32\taskkill.exe
    taskkill /F /T /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:5568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
  2⤵
  PID:4328
- - C:\Windows\system32\taskkill.exe
    taskkill /F /T /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:2484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
  2⤵
  PID:4904
- - C:\Windows\system32\taskkill.exe
    taskkill /F /T /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:1736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where /r . *.sqlite"
  2⤵
  PID:764
- - C:\Windows\system32\where.exe
    where /r . *.sqlite
    3⤵
    PID:5696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4216
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
  2⤵
  PID:3136
- - C:\Windows\system32\taskkill.exe
    taskkill /F /T /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:2628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
  2⤵
  PID:4908
- - C:\Windows\system32\taskkill.exe
    taskkill /F /T /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:5656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"
  2⤵
  PID:5100
- - C:\Windows\system32\taskkill.exe
    taskkill /IM EpicGamesLauncher.exe /F
    3⤵
    - Kills process with taskkill
    PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
  2⤵
  PID:4984
- - C:\Windows\system32\taskkill.exe
    taskkill /IM javaw.exe /F
    3⤵
    - Kills process with taskkill
    PID:4728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
  2⤵
  PID:1080
- - C:\Windows\system32\taskkill.exe
    taskkill /IM Steam.exe /F
    3⤵
    - Kills process with taskkill
    PID:3108

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4292

C:\Users\Admin\Desktop\Kameta\KametaV14.exe
"C:\Users\Admin\Desktop\Kameta\KametaV14.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  PID:3788
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:5336
- C:\Users\Admin\Desktop\Kameta\KametaV14.exe
  "C:\Users\Admin\Desktop\Kameta\KametaV14.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1804,i,391590787170545781,1639601754278097876,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:216
- C:\Users\Admin\Desktop\Kameta\KametaV14.exe
  "C:\Users\Admin\Desktop\Kameta\KametaV14.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=1992 --field-trial-handle=1804,i,391590787170545781,1639601754278097876,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:5980
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where /r . cookies.sqlite"
  2⤵
  PID:116
- - C:\Windows\system32\where.exe
    where /r . cookies.sqlite
    3⤵
    PID:3124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4540
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1196
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:2416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ffde1e4cc40,0x7ffde1e4cc4c,0x7ffde1e4cc58
    3⤵
    PID:4192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2056,i,9400270045745194007,14852754014496016307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2052 /prefetch:2
    3⤵
    PID:1712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1864,i,9400270045745194007,14852754014496016307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2196 /prefetch:3
    3⤵
    PID:5436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2340,i,9400270045745194007,14852754014496016307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2176 /prefetch:8
    3⤵
    PID:2712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3236,i,9400270045745194007,14852754014496016307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3268,i,9400270045745194007,14852754014496016307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4420,i,9400270045745194007,14852754014496016307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4528 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4644,i,9400270045745194007,14852754014496016307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4648 /prefetch:8
    3⤵
    PID:2528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4756,i,9400270045745194007,14852754014496016307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4772 /prefetch:8
    3⤵
    PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd2e046f8,0x7ffdd2e04708,0x7ffdd2e04718
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,10166324332558929681,8773815410635206280,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
    3⤵
    PID:876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,10166324332558929681,8773815410635206280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,10166324332558929681,8773815410635206280,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2148,10166324332558929681,8773815410635206280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2148,10166324332558929681,8773815410635206280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2148,10166324332558929681,8773815410635206280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2148,10166324332558929681,8773815410635206280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4384
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2544
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:5672
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
  2⤵
  PID:1680
- - C:\Windows\system32\taskkill.exe
    taskkill /F /T /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:4356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
  2⤵
  PID:2116
- - C:\Windows\system32\taskkill.exe
    taskkill /F /T /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:1736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
  2⤵
  PID:4436
- - C:\Windows\system32\taskkill.exe
    taskkill /F /T /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:5572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
  2⤵
  PID:5840
- - C:\Windows\system32\taskkill.exe
    taskkill /F /T /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:5160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where /r . *.sqlite"
  2⤵
  PID:1496
- - C:\Windows\system32\where.exe
    where /r . *.sqlite
    3⤵
    PID:4752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:5336
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
  2⤵
  PID:1584
- - C:\Windows\system32\taskkill.exe
    taskkill /F /T /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:2456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
  2⤵
  PID:3884
- - C:\Windows\system32\taskkill.exe
    taskkill /F /T /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:3716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
  2⤵
  PID:3348
- - C:\Windows\system32\taskkill.exe
    taskkill /F /T /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:5064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"
  2⤵
  PID:6112
- - C:\Windows\system32\taskkill.exe
    taskkill /IM EpicGamesLauncher.exe /F
    3⤵
    - Kills process with taskkill
    PID:4832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
  2⤵
  PID:1216
- - C:\Windows\system32\taskkill.exe
    taskkill /IM javaw.exe /F
    3⤵
    - Kills process with taskkill
    PID:5324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
  2⤵
  PID:2672
- - C:\Windows\system32\taskkill.exe
    taskkill /IM Steam.exe /F
    3⤵
    - Kills process with taskkill
    PID:2596

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4888

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd2e046f8,0x7ffdd2e04708,0x7ffdd2e04718
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10328296496871720746,2129723202781068568,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,10328296496871720746,2129723202781068568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10328296496871720746,2129723202781068568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10328296496871720746,2129723202781068568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,10328296496871720746,2129723202781068568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  PID:3960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

Privilege Escalation

Defense Evasion

Modify Authentication Process

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery