wannacry | 74faf334cb0bdd3e9dfab8c323d4eb3b9b089bcaadc7dbd639d9aa93a4f6f829

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wbaseltcdk426 = "\"C:\\Users\\Admin\\Desktop\\tasksche.exe\""	reg.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
165	raw.githubusercontent.com
166	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_monitor.PNF	x360ce.exe
File created	C:\Windows\INF\c_volume.PNF	x360ce.exe
File created	C:\Windows\INF\c_processor.PNF	x360ce.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\INF\c_diskdrive.PNF	x360ce.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	SearchUI.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe

Executes dropped EXE 13 IoCs

pid	Process
5172	taskdl.exe
5656	taskdl.exe
1924	taskse.exe
1872	@[email protected]
1016	@[email protected]
5284	@[email protected]
5508	taskdl.exe
6116	taskse.exe
3868	@[email protected]
3792	taskdl.exe
312	taskse.exe
5996	@[email protected]
1920	@[email protected]

Loads dropped DLL 1 IoCs

pid	Process
1604	x360ce.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Checks SCSI registry key(s) 3 TTPs 34 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	x360ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	x360ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	x360ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	x360ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	x360ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	x360ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg	x360ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	x360ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	x360ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 6 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
5784	ipconfig.exe
5612	ipconfig.exe
520	ipconfig.exe
4788	ipconfig.exe
5984	ipconfig.exe
5672	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\GPU	SearchUI.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133641385567758335"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7650"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "11"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "363"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7682"	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "364"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "396"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "363"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	firefox.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
6060	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\P01S0N-main.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
2868	chrome.exe
2868	chrome.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2220	OpenWith.exe
1604	x360ce.exe
3956	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
6036	chrome.exe
6036	chrome.exe
6036	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1604	x360ce.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1604	x360ce.exe
1604	x360ce.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1604	x360ce.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
1604	x360ce.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1604	x360ce.exe
4040	chrome.exe
2336	firefox.exe
2876	OpenWith.exe
2244	OpenWith.exe
2876	OpenWith.exe
2876	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
1872	@[email protected]
1872	@[email protected]
5284	@[email protected]
3868	@[email protected]
5996	@[email protected]
1920	@[email protected]
4448	SearchUI.exe
5936	firefox.exe
4400	firefox.exe
4448	SearchUI.exe
4448	SearchUI.exe
4448	SearchUI.exe
4448	SearchUI.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
5616	firefox.exe
5356	firefox.exe
4580	osk.exe
4580	osk.exe
4580	osk.exe
4580	osk.exe
4580	osk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 3144	2868	chrome.exe	73
PID 2868 wrote to memory of 3144	2868	chrome.exe	73
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 880	2868	chrome.exe	75
PID 2868 wrote to memory of 4540	2868	chrome.exe	76
PID 2868 wrote to memory of 4540	2868	chrome.exe	76
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77
PID 2868 wrote to memory of 2972	2868	chrome.exe	77

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4180	attrib.exe
5908	attrib.exe
1452	attrib.exe

C:\Users\Admin\AppData\Local\Temp\x360ce.exe
"C:\Users\Admin\AppData\Local\Temp\x360ce.exe"
1⤵
- Drops file in Windows directory
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffdeea39758,0x7ffdeea39768,0x7ffdeea39778
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:2
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1820 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2084 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3184 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4404 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4420 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4620 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5260 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5092 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4400 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4536 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4180 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
  2⤵
  PID:168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4660 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:1
  2⤵
  PID:1444

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2164

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\6bb37965cd49445887f2c63636e416e8 /t 2584 /p 1604
1⤵
PID:4208

