b3a40a38e3168bb9c39aa51214d046d35f824bea354ec75295c36d7a26fbac2e

pid	Process
2400	chrome.exe
4396	chrome.exe
4484	chrome.exe
2416	chrome.exe
4320	chrome.exe
5248	chrome.exe
2932	chrome.exe
908	chrome.exe
5520	chrome.exe
1312	chrome.exe
2380	chrome.exe
2776	chrome.exe
5128	chrome.exe
5876	chrome.exe
2704	chrome.exe
2096	chrome.exe
2304	chrome.exe
3824	chrome.exe
3180	chrome.exe
120	chrome.exe
2932	chrome.exe
3916	chrome.exe
5308	chrome.exe
4948	chrome.exe
6076	chrome.exe
4584	chrome.exe
200	chrome.exe
992	chrome.exe
3720	chrome.exe
2172	chrome.exe
3168	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
1256	warden.exe
5908	warden.exe
5556	pilot.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Flotilla = "\"C:\\Users\\Admin\\AppData\\Local\\Flotilla\\current\\warden.exe\""	2026-08-17_077124b02fa726423c86b0ab4960553a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3000	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2316	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-17_077124b02fa726423c86b0ab4960553a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-17_077124b02fa726423c86b0ab4960553a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3832	chrome.exe
2848	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pilot.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pilot.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	pilot.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	pilot.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

