509a1890bf620db2b93c056f891c9077f926ea191d2a63d91ea8ef80f4c52673

Analysis

user interaction
yes
max time kernel
62s
max time network
50s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FyreMC-0.9.6-x64-Setup.exe
Size 105.1MB
Sample260628-1ec5vaew9t
SHA256 509a1890bf620db2b93c056f891c9077f926ea191d2a63d91ea8ef80f4c52673
MD5 08deb36c00feb214222e236440e60b55
SHA1 8f9e4d6dc05eeca77c2deeea7162a9bf68fc9c60
SHA512 a56d2e4a683bcb3d44534234d3b81f1656d1b4ae744b2cd770b494f3667648495a6c7e87112098555e285b18f9023e145bf20b217ee064c634ff59e8abecbb33
SSDEEP 1572864:yM7DOSm7w+x02+lONe9ByecfpRujUhRA4VVSGzmayzqv3arDpPj28i6Rqm5Q8XT8:yMHHvOq0D8UZCzOEBj2NIqCT/oQby
TLSH
T1493833117B95857BF31B68324BE6E69B18653A2BB8F1364B03583757BC33240CB1F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1724	Update.exe
5312	Squirrel.exe
2532	FyreMC.exe
2976	Update.exe
2260	FyreMC.exe
3724	FyreMC.exe
4176	FyreMC.exe
2156	FyreMC.exe
4784	FyreMC.exe
2820	Update.exe
1524	FyreMC.exe

Loads dropped DLL 12 IoCs

pid	Process
2532	FyreMC.exe
2260	FyreMC.exe
3724	FyreMC.exe
4176	FyreMC.exe
2156	FyreMC.exe
3724	FyreMC.exe
3724	FyreMC.exe
3724	FyreMC.exe
3724	FyreMC.exe
3724	FyreMC.exe
4784	FyreMC.exe
1524	FyreMC.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
1	raw.githubusercontent.com