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4212

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5000
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.0.485774313\1898041861" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1696 -prefsLen 20767 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0e3262f-6fe0-4b85-a2fd-e17ebd3d9f7f} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 1792 1b74fcdc058 gpu
    3⤵
    PID:4992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.1.2028021135\2090226749" -parentBuildID 20221007134813 -prefsHandle 2136 -prefMapHandle 2132 -prefsLen 20848 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db1df5bc-569c-44c5-a075-38734785c0d5} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 2148 1b744c72858 socket
    3⤵
    - Checks processor information in registry
    PID:4640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.2.1132289045\842700985" -childID 1 -isForBrowser -prefsHandle 3020 -prefMapHandle 3016 -prefsLen 20951 -prefMapSize 233414 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e20cee16-48a7-456f-89be-a478a2015fc8} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 3032 1b753cba558 tab
    3⤵
    PID:3196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.3.2090601943\2013075698" -childID 2 -isForBrowser -prefsHandle 3472 -prefMapHandle 3468 -prefsLen 26136 -prefMapSize 233414 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f81cc28b-3478-46b4-831b-16df252b4423} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 3484 1b7525eba58 tab
    3⤵
    PID:2616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.4.447837657\1712616188" -childID 3 -isForBrowser -prefsHandle 4276 -prefMapHandle 4272 -prefsLen 26271 -prefMapSize 233414 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {726167a3-f378-4fdc-82c4-9d06372f3d9c} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 3668 1b754d6c858 tab
    3⤵
    PID:1032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.5.1687032270\1818256804" -childID 4 -isForBrowser -prefsHandle 4772 -prefMapHandle 4796 -prefsLen 26195 -prefMapSize 233414 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {40645668-9643-4c6f-82a4-dac6afb3eca2} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 4776 1b7565a2858 tab
    3⤵
    PID:792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.6.193348506\235102129" -childID 5 -isForBrowser -prefsHandle 4924 -prefMapHandle 4928 -prefsLen 26195 -prefMapSize 233414 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e510d871-bb7b-48b1-a6e0-f88577bf015a} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 4916 1b75484a458 tab
    3⤵
    PID:4316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.7.1265240070\1197505956" -childID 6 -isForBrowser -prefsHandle 5112 -prefMapHandle 5116 -prefsLen 26195 -prefMapSize 233414 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cdeaa4ef-532a-4790-859a-16a28c6412a6} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 4820 1b754849e58 tab
    3⤵
    PID:1912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffdeea39758,0x7ffdeea39768,0x7ffdeea39778
  2⤵
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1528 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:2
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1792 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3148 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4376 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4556 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4680 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4620 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4700 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3020 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5924 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3304 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=6108 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=6036 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5572 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5524 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3028 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5388 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:2
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=944 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=3276 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=3132 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5952 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3076 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
  2⤵
  PID:5280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1120 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=3516 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=3508 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
  2⤵
  PID:5532

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:6100

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap12910:86:7zEvent18992
1⤵
PID:4580

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2876

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2244

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2220
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RANSOMWARE-WANNACRY-2.0-master\README.md
  2⤵
  PID:5304

C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
"C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
PID:5344
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - Views/modifies file attributes
  PID:4180
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:3820
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:5172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 25731719665344.bat
  2⤵
  PID:4980
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - Views/modifies file attributes
  PID:5908
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  PID:1248
- - C:\Users\Admin\Desktop\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5284
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:5508
- C:\Users\Admin\Desktop\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:6116
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "wbaseltcdk426" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
  2⤵
  PID:5928
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "wbaseltcdk426" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:6060
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Users\Admin\Desktop\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5996
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1920

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RANSOMWARE-WANNACRY-2.0-master\@[email protected]
1⤵
PID:5700

C:\Users\Admin\Desktop\taskdl.exe
"C:\Users\Admin\Desktop\taskdl.exe"
1⤵
- Executes dropped EXE
PID:5656

C:\Users\Admin\Desktop\taskse.exe
"C:\Users\Admin\Desktop\taskse.exe"
1⤵
- Executes dropped EXE
PID:1924

C:\Users\Admin\Desktop\@[email protected]
"C:\Users\Admin\Desktop\@[email protected]"
1⤵
- Sets desktop wallpaper using registry
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1872

C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
"C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
1⤵
PID:5492
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - Views/modifies file attributes
  PID:1452
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:5860

