f3d84f67065f746d9236b8f5507e7ba60403f59129719f7df95bac5a3ca44ae0

Analysis

user interaction
yes
max time kernel
74s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 21:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UI.exe
Size 16.4MB
Sample260629-1a8e7agy2j
SHA256 f3d84f67065f746d9236b8f5507e7ba60403f59129719f7df95bac5a3ca44ae0
MD5 a2b6b7198b6699f866a745c8ba55c2c1
SHA1 ab063e32b77137604c214916dffce1b5a3871cd5
SHA512 c158333918433e47c3c08901034b85ba99894ee37a719520c358618d74555f0bc19af2c2f274a6f4005a56d42a814ee804d8e684191084c46437e78ec751fff5
SSDEEP 196608:5sC0dlkPaQbao2Faaya8l0S7oo3TwhRCuMqoW:l0d0uFaayFso3TwhRX
TLSH
T1A30706257B5A996DC05AC4B4834B8B72497130DB0B39B9FF449492382F6EBF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
6392	UI.exe
796	lsp.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UI.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
23	raw.githubusercontent.com
52	raw.githubusercontent.com
53	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 43 IoCs

discovery

Process Discovery

T1057

pid	Process
4928	tasklist.exe
6012	tasklist.exe
5284	tasklist.exe
4284	tasklist.exe
3856	tasklist.exe
2760	tasklist.exe
3912	tasklist.exe
6120	tasklist.exe
2144	tasklist.exe
4080	tasklist.exe
1564	tasklist.exe
5640	tasklist.exe
1936	tasklist.exe
4420	tasklist.exe
5176	tasklist.exe
2756	tasklist.exe
1308	tasklist.exe
7052	tasklist.exe
3696	tasklist.exe
1088	tasklist.exe
4560	tasklist.exe
6764	tasklist.exe
6168	tasklist.exe
5392	tasklist.exe
4736	tasklist.exe
5788	tasklist.exe
5848	tasklist.exe
2996	tasklist.exe
6568	tasklist.exe
6800	tasklist.exe
4828	tasklist.exe
580	tasklist.exe
7052	tasklist.exe
4672	tasklist.exe
1388	tasklist.exe
1936	tasklist.exe
6436	tasklist.exe
3756	tasklist.exe
5068	tasklist.exe
5984	tasklist.exe
7148	tasklist.exe
7072	tasklist.exe
4228	tasklist.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 64 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
6296	powershell.exe
4660	powershell.exe
6880	powershell.exe
2592	powershell.exe
2448	powershell.exe
5600	powershell.exe
1236	powershell.exe
5052	powershell.exe
3052	powershell.exe
2516	powershell.exe
6792	powershell.exe
4792	powershell.exe
2532	powershell.exe
1352	powershell.exe
1212	powershell.exe
5924	powershell.exe
1688	powershell.exe
5804	powershell.exe
1724	powershell.exe
2172	powershell.exe
4952	powershell.exe
5488	powershell.exe
6136	powershell.exe
5672	powershell.exe
6136	powershell.exe
6440	powershell.exe
4852	powershell.exe
4600	powershell.exe
1508	powershell.exe
6192	powershell.exe
6932	powershell.exe
1860	powershell.exe
5640	powershell.exe
3604	powershell.exe
2924	powershell.exe
4452	powershell.exe
5404	powershell.exe
7144	powershell.exe
992	powershell.exe
6536	powershell.exe
6716	powershell.exe
3904	powershell.exe
836	powershell.exe
812	powershell.exe
6812	powershell.exe
1340	powershell.exe
2516	powershell.exe
6040	powershell.exe
5488	powershell.exe
6200	powershell.exe
4620	powershell.exe
5640	powershell.exe
3220	powershell.exe
7072	powershell.exe
6140	powershell.exe
5392	powershell.exe
572	powershell.exe
4356	powershell.exe
4624	powershell.exe
6932	powershell.exe
2420	powershell.exe
7096	powershell.exe
6268	powershell.exe
6268	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2272	PING.EXE