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3808	powershell.exe
2152	powershell.exe
4936	powershell.exe
4740	powershell.exe
2560	powershell.exe
6140	powershell.exe
5264	powershell.exe
6020	powershell.exe
2324	powershell.exe
1400	powershell.exe
5564	powershell.exe
4812	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FyreMC-0.9.6-x64-Setup.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
1724	Update.exe
1724	Update.exe
4740	powershell.exe
4740	powershell.exe
3808	powershell.exe
3808	powershell.exe
5264	powershell.exe
5264	powershell.exe
2152	powershell.exe
2152	powershell.exe
2560	powershell.exe
2560	powershell.exe
6140	powershell.exe
6140	powershell.exe
3808	powershell.exe
4812	powershell.exe
4812	powershell.exe
5264	powershell.exe
2152	powershell.exe
4740	powershell.exe
2560	powershell.exe
6140	powershell.exe
4812	powershell.exe
4936	powershell.exe
4936	powershell.exe
6020	powershell.exe
6020	powershell.exe
4936	powershell.exe
2324	powershell.exe
2324	powershell.exe
6020	powershell.exe
2324	powershell.exe
1400	powershell.exe
1400	powershell.exe
1400	powershell.exe
5564	powershell.exe
5564	powershell.exe
5564	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	Update.exe
Token: SeShutdownPrivilege	2260	FyreMC.exe
Token: SeCreatePagefilePrivilege	2260	FyreMC.exe
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	3808	powershell.exe
Token: SeDebugPrivilege	5264	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	6140	powershell.exe
Token: SeDebugPrivilege	4812	powershell.exe
Token: SeShutdownPrivilege	2260	FyreMC.exe
Token: SeCreatePagefilePrivilege	2260	FyreMC.exe
Token: SeShutdownPrivilege	2260	FyreMC.exe
Token: SeCreatePagefilePrivilege	2260	FyreMC.exe
Token: SeShutdownPrivilege	2260	FyreMC.exe
Token: SeCreatePagefilePrivilege	2260	FyreMC.exe
Token: SeIncreaseQuotaPrivilege	2560	powershell.exe
Token: SeSecurityPrivilege	2560	powershell.exe
Token: SeTakeOwnershipPrivilege	2560	powershell.exe
Token: SeLoadDriverPrivilege	2560	powershell.exe
Token: SeSystemProfilePrivilege	2560	powershell.exe
Token: SeSystemtimePrivilege	2560	powershell.exe
Token: SeProfSingleProcessPrivilege	2560	powershell.exe
Token: SeIncBasePriorityPrivilege	2560	powershell.exe
Token: SeCreatePagefilePrivilege	2560	powershell.exe
Token: SeBackupPrivilege	2560	powershell.exe
Token: SeRestorePrivilege	2560	powershell.exe
Token: SeShutdownPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeSystemEnvironmentPrivilege	2560	powershell.exe
Token: SeRemoteShutdownPrivilege	2560	powershell.exe
Token: SeUndockPrivilege	2560	powershell.exe
Token: SeManageVolumePrivilege	2560	powershell.exe
Token: 33	2560	powershell.exe
Token: 34	2560	powershell.exe
Token: 35	2560	powershell.exe
Token: 36	2560	powershell.exe
Token: SeIncreaseQuotaPrivilege	4740	powershell.exe
Token: SeSecurityPrivilege	4740	powershell.exe
Token: SeTakeOwnershipPrivilege	4740	powershell.exe
Token: SeLoadDriverPrivilege	4740	powershell.exe
Token: SeSystemProfilePrivilege	4740	powershell.exe
Token: SeSystemtimePrivilege	4740	powershell.exe
Token: SeProfSingleProcessPrivilege	4740	powershell.exe
Token: SeIncBasePriorityPrivilege	4740	powershell.exe
Token: SeCreatePagefilePrivilege	4740	powershell.exe
Token: SeBackupPrivilege	4740	powershell.exe
Token: SeRestorePrivilege	4740	powershell.exe
Token: SeShutdownPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeSystemEnvironmentPrivilege	4740	powershell.exe
Token: SeRemoteShutdownPrivilege	4740	powershell.exe
Token: SeUndockPrivilege	4740	powershell.exe
Token: SeManageVolumePrivilege	4740	powershell.exe
Token: 33	4740	powershell.exe
Token: 34	4740	powershell.exe
Token: 35	4740	powershell.exe
Token: 36	4740	powershell.exe
Token: SeShutdownPrivilege	2260	FyreMC.exe
Token: SeCreatePagefilePrivilege	2260	FyreMC.exe
Token: SeShutdownPrivilege	2260	FyreMC.exe
Token: SeCreatePagefilePrivilege	2260	FyreMC.exe
Token: SeShutdownPrivilege	2260	FyreMC.exe
Token: SeCreatePagefilePrivilege	2260	FyreMC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	Update.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 1724	4864	FyreMC-0.9.6-x64-Setup.exe	89
PID 1724 wrote to memory of 5312	1724	Update.exe	90
PID 1724 wrote to memory of 2532	1724	Update.exe	91
PID 2532 wrote to memory of 5032	2532	FyreMC.exe	92
PID 5032 wrote to memory of 5388	5032	cmd.exe	94
PID 2532 wrote to memory of 2976	2532	FyreMC.exe	95
PID 1724 wrote to memory of 2260	1724	Update.exe	96
PID 2260 wrote to memory of 1208	2260	FyreMC.exe	98
PID 1208 wrote to memory of 5596	1208	cmd.exe	100
PID 2260 wrote to memory of 3724	2260	FyreMC.exe	101
PID 2260 wrote to memory of 3724	2260	FyreMC.exe	101
PID 2260 wrote to memory of 4176	2260	FyreMC.exe	102
PID 2260 wrote to memory of 2156	2260	FyreMC.exe	103
PID 2260 wrote to memory of 6140	2260	FyreMC.exe	104
PID 2260 wrote to memory of 2152	2260	FyreMC.exe	105
PID 2260 wrote to memory of 3808	2260	FyreMC.exe	106
PID 2260 wrote to memory of 2560	2260	FyreMC.exe	107
PID 2260 wrote to memory of 4812	2260	FyreMC.exe	108
PID 2260 wrote to memory of 4740	2260	FyreMC.exe	109
PID 2260 wrote to memory of 5264	2260	FyreMC.exe	110
PID 2260 wrote to memory of 1404	2260	FyreMC.exe	121
PID 2260 wrote to memory of 6020	2260	FyreMC.exe	123
PID 2260 wrote to memory of 4936	2260	FyreMC.exe	124
PID 2260 wrote to memory of 2324	2260	FyreMC.exe	125
PID 2260 wrote to memory of 3496	2260	FyreMC.exe	129
PID 3496 wrote to memory of 5552	3496	cmd.exe	131
PID 2260 wrote to memory of 2480	2260	FyreMC.exe	132
PID 2480 wrote to memory of 4560	2480	cmd.exe	134
PID 2260 wrote to memory of 1400	2260	FyreMC.exe	135
PID 2260 wrote to memory of 1748	2260	FyreMC.exe	137
PID 1748 wrote to memory of 4828	1748	cmd.exe	139
PID 2260 wrote to memory of 4784	2260	FyreMC.exe	140
PID 2260 wrote to memory of 2820	2260	FyreMC.exe	141
PID 2260 wrote to memory of 1524	2260	FyreMC.exe	142
PID 1524 wrote to memory of 5424	1524	FyreMC.exe	143
PID 5424 wrote to memory of 6076	5424	cmd.exe	145
PID 1524 wrote to memory of 5564	1524	FyreMC.exe	146