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:3956

\??\c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:5448

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4448

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5912
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.0.1233555148\780826971" -parentBuildID 20221007134813 -prefsHandle 1532 -prefMapHandle 1524 -prefsLen 17655 -prefMapSize 231678 -appDir "C:\Program Files\Mozilla Firefox\browser" - {68dbdd4c-0020-4cd2-8c34-0fbfb29e97a7} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 1620 1df3d9fd058 gpu
    3⤵
    PID:5668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.1.1580576845\841084941" -parentBuildID 20221007134813 -prefsHandle 2016 -prefMapHandle 2012 -prefsLen 17700 -prefMapSize 231678 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea13cc80-108e-4b1a-9449-5a6201440da3} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 2028 1df3d62ad58 socket
    3⤵
    - Checks processor information in registry
    PID:5232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.2.609605495\1232018475" -childID 1 -isForBrowser -prefsHandle 3104 -prefMapHandle 3100 -prefsLen 20286 -prefMapSize 231678 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b91adeb-8abe-4a4f-a6a3-1f00b7816712} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 3116 1df40fd4658 tab
    3⤵
    PID:5088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.3.1453997099\245634513" -childID 2 -isForBrowser -prefsHandle 3384 -prefMapHandle 3388 -prefsLen 20408 -prefMapSize 231678 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f6f2c6f-056e-4e8f-b548-08c0846086b8} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 3876 1df42394658 tab
    3⤵
    PID:3600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.4.1758223490\1921953519" -childID 3 -isForBrowser -prefsHandle 3964 -prefMapHandle 3824 -prefsLen 26868 -prefMapSize 231678 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3531730f-22d2-4de6-b285-adc53e6c1dc6} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 3776 1df4228d458 tab
    3⤵
    PID:3492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.5.449070076\2125114288" -parentBuildID 20221007134813 -prefsHandle 4256 -prefMapHandle 4252 -prefsLen 27129 -prefMapSize 231678 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b93bd154-fd13-4b4a-a959-0c0ea9542b20} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 4264 1df432cce58 rdd
    3⤵
    PID:3104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.6.1252147755\876713867" -childID 4 -isForBrowser -prefsHandle 3592 -prefMapHandle 3588 -prefsLen 27457 -prefMapSize 231678 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {764b38e6-902e-4d30-a09f-0313aa7ed961} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 3524 1df3d62b658 tab
    3⤵
    PID:5116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.7.1756787155\895253408" -childID 5 -isForBrowser -prefsHandle 4756 -prefMapHandle 3592 -prefsLen 27496 -prefMapSize 231678 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d0d962d-44be-43c7-94b7-3634941b7d1d} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 3564 1df43f1dc58 tab
    3⤵
    PID:3920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.8.223275292\650091305" -childID 6 -isForBrowser -prefsHandle 4860 -prefMapHandle 4868 -prefsLen 27496 -prefMapSize 231678 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {252ff058-ddbe-4c60-866c-ff5f22d638be} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 4944 1df43f1e258 tab
    3⤵
    PID:4636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.9.1432120203\1835989325" -childID 7 -isForBrowser -prefsHandle 3304 -prefMapHandle 3720 -prefsLen 27496 -prefMapSize 231678 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7220f0cc-4ffe-494e-b2fb-f4e6d778fbf1} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 4836 1df43f1eb58 tab
    3⤵
    PID:5824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffdeea39758,0x7ffdeea39768,0x7ffdeea39778
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1568 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:2
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1788 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1852 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3248 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4352 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3784 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4640 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:8
  2⤵
  PID:5996

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1572

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2680
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  PID:4400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.0.1661125377\1042700566" -parentBuildID 20221007134813 -prefsHandle 1584 -prefMapHandle 1560 -prefsLen 20529 -prefMapSize 233006 -appDir "C:\Program Files\Mozilla Firefox\browser" - {712e4435-501d-42a8-a877-b47a8ba4007a} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 1664 21aa360d258 gpu
    3⤵
    PID:5364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.1.1729119649\1424153627" -parentBuildID 20221007134813 -prefsHandle 1992 -prefMapHandle 1988 -prefsLen 20574 -prefMapSize 233006 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59f1f071-79ba-460b-b911-63b42c65397b} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 2008 21aa3236758 socket
    3⤵
    - Checks processor information in registry
    PID:2804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.2.535189209\1297531834" -childID 1 -isForBrowser -prefsHandle 2744 -prefMapHandle 2740 -prefsLen 21034 -prefMapSize 233006 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbf3a6d5-549b-49ae-a3b0-4795abbb4a02} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 2756 21aa7141258 tab
    3⤵
    PID:4984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.3.1330867050\866264493" -childID 2 -isForBrowser -prefsHandle 3628 -prefMapHandle 3624 -prefsLen 26304 -prefMapSize 233006 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e97722c9-df1c-4d7a-8cef-daf58a5578f4} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 3636 21aa8362758 tab
    3⤵
    PID:4488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.4.1338965945\634951009" -childID 3 -isForBrowser -prefsHandle 3784 -prefMapHandle 3776 -prefsLen 26304 -prefMapSize 233006 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {89fdb167-cf0f-418e-958c-36a707f73004} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 3796 21a98730258 tab
    3⤵
    PID:1560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.5.1520029979\932904861" -childID 4 -isForBrowser -prefsHandle 4556 -prefMapHandle 4552 -prefsLen 26304 -prefMapSize 233006 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2f394cf-b98b-4d67-a5c4-d1615d855c85} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 4568 21aa96fae58 tab
    3⤵
    PID:6012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.6.43867502\1110361879" -childID 5 -isForBrowser -prefsHandle 4736 -prefMapHandle 4740 -prefsLen 26304 -prefMapSize 233006 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {24a1fbdf-e5c6-431b-add6-68a345289e48} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 4600 21aa96fab58 tab
    3⤵
    PID:1520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.7.1337400493\567827467" -childID 6 -isForBrowser -prefsHandle 4908 -prefMapHandle 4912 -prefsLen 26304 -prefMapSize 233006 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {506bb145-62b9-4d4a-99f2-932322d9df9f} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 4404 21aa96fbd58 tab
    3⤵
    PID:5956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.8.137177478\1187661952" -childID 7 -isForBrowser -prefsHandle 5268 -prefMapHandle 5272 -prefsLen 26383 -prefMapSize 233006 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aeeb396d-b30f-4d92-8e51-4b7068fcf025} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 5296 21aaa6b8658 tab
    3⤵
    PID:1852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.9.567647113\836673868" -childID 8 -isForBrowser -prefsHandle 5404 -prefMapHandle 5476 -prefsLen 26823 -prefMapSize 233006 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {76cc159a-d171-4bdd-b113-5825c9d6dd0f} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 5560 21a98765958 tab
    3⤵
    PID:5816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.10.1350503029\863777098" -childID 9 -isForBrowser -prefsHandle 4140 -prefMapHandle 3912 -prefsLen 26823 -prefMapSize 233006 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f0d7344-acca-4304-9078-103b03b84fd6} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 3864 21aab286e58 tab
    3⤵
    PID:4420

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /6
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5488

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\P01S0N-main\Free_internet1.bat"
1⤵
PID:5124
- C:\Windows\system32\ipconfig.exe
  ipconfig /release
  2⤵
  - Gathers network information
  PID:5612
- C:\Windows\system32\choice.exe
  choice /c AB /m "Would you like to Access your internet connection back?Y/N"
  2⤵
  PID:3532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\P01S0N-main\Flash_fund.bat"
1⤵
PID:3492

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\P01S0N-main\Free_internet.bat"
1⤵
PID:3460
- C:\Windows\system32\ipconfig.exe
  ipconfig release
  2⤵
  - Gathers network information
  PID:5784
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:792
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:3544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:5616
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5616.0.1826099739\1513925409" -parentBuildID 20221007134813 -prefsHandle 1524 -prefMapHandle 1512 -prefsLen 20949 -prefMapSize 233105 -appDir "C:\Program Files\Mozilla Firefox\browser" - {05aa9dd7-5bd3-4e91-a304-3e104b9d3468} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" 1616 1f6108fbc58 gpu
      4⤵
      PID:5640
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5616.1.1570809441\1700907766" -parentBuildID 20221007134813 -prefsHandle 1944 -prefMapHandle 1940 -prefsLen 20994 -prefMapSize 233105 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {583cf3b6-8ea9-4b7e-a0fd-7c93766b5093} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" 1956 1f610536d58 socket
      4⤵
      Checks processor information in registry
      PID:2172
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5616.2.1674960688\1841936684" -childID 1 -isForBrowser -prefsHandle 2684 -prefMapHandle 2680 -prefsLen 21455 -prefMapSize 233105 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {88268b77-13fd-466a-b439-907d4f658ddf} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" 2648 1f61095b458 tab
      4⤵
      PID:4272
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5616.3.1873322968\2027596009" -childID 2 -isForBrowser -prefsHandle 3424 -prefMapHandle 3420 -prefsLen 26640 -prefMapSize 233105 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {26d9baa6-4f8f-4769-a4db-36321bc1e488} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" 3436 1f606269058 tab
      4⤵
      PID:1304
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5616.4.570697356\1455198726" -childID 3 -isForBrowser -prefsHandle 3420 -prefMapHandle 3456 -prefsLen 26640 -prefMapSize 233105 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4726343d-ca93-46ac-a92e-3e66ea6bd01e} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" 3648 1f6157e8458 tab
      4⤵
      PID:1156
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5616.5.963943594\1528848301" -childID 4 -isForBrowser -prefsHandle 4452 -prefMapHandle 4480 -prefsLen 26640 -prefMapSize 233105 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8aec3c14-4f03-4df3-b4bf-589a0e185b9f} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" 4468 1f616397158 tab
      4⤵
      PID:5808
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5616.6.877490451\1341674352" -childID 5 -isForBrowser -prefsHandle 4620 -prefMapHandle 4624 -prefsLen 26640 -prefMapSize 233105 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d083c621-2374-419d-9953-4176e67dcf31} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" 4504 1f616398358 tab
      4⤵
      PID:5172
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5616.7.400609363\1552379698" -childID 6 -isForBrowser -prefsHandle 4820 -prefMapHandle 4824 -prefsLen 26640 -prefMapSize 233105 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0041b25-2fb2-42ce-be86-313737779b73} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" 4816 1f616398958 tab
      4⤵
      PID:3204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\P01S0N-main\Flash_fund.bat" "
1⤵
PID:1504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\P01S0N-main\Flash_fund.bat" "
1⤵
PID:4320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\P01S0N-main\Free_internet.bat" "
1⤵
PID:1880
- C:\Windows\system32\ipconfig.exe
  ipconfig release
  2⤵
  - Gathers network information
  PID:520
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:3504
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:2768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:5356
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5356.0.314835269\588030585" -parentBuildID 20221007134813 -prefsHandle 1588 -prefMapHandle 1580 -prefsLen 20949 -prefMapSize 233105 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d5f55ee-36ea-4e36-8adb-9625f65bb8a8} 5356 "\\.\pipe\gecko-crash-server-pipe.5356" 1664 2123a7fe258 gpu
      4⤵
      PID:2376
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5356.1.2124298694\874351349" -parentBuildID 20221007134813 -prefsHandle 1992 -prefMapHandle 1988 -prefsLen 20994 -prefMapSize 233105 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f984e725-9086-4a97-8390-9d876339d2ff} 5356 "\\.\pipe\gecko-crash-server-pipe.5356" 2004 2122f8ddb58 socket
      4⤵
      Checks processor information in registry
      PID:3176
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5356.2.633872863\24402924" -childID 1 -isForBrowser -prefsHandle 2744 -prefMapHandle 2740 -prefsLen 21455 -prefMapSize 233105 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ee81349-8dfa-4a39-90a3-23991b39d4c7} 5356 "\\.\pipe\gecko-crash-server-pipe.5356" 2752 2123e22d958 tab
      4⤵
      PID:2796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell
  2⤵
  PID:4484
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:1624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\P01S0N-main\Free_internet1.bat" "
1⤵
PID:5000
- C:\Windows\system32\ipconfig.exe
  ipconfig /release
  2⤵
  - Gathers network information
  PID:4788
- C:\Windows\system32\choice.exe
  choice /c AB /m "Would you like to Access your internet connection back?Y/N"
  2⤵
  PID:192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\P01S0N-main\Free_internet1.bat" "
1⤵
PID:5004
- C:\Windows\system32\ipconfig.exe
  ipconfig /release
  2⤵
  - Gathers network information
  PID:5984
- C:\Windows\system32\choice.exe
  choice /c AB /m "Would you like to Access your internet connection back?Y/N"
  2⤵
  PID:3124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\P01S0N-main\Free_internet1.bat" "
1⤵
PID:2780
- C:\Windows\system32\ipconfig.exe
  ipconfig /release
  2⤵
  - Gathers network information
  PID:5672
- C:\Windows\system32\choice.exe
  choice /c AB /m "Would you like to Access your internet connection back?Y/N"
  2⤵
  PID:312

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
1⤵
PID:2232

C:\Windows\System32\ATBroker.exe
C:\Windows\System32\ATBroker.exe /start osk
1⤵
PID:3912
- C:\Windows\System32\osk.exe
  "C:\Windows\System32\osk.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4580

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x430
1⤵
PID:3092

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4632
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  PID:6128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6128.0.1576298333\450930571" -parentBuildID 20221007134813 -prefsHandle 1580 -prefMapHandle 1572 -prefsLen 20949 -prefMapSize 233105 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a9d1fce-a5c7-4880-a5db-455e97df92a5} 6128 "\\.\pipe\gecko-crash-server-pipe.6128" 1664 283ed805358 gpu
    3⤵
    PID:5060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6128.1.1084075626\595180151" -parentBuildID 20221007134813 -prefsHandle 1992 -prefMapHandle 1988 -prefsLen 20994 -prefMapSize 233105 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65738d89-62c6-4830-bfd0-bb099799a969} 6128 "\\.\pipe\gecko-crash-server-pipe.6128" 2004 283ed638e58 socket
    3⤵
    - Checks processor information in registry
    PID:3396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6128.2.1111501400\39279096" -childID 1 -isForBrowser -prefsHandle 2724 -prefMapHandle 2720 -prefsLen 21455 -prefMapSize 233105 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f50ffbd-b48d-4b6a-a421-555a3108188c} 6128 "\\.\pipe\gecko-crash-server-pipe.6128" 2736 283f0ef4958 tab
    3⤵
    PID:4056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6128.3.633151706\926257516" -childID 2 -isForBrowser -prefsHandle 3412 -prefMapHandle 3408 -prefsLen 25860 -prefMapSize 233105 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {07210a61-4beb-4e55-a0d4-d53085d8d954} 6128 "\\.\pipe\gecko-crash-server-pipe.6128" 3424 283f23cf358 tab
    3⤵
    PID:5188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6128.4.1838545081\1848505870" -childID 3 -isForBrowser -prefsHandle 3704 -prefMapHandle 3700 -prefsLen 26640 -prefMapSize 233105 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e951e7be-edf6-4ab2-9391-512562cbdb05} 6128 "\\.\pipe\gecko-crash-server-pipe.6128" 3716 283f26f9258 tab
    3⤵
    PID:4944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6128.5.1458149736\2037487769" -childID 4 -isForBrowser -prefsHandle 4572 -prefMapHandle 4568 -prefsLen 26640 -prefMapSize 233105 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d59ebaaf-5d24-4d40-84e4-c9eb3989d6f0} 6128 "\\.\pipe\gecko-crash-server-pipe.6128" 4584 283f3745d58 tab
    3⤵
    PID:1708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6128.6.636396783\32930698" -childID 5 -isForBrowser -prefsHandle 4724 -prefMapHandle 4728 -prefsLen 26640 -prefMapSize 233105 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4009354c-236b-429a-9c90-65ecaff7c26f} 6128 "\\.\pipe\gecko-crash-server-pipe.6128" 4716 283e2b6a558 tab
    3⤵
    PID:3932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6128.7.2039595717\139783142" -childID 6 -isForBrowser -prefsHandle 4928 -prefMapHandle 4932 -prefsLen 26640 -prefMapSize 233105 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e99253e9-520e-491e-858a-9c9837db4658} 6128 "\\.\pipe\gecko-crash-server-pipe.6128" 4920 283f3747e58 tab
    3⤵
    PID:5868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6128.8.1592678531\506324448" -childID 7 -isForBrowser -prefsHandle 5452 -prefMapHandle 5432 -prefsLen 27340 -prefMapSize 233105 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f78bcb88-6a7f-4250-9269-b1662a034b90} 6128 "\\.\pipe\gecko-crash-server-pipe.6128" 5420 283f5e2ab58 tab
    3⤵
    PID:1360

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
1⤵
- Modifies registry class
PID:3112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\test.bat" "
1⤵
PID:968
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4244
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3532
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:3452
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:320
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:5840
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:3940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:1932
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7372
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7380
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:10124
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:12868
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:14364
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:14424
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:17064
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:12604
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:14100
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:15072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:16636
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:21340
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:3628