defense_evasion spyware trojan

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4748	taskkill.exe
3412	taskkill.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314808976226042"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies system certificate store 2 TTPs 1 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-08-17_077124b02fa726423c86b0ab4960553a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4928	powershell.exe
4928	powershell.exe
5556	pilot.exe
5556	pilot.exe
4396	chrome.exe
4396	chrome.exe
4948	chrome.exe
4948	chrome.exe
4352	chrome.exe
4352	chrome.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4396	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4396	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4948	chrome.exe
4948	chrome.exe
4396	chrome.exe
4396	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeIncreaseQuotaPrivilege	4928	powershell.exe
Token: SeSecurityPrivilege	4928	powershell.exe
Token: SeTakeOwnershipPrivilege	4928	powershell.exe
Token: SeLoadDriverPrivilege	4928	powershell.exe
Token: SeSystemProfilePrivilege	4928	powershell.exe
Token: SeSystemtimePrivilege	4928	powershell.exe
Token: SeProfSingleProcessPrivilege	4928	powershell.exe
Token: SeIncBasePriorityPrivilege	4928	powershell.exe
Token: SeCreatePagefilePrivilege	4928	powershell.exe
Token: SeBackupPrivilege	4928	powershell.exe
Token: SeRestorePrivilege	4928	powershell.exe
Token: SeShutdownPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeSystemEnvironmentPrivilege	4928	powershell.exe
Token: SeRemoteShutdownPrivilege	4928	powershell.exe
Token: SeUndockPrivilege	4928	powershell.exe
Token: SeManageVolumePrivilege	4928	powershell.exe
Token: 33	4928	powershell.exe
Token: 34	4928	powershell.exe
Token: 35	4928	powershell.exe
Token: 36	4928	powershell.exe
Token: SeDebugPrivilege	3412	taskkill.exe
Token: SeDebugPrivilege	4748	taskkill.exe
Token: SeDebugPrivilege	3000	tasklist.exe
Token: SeDebugPrivilege	5556	pilot.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4396	chrome.exe
4948	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 4928	1548	2026-08-17_077124b02fa726423c86b0ab4960553a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 1548 wrote to memory of 3412	1548	2026-08-17_077124b02fa726423c86b0ab4960553a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 1548 wrote to memory of 4748	1548	2026-08-17_077124b02fa726423c86b0ab4960553a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	95
PID 1548 wrote to memory of 3000	1548	2026-08-17_077124b02fa726423c86b0ab4960553a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	97
PID 1548 wrote to memory of 2316	1548	2026-08-17_077124b02fa726423c86b0ab4960553a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	99
PID 1548 wrote to memory of 5908	1548	2026-08-17_077124b02fa726423c86b0ab4960553a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	103
PID 5908 wrote to memory of 5556	5908	warden.exe	104
PID 5556 wrote to memory of 4396	5556	pilot.exe	105
PID 4396 wrote to memory of 4316	4396	chrome.exe	106
PID 4396 wrote to memory of 4800	4396	chrome.exe	107
PID 4396 wrote to memory of 4800	4396	chrome.exe	107
PID 4396 wrote to memory of 3832	4396	chrome.exe	108
PID 4396 wrote to memory of 600	4396	chrome.exe	109
PID 4396 wrote to memory of 600	4396	chrome.exe	109
PID 4396 wrote to memory of 3180	4396	chrome.exe	111
PID 4396 wrote to memory of 3180	4396	chrome.exe	111
PID 4396 wrote to memory of 3916	4396	chrome.exe	112
PID 4396 wrote to memory of 3916	4396	chrome.exe	112
PID 4396 wrote to memory of 5308	4396	chrome.exe	113
PID 4396 wrote to memory of 4484	4396	chrome.exe	114
PID 4396 wrote to memory of 5308	4396	chrome.exe	113
PID 4396 wrote to memory of 4484	4396	chrome.exe	114
PID 4396 wrote to memory of 2380	4396	chrome.exe	115
PID 4396 wrote to memory of 2380	4396	chrome.exe	115
PID 4396 wrote to memory of 2704	4396	chrome.exe	116
PID 4396 wrote to memory of 2704	4396	chrome.exe	116
PID 4396 wrote to memory of 120	4396	chrome.exe	121
PID 4396 wrote to memory of 120	4396	chrome.exe	121
PID 4396 wrote to memory of 4868	4396	chrome.exe	122
PID 5556 wrote to memory of 4948	5556	pilot.exe	125
PID 4948 wrote to memory of 5732	4948	chrome.exe	126
PID 4948 wrote to memory of 2916	4948	chrome.exe	127
PID 4948 wrote to memory of 2848	4948	chrome.exe	128
PID 4948 wrote to memory of 2916	4948	chrome.exe	127
PID 4948 wrote to memory of 4372	4948	chrome.exe	129
PID 4948 wrote to memory of 4372	4948	chrome.exe	129
PID 4948 wrote to memory of 2096	4948	chrome.exe	131
PID 4948 wrote to memory of 3720	4948	chrome.exe	130
PID 4948 wrote to memory of 2096	4948	chrome.exe	131
PID 4948 wrote to memory of 3720	4948	chrome.exe	130
PID 4948 wrote to memory of 2304	4948	chrome.exe	133
PID 4948 wrote to memory of 2932	4948	chrome.exe	132
PID 4948 wrote to memory of 2304	4948	chrome.exe	133
PID 4948 wrote to memory of 2932	4948	chrome.exe	132
PID 4948 wrote to memory of 2172	4948	chrome.exe	134
PID 4948 wrote to memory of 2172	4948	chrome.exe	134
PID 4948 wrote to memory of 3824	4948	chrome.exe	135
PID 4948 wrote to memory of 3824	4948	chrome.exe	135
PID 4396 wrote to memory of 5128	4396	chrome.exe	140
PID 4396 wrote to memory of 5128	4396	chrome.exe	140
PID 4948 wrote to memory of 3704	4948	chrome.exe	141
PID 4396 wrote to memory of 2168	4396	chrome.exe	142
PID 4396 wrote to memory of 688	4396	chrome.exe	143
PID 4396 wrote to memory of 2412	4396	chrome.exe	144
PID 4948 wrote to memory of 2416	4948	chrome.exe	145
PID 4948 wrote to memory of 2416	4948	chrome.exe	145
PID 4948 wrote to memory of 2928	4948	chrome.exe	146
PID 4948 wrote to memory of 2928	4948	chrome.exe	146
PID 4948 wrote to memory of 6076	4948	chrome.exe	147
PID 4948 wrote to memory of 6076	4948	chrome.exe	147
PID 4948 wrote to memory of 4320	4948	chrome.exe	148
PID 4948 wrote to memory of 4320	4948	chrome.exe	148
PID 4948 wrote to memory of 3168	4948	chrome.exe	149
PID 4948 wrote to memory of 3168	4948	chrome.exe	149