C:\Users\Admin\AppData\Local\Temp\FyreMC-0.9.6-x64-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\FyreMC-0.9.6-x64-Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\Squirrel.exe
    "C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    PID:5312
- - C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\FyreMC.exe
    "C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\FyreMC.exe" --squirrel-install 0.9.6
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5032
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:5388
  - - C:\Users\Admin\AppData\Local\fyremc-client\Update.exe
      C:\Users\Admin\AppData\Local\fyremc-client\Update.exe --createShortcut=FyreMC.exe
      4⤵
      Executes dropped EXE
      PID:2976
- - C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\FyreMC.exe
    "C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\FyreMC.exe" --squirrel-firstrun
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1208
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:5596
  - - C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\FyreMC.exe
      "C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\FyreMC.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\FyreMC" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1464 --field-trial-handle=1656,i,4325236963001937822,10151800106067234718,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3724
  - - C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\FyreMC.exe
      "C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\FyreMC.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\FyreMC" --mojo-platform-channel-handle=1960 --field-trial-handle=1656,i,4325236963001937822,10151800106067234718,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4176
  - - C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\FyreMC.exe
      "C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\FyreMC.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\FyreMC" --app-user-model-id=com.squirrel.fyremc-client.FyreMC --app-path="C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2204 --field-trial-handle=1656,i,4325236963001937822,10151800106067234718,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5264
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
      4⤵
      PID:1404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3496
    - - C:\Windows\system32\findstr.exe
        
        findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
        5⤵
        
        PID:5552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2480
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        
        PID:4560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1748
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        
        PID:4828
  - - C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\FyreMC.exe
      "C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\FyreMC.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\FyreMC" --app-user-model-id=com.squirrel.fyremc-client.FyreMC --app-path="C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3312 --field-trial-handle=1656,i,4325236963001937822,10151800106067234718,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4784
  - - C:\Users\Admin\AppData\Local\fyremc-client\Update.exe
      C:\Users\Admin\AppData\Local\fyremc-client\Update.exe --checkForUpdate https://auth.fyremc.hu/game/v2/launcher/win32/x64
      4⤵
      Executes dropped EXE
      PID:2820
  - - C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\FyreMC.exe
      "C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\FyreMC.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\FyreMC" --app-user-model-id=com.squirrel.fyremc-client.FyreMC --app-path="C:\Users\Admin\AppData\Local\fyremc-client\app-0.9.6\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2436 --field-trial-handle=1656,i,4325236963001937822,10151800106067234718,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "chcp"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5424
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:6076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...