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3644	netstat.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4576	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3644	netstat.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
2644	taskkill.exe
5512	taskkill.exe
3516	taskkill.exe
6488	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2272	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4660	powershell.exe
4660	powershell.exe
1212	powershell.exe
1212	powershell.exe
1212	powershell.exe
6796	powershell.exe
6796	powershell.exe
6796	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
836	powershell.exe
836	powershell.exe
836	powershell.exe
6040	powershell.exe
6040	powershell.exe
6040	powershell.exe
4624	powershell.exe
4624	powershell.exe
4624	powershell.exe
6932	powershell.exe
6932	powershell.exe
6932	powershell.exe
2420	powershell.exe
2420	powershell.exe
2420	powershell.exe
4452	powershell.exe
4452	powershell.exe
6572	powershell.exe
6572	powershell.exe
6192	powershell.exe
6192	powershell.exe
6192	powershell.exe
5404	powershell.exe
5404	powershell.exe
5404	powershell.exe
3464	chrome.exe
3464	chrome.exe
2328	powershell.exe
2328	powershell.exe
2328	powershell.exe
5392	powershell.exe
5392	powershell.exe
5392	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
6136	powershell.exe
6136	powershell.exe
6136	powershell.exe
6932	powershell.exe
6932	powershell.exe
6932	powershell.exe
5052	powershell.exe
5052	powershell.exe
5052	powershell.exe
6520	powershell.exe
6520	powershell.exe
6520	powershell.exe
2276	powershell.exe
2276	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3984	msedgewebview2.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
5964	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4420	tasklist.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeIncreaseQuotaPrivilege	4660	powershell.exe
Token: SeSecurityPrivilege	4660	powershell.exe
Token: SeTakeOwnershipPrivilege	4660	powershell.exe
Token: SeLoadDriverPrivilege	4660	powershell.exe
Token: SeSystemProfilePrivilege	4660	powershell.exe
Token: SeSystemtimePrivilege	4660	powershell.exe
Token: SeProfSingleProcessPrivilege	4660	powershell.exe
Token: SeIncBasePriorityPrivilege	4660	powershell.exe
Token: SeCreatePagefilePrivilege	4660	powershell.exe
Token: SeBackupPrivilege	4660	powershell.exe
Token: SeRestorePrivilege	4660	powershell.exe
Token: SeShutdownPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeSystemEnvironmentPrivilege	4660	powershell.exe
Token: SeRemoteShutdownPrivilege	4660	powershell.exe
Token: SeUndockPrivilege	4660	powershell.exe
Token: SeManageVolumePrivilege	4660	powershell.exe
Token: 33	4660	powershell.exe
Token: 34	4660	powershell.exe
Token: 35	4660	powershell.exe
Token: 36	4660	powershell.exe
Token: SeDebugPrivilege	3644	netstat.exe
Token: SeDebugPrivilege	580	tasklist.exe
Token: SeDebugPrivilege	1088	tasklist.exe
Token: SeDebugPrivilege	5176	tasklist.exe
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeIncreaseQuotaPrivilege	1212	powershell.exe
Token: SeSecurityPrivilege	1212	powershell.exe
Token: SeTakeOwnershipPrivilege	1212	powershell.exe
Token: SeLoadDriverPrivilege	1212	powershell.exe
Token: SeSystemProfilePrivilege	1212	powershell.exe
Token: SeSystemtimePrivilege	1212	powershell.exe
Token: SeProfSingleProcessPrivilege	1212	powershell.exe
Token: SeIncBasePriorityPrivilege	1212	powershell.exe
Token: SeCreatePagefilePrivilege	1212	powershell.exe
Token: SeBackupPrivilege	1212	powershell.exe
Token: SeRestorePrivilege	1212	powershell.exe
Token: SeShutdownPrivilege	1212	powershell.exe
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeSystemEnvironmentPrivilege	1212	powershell.exe
Token: SeRemoteShutdownPrivilege	1212	powershell.exe
Token: SeUndockPrivilege	1212	powershell.exe
Token: SeManageVolumePrivilege	1212	powershell.exe
Token: 33	1212	powershell.exe
Token: 34	1212	powershell.exe
Token: 35	1212	powershell.exe
Token: 36	1212	powershell.exe
Token: SeDebugPrivilege	2644	taskkill.exe
Token: SeDebugPrivilege	6796	powershell.exe
Token: SeIncreaseQuotaPrivilege	6796	powershell.exe
Token: SeSecurityPrivilege	6796	powershell.exe
Token: SeTakeOwnershipPrivilege	6796	powershell.exe
Token: SeLoadDriverPrivilege	6796	powershell.exe
Token: SeSystemProfilePrivilege	6796	powershell.exe
Token: SeSystemtimePrivilege	6796	powershell.exe
Token: SeProfSingleProcessPrivilege	6796	powershell.exe
Token: SeIncBasePriorityPrivilege	6796	powershell.exe
Token: SeCreatePagefilePrivilege	6796	powershell.exe
Token: SeBackupPrivilege	6796	powershell.exe
Token: SeRestorePrivilege	6796	powershell.exe
Token: SeShutdownPrivilege	6796	powershell.exe
Token: SeDebugPrivilege	6796	powershell.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
5004	UI.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
6392	UI.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4420	5004	UI.exe	88
PID 5004 wrote to memory of 4660	5004	UI.exe	91
PID 5004 wrote to memory of 3644	5004	UI.exe	93
PID 5004 wrote to memory of 3984	5004	UI.exe	95
PID 3984 wrote to memory of 6552	3984	msedgewebview2.exe	96
PID 3984 wrote to memory of 2324	3984	msedgewebview2.exe	97
PID 3984 wrote to memory of 2324	3984	msedgewebview2.exe	97
PID 3984 wrote to memory of 2324	3984	msedgewebview2.exe	97
PID 3984 wrote to memory of 2324	3984	msedgewebview2.exe	97
PID 3984 wrote to memory of 7104	3984	msedgewebview2.exe	98
PID 3984 wrote to memory of 5736	3984	msedgewebview2.exe	99
PID 3984 wrote to memory of 5736	3984	msedgewebview2.exe	99
PID 3984 wrote to memory of 5736	3984	msedgewebview2.exe	99
PID 3984 wrote to memory of 4200	3984	msedgewebview2.exe	100
PID 3984 wrote to memory of 4200	3984	msedgewebview2.exe	100
PID 3984 wrote to memory of 4200	3984	msedgewebview2.exe	100
PID 3984 wrote to memory of 4200	3984	msedgewebview2.exe	100
PID 3984 wrote to memory of 4200	3984	msedgewebview2.exe	100
PID 5004 wrote to memory of 580	5004	UI.exe	101
PID 5004 wrote to memory of 1432	5004	UI.exe	103
PID 5004 wrote to memory of 1088	5004	UI.exe	105
PID 1432 wrote to memory of 2728	1432	cmd.exe	107
PID 2728 wrote to memory of 2272	2728	cmd.exe	108
PID 2728 wrote to memory of 6392	2728	cmd.exe	109
PID 6392 wrote to memory of 5176	6392	UI.exe	110
PID 6392 wrote to memory of 1212	6392	UI.exe	112
PID 6392 wrote to memory of 2644	6392	UI.exe	114
PID 6392 wrote to memory of 6796	6392	UI.exe	116
PID 6392 wrote to memory of 1236	6392	UI.exe	118
PID 6392 wrote to memory of 4356	6392	UI.exe	120
PID 6392 wrote to memory of 836	6392	UI.exe	122
PID 6392 wrote to memory of 6040	6392	UI.exe	124
PID 6392 wrote to memory of 4624	6392	UI.exe	126
PID 6392 wrote to memory of 6932	6392	UI.exe	160
PID 6392 wrote to memory of 2420	6392	UI.exe	130
PID 6392 wrote to memory of 4452	6392	UI.exe	132
PID 6392 wrote to memory of 6572	6392	UI.exe	134
PID 6392 wrote to memory of 6192	6392	UI.exe	136
PID 6392 wrote to memory of 5404	6392	UI.exe	138
PID 3464 wrote to memory of 3440	3464	chrome.exe	141
PID 3464 wrote to memory of 6268	3464	chrome.exe	212
PID 3464 wrote to memory of 6268	3464	chrome.exe	212
PID 3464 wrote to memory of 4576	3464	chrome.exe	143
PID 3464 wrote to memory of 5956	3464	chrome.exe	145
PID 3464 wrote to memory of 5956	3464	chrome.exe	145
PID 3464 wrote to memory of 6188	3464	chrome.exe	146
PID 3464 wrote to memory of 5984	3464	chrome.exe	147
PID 3464 wrote to memory of 6188	3464	chrome.exe	146
PID 3464 wrote to memory of 5984	3464	chrome.exe	147
PID 6392 wrote to memory of 2328	6392	UI.exe	148
PID 3464 wrote to memory of 2824	3464	chrome.exe	150
PID 3464 wrote to memory of 2824	3464	chrome.exe	150
PID 3464 wrote to memory of 4912	3464	chrome.exe	151
PID 3464 wrote to memory of 4912	3464	chrome.exe	151
PID 3464 wrote to memory of 5424	3464	chrome.exe	152
PID 3464 wrote to memory of 5424	3464	chrome.exe	152
PID 3464 wrote to memory of 5124	3464	chrome.exe	153
PID 3464 wrote to memory of 5124	3464	chrome.exe	153
PID 6392 wrote to memory of 5392	6392	UI.exe	187
PID 6392 wrote to memory of 1352	6392	UI.exe	156
PID 6392 wrote to memory of 6136	6392	UI.exe	158
PID 6392 wrote to memory of 6932	6392	UI.exe	193
PID 6392 wrote to memory of 5052	6392	UI.exe	162
PID 6392 wrote to memory of 6520	6392	UI.exe	164

C:\Users\Admin\AppData\Local\Temp\UI.exe
"C:\Users\Admin\AppData\Local\Temp\UI.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq UI.exe" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4660
- C:\Windows\system32\netstat.exe
  "netstat" -ano -p TCP
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:3644
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5004.2924.17755900414911663399 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView /prefetch:4 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7fff7a4d5fd8,0x7fff7a4d5fe4,0x7fff7a4d5ff0
    3⤵
    PID:6552
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1808 --field-trial-handle=1812,i,9775038956707370238,7270284085783749125,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2224 --field-trial-handle=1812,i,9775038956707370238,7270284085783749125,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:7104
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=1812,i,9775038956707370238,7270284085783749125,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:5736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3484 --field-trial-handle=1812,i,9775038956707370238,7270284085783749125,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd /prefetch:1
    3⤵
    PID:4200
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:580
- C:\Windows\system32\cmd.exe
  "cmd" /c start "" /b C:\Users\Admin\AppData\Local\Temp\cosmic_ui_update.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\cosmic_ui_update.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\UI.exe
      "C:\Users\Admin\AppData\Local\Temp\UI.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:6392
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist" /FI "IMAGENAME eq UI.exe" /FO CSV /NH
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1212
    - - C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /PID 5004
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2644
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6796
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        
        PID:1236
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        
        PID:4356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        
        PID:836
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        
        PID:6040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        
        PID:4624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        
        PID:6932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        
        PID:2420
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        
        PID:4452
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        
        PID:6192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        
        PID:5404
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2328
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        
        PID:5392
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        
        PID:1352
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        
        PID:6136
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        
        PID:6932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        
        PID:5052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2276
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=6392.6548.7781628635041415722 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:5964
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView /prefetch:4 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7fff7a4d5fd8,0x7fff7a4d5fe4,0x7fff7a4d5ff0
        6⤵
        
        PID:4360
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1780,i,3630454078671793677,2133375805655409115,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
        6⤵
        
        PID:4516
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2116 --field-trial-handle=1780,i,3630454078671793677,2133375805655409115,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
        6⤵
        
        PID:5432
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2664 --field-trial-handle=1780,i,3630454078671793677,2133375805655409115,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
        6⤵
        
        PID:5428
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3428 --field-trial-handle=1780,i,3630454078671793677,2133375805655409115,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd /prefetch:1
        6⤵
        
        PID:1460
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=824 --field-trial-handle=1780,i,3630454078671793677,2133375805655409115,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
        6⤵
        
        PID:6464
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:2756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:4952
    - - C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /PID 5004
        5⤵
        Kills process with taskkill
        
        PID:5512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:6268
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:3856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:6440
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5392
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\bin\lsp\lsp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bin\lsp\lsp.exe" lsp --definitions=C:\Users\Admin\AppData\Local\Temp\bin\lsp\globalTypes.d.luau --docs=C:\Users\Admin\AppData\Local\Temp\bin\lsp\docs.json --definitions=C:\Users\Admin\AppData\Local\Temp\bin\lsp\sunc.d.lua --definitions=C:\Users\Admin\AppData\Local\Temp\bin\lsp\synx.d.lua
        5⤵
        Executes dropped EXE
        
        PID:796
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:6932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:3052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:4620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:5640
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:3912
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        
        PID:6296
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:1860
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:6568
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:2516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:4852
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:6800
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:6268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:812
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:6120
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:7096
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        
        PID:6412
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:5068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        
        PID:1192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:3220
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:5284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:5640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        
        PID:1724
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:4284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:6880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        
        PID:1940
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:2144
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:5488
    - - C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /PID 5004
        5⤵
        Kills process with taskkill
        
        PID:3516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        
        PID:3084
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:4560
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        
        PID:840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:6812
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:4828
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        
        PID:476
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:7052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:7144
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:4600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:5924
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:5788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:1688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:992
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:7148
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:5488
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        
        PID:1244
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:4928
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:2924
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:4080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:6536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:7072
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:4672
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:6716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        
        PID:2992
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:1388
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:3604
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:2592
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:6012
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        
        PID:624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:5804
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:1308
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:6136
    - - C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /PID 5004
        5⤵
        Kills process with taskkill
        
        PID:6488
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:3904
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:5848
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:7096
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:1508
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:2996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        
        PID:364
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:1340
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:1936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:1724
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:2172
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:1564
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:5672
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:6792
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:5984
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:6268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:6140
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:6764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        
        PID:2116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        
        PID:2684
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:7052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        
        PID:3392
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:4792
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:5640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:2448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:6200
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:6168
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:2516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:2532
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:5392
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        
        PID:4448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:6296
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:7072
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:5600
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:1936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
        5⤵
        
        PID:5544
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:4228
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist" /FI "PID eq 5004" /FO CSV /NH
        5⤵
        Enumerates processes with tasklist
        
        PID:4736
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:3696
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:6436
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Enumerates processes with tasklist
        
        PID:3756
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa4,0x134,0x7fff73f1c728,0x7fff73f1c734,0x7fff73f1c740
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,12436211596842368197,9094187677165533085,262144 --field-trial-handle=1916,i,12500021803298355775,227913271923350460,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:6268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,14640784091692530521,9717590621733182004,524288 --field-trial-handle=1916,i,12500021803298355775,227913271923350460,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,13180797108246977174,3896993986381775441,524288 --field-trial-handle=1916,i,12500021803298355775,227913271923350460,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:13
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,14137042219130763106,15171056928180907489,2097152 --field-trial-handle=1916,i,12500021803298355775,227913271923350460,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:6188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,15417169817936973856,3006531716405036576,2097152 --field-trial-handle=1916,i,12500021803298355775,227913271923350460,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4604,i,14035288963995758859,17451110621428217872,2097152 --field-trial-handle=1916,i,12500021803298355775,227913271923350460,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4912,i,7894976528418626952,10332364507764872856,524288 --field-trial-handle=1916,i,12500021803298355775,227913271923350460,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5056,i,11696941425690305593,2543327229021165266,524288 --field-trial-handle=1916,i,12500021803298355775,227913271923350460,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,17437369109037044004,16063585769261024399,524288 --field-trial-handle=1916,i,12500021803298355775,227913271923350460,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:5124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f9db8d6c31d863d402009f6458a05366c1d4b839f1094d9c28d9279a46093f96
MD5 ac529f5060d25f4a47e47ea8f8434dc2
SHA1 9186a084b8f0a0b630fafffc97d0856e8e256e1d
SHA512 18ca1b3aa2576d4bcf86b18a28baa2e5589d2302764f80bee6d2817a6c77c12c52a0e7e5461ec677a4c7763a1fcefcb5d1d6d7f61ffe6a8a29ffebad29703bad
TLSH
T171417BB7C3E8897D890156F8AB256F1FCE2E0E18532C3D16C8D4AE1F53E28B2D24054E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 80d61bb77b6d2229dc7052a9bca04c6c6511e3aeee39f149585dcee50fac2dcf
MD5 9ad04768426c8e203c52c6cf28cd4545
SHA1 5d9c2d8deb05382ad47eca1bfb95395d55178e0d
SHA512 745196a3061ef8a64e3e0cb6bebbd6c7ab8fcb0472adec5a7463e25cc1f0fe5f5fb993568fdf971ae774d8ba70e53366445d93440569a67d82a11b2680b5df53
TLSH
T122F00557F6793023607815FF6E047C097579B83103416CF0CE6A412DE1875E70F25017
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 4fe881736ca767bc18888c145fe152201e3a9417d76925659784704afa1ad8ae
MD5 9c8743e637dd5ce3ff0b93da7bf32d29
SHA1 2fe2481866c356a22ef6fa445e061f355b4df03f
SHA512 4365a2d602f01aa08122d05de28a3bcde5de190b758cd2b2d1015a0d48c87b552be8ef4ed0a5e74ed8909457dee2372a0d65d444a4355bd090e0ac51a30d171f
SSDEEP 192:IR2xbSvv77APRp2k90Hsb+WNnSpKUu5YPyIsnAUgR:IR2xWnKX3+wBUdR
TLSH
T1FD22752EA914B97B5CCBD22AFA257793D3F9112135902E44EAFC8A2C16E75CC2217437
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 1f848aa688155e2ab615738bc843daf6b8f14bbe671c3a4a784680704b5380e7
MD5 10ccaaf62ee6d4ec29f4177d6665def8
SHA1 82deee07efabfd40c9390d449016ca562478ffb8
SHA512 f0d1e38a67e09212352a7a9741e55de40141832ee866430ee521bb33e60e4adb2bfb8a3c22df3fb9033e82d440dc9916e6d3230fda7a079502c34422a025808d
SSDEEP 192:eUX4K6qs7KxkXqK4I40pUZNCgVLHrKHfFKslEmbQ8OXzKD/h0+ErUkKN9MbjWFCd:lXj5s7KxkXqKf/pUZNCgVLH2HfgslTOd
TLSH
T13B32E827A88DAE7F0FD8D509D8167F4B6CF5429276680C2856FF9D0803A67CE114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 5fffd05469382319939ec37815109718350a3662fa2d7d9497420bda2e32f05b
MD5 6f012f891f6d8257f17faa5523a65e37
SHA1 7a717aefbd4d163c8dd77cfc12fec45cd6dd933f
SHA512 67978dcfb89db9001c708c18aa8df87e7ff56f606b12909752e357f8435ec7bd0dd73a09b4f5e352b1e75e58abca6bc8d261016df0a7243bf400d4097afa9188
SSDEEP 96:jC6Rd+7S3YGHwmkwufuxZnI8qBmPSl8h4otok58WDZB6GGyvMbFBB151VaCanKC2:jCcsSoGXxZI89iUDj/WNf1anKI5U3d
TLSH
T147C1F935A96DAD335AF6E186F4172A83CEB4219B69509F54DEE90F0C12E70EC2342623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 cec1309d6f85f0400c6356638bb22cdcdd776231f2fe07983c4d1795ffc63836
MD5 a21fe5030b33e64e7c3338181d317303
SHA1 e71b048570e4525cea35830a3190b880fee6a609
SHA512 92ab9264ccf9b3bf51cee2263bd4919231fa9bc21f6e18b6024b6ccf9fae55d07600f2e03e282e2894bfab74b404fff9472728afbf856c385bf6a0f9d38f669a
SSDEEP 96:jC6Wd+7S3YGHwmkwufuxZnI8qBmJRDotok589DZB6GGyvMbP74cfbvpE69v4a:jCFsSoGXxZI8jDUD6/Wn74cfbRE6h
TLSH
T1ADA13A31B869AD3785F5D085B9523F83CE78216BA960AF94DDED1F0C16E71E81302633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download