C:\Users\Admin\AppData\Local\Temp\2026-08-17_077124b02fa726423c86b0ab4960553a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_077124b02fa726423c86b0ab4960553a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Adds Run key to start application
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Flotilla' -ErrorAction Stop; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\flotilla-profiles' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess 'warden.exe','pilot.exe' -ErrorAction SilentlyContinue; Write-Output 'EXCLUSION_OK' } catch { Write-Output ('EXCLUSION_FAIL: ' + $_.Exception.Message) }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4928
- C:\Windows\system32\taskkill.exe
  taskkill /F /T /IM warden.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3412
- C:\Windows\system32\taskkill.exe
  taskkill /F /T /IM pilot.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4748
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq warden.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3000
- C:\Windows\system32\cmd.exe
  cmd /c mklink /J C:\Users\Admin\AppData\Local\Flotilla\current C:\Users\Admin\AppData\Local\Flotilla\versions\1.6.9
  2⤵
  - Executes a command shell one-liner
  PID:2316
- C:\Users\Admin\AppData\Local\Flotilla\current\warden.exe
  C:\Users\Admin\AppData\Local\Flotilla\current\warden.exe --root C:\Users\Admin\AppData\Local\Flotilla
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5908
- - C:\Users\Admin\AppData\Local\Flotilla\current\pilot.exe
    C:\Users\Admin\AppData\Local\Flotilla\current\pilot.exe
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5556
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-popup-blocking --metrics-recording-only --disable-breakpad --autoplay-policy=no-user-gesture-required --enable-zero-copy "--user-agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --no-first-run --mute-audio --disable-hang-monitor --disable-renderer-backgrounding --enable-automation --disable-client-side-phishing-detection --disable-extensions --disable-features=site-per-process,Translate,BlinkGenPropertyTrees,CalculateNativeWinOcclusion,Vulkan --disable-prompt-on-repost --use-mock-keychain --user-data-dir=C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast --enable-gpu-rasterization --disable-sync --no-default-browser-check --disable-default-apps --disable-ipc-flooding-protection --force-color-profile=srgb --window-size=854,480 --ignore-gpu-blocklist --disable-backgrounding-occluded-windows --disable-background-timer-throttling --password-store=basic --disable-blink-features=AutomationControlled --safebrowsing-disable-auto-update --headless=new --hide-scrollbars --disable-background-networking --enable-features=NetworkService,NetworkServiceInProcess --disable-dev-shm-usage --remote-debugging-port=0 about:blank
      4⤵
      Uses browser remote debugging
      Checks SCSI registry key(s)
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4396
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffed203c728,0x7ffed203c734,0x7ffed203c740
        5⤵
        
        PID:4316
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-breakpad --enable-gpu-rasterization --headless=new --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAYAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=1780 /prefetch:2
        5⤵
        
        PID:4800
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --force-high-res-timeticks=disabled --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3832
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --force-high-res-timeticks=disabled --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:13
        5⤵
        
        PID:600
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3180
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3916
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5308
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:9
        5⤵
        Uses browser remote debugging
        
        PID:4484
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:9
        5⤵
        Uses browser remote debugging
        
        PID:2380
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2704
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:120
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --video-capture-use-gpu-memory-buffer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --force-high-res-timeticks=disabled --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
        5⤵
        
        PID:4868
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5128
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --video-capture-use-gpu-memory-buffer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --force-high-res-timeticks=disabled --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
        5⤵
        
        PID:2168
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --video-capture-use-gpu-memory-buffer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --force-high-res-timeticks=disabled --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
        5⤵
        
        PID:688
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --video-capture-use-gpu-memory-buffer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --force-high-res-timeticks=disabled --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
        5⤵
        
        PID:2412
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4584
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=media.mojom.CdmServiceBroker --lang=en-US --service-sandbox-type=cdm --mute-audio --video-capture-use-gpu-memory-buffer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --force-high-res-timeticks=disabled --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
        5⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4616
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5248
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5520
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2932
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2400
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mute-audio --video-capture-use-gpu-memory-buffer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --force-high-res-timeticks=disabled --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:12
        5⤵
        
        PID:5332
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5876
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --disable-breakpad --enable-gpu-rasterization --headless=new --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-poast" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAYAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1784,i,10386048211593097373,15863622494269998318,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4352
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-color-profile=srgb --metrics-recording-only --password-store=basic --window-size=854,480 --mute-audio --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-features=site-per-process,Translate,BlinkGenPropertyTrees,CalculateNativeWinOcclusion,Vulkan --disable-prompt-on-repost --enable-zero-copy --hide-scrollbars --disable-background-networking --disable-background-timer-throttling --disable-breakpad --disable-hang-monitor --disable-renderer-backgrounding "--user-agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --disable-default-apps --disable-sync --enable-automation --disable-dev-shm-usage --disable-ipc-flooding-protection --user-data-dir=C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical --no-first-run --autoplay-policy=no-user-gesture-required --ignore-gpu-blocklist --no-default-browser-check --disable-extensions --disable-popup-blocking --safebrowsing-disable-auto-update --disable-blink-features=AutomationControlled --enable-gpu-rasterization --enable-features=NetworkService,NetworkServiceInProcess --use-mock-keychain --headless=new --remote-debugging-port=0 about:blank
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffed203c728,0x7ffed203c734,0x7ffed203c740
        5⤵
        
        PID:5732
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-breakpad --enable-gpu-rasterization --headless=new --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAYAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:2
        5⤵
        
        PID:2916
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2848
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --force-high-res-timeticks=disabled --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:13
        5⤵
        
        PID:4372
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2096
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2932
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:9
        5⤵
        Uses browser remote debugging
        
        PID:2304
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:9
        5⤵
        Uses browser remote debugging
        
        PID:2172
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3824
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --video-capture-use-gpu-memory-buffer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --force-high-res-timeticks=disabled --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
        5⤵
        
        PID:3704
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2416
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=media.mojom.CdmServiceBroker --lang=en-US --service-sandbox-type=cdm --mute-audio --video-capture-use-gpu-memory-buffer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --force-high-res-timeticks=disabled --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:14
        5⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2928
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6076
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4320
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3168
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --video-capture-use-gpu-memory-buffer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --force-high-res-timeticks=disabled --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
        5⤵
        
        PID:256
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --video-capture-use-gpu-memory-buffer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --force-high-res-timeticks=disabled --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
        5⤵
        
        PID:2996
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --video-capture-use-gpu-memory-buffer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --force-high-res-timeticks=disabled --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
        5⤵
        
        PID:4532
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2776
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:200
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:992
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:908
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1312
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mute-audio --video-capture-use-gpu-memory-buffer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-seroxxoffical" --force-high-res-timeticks=disabled --field-trial-handle=1980,i,5628974956843350054,7558261702338251771,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:12
        5⤵
        
        PID:2700

C:\Users\Admin\AppData\Local\Flotilla\current\warden.exe
"C:\Users\Admin\AppData\Local\Flotilla\current\warden.exe"
1⤵
- Executes dropped EXE
PID:1256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Authentication Process

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Modify Authentication Process

Steal Web Session Cookie

T1539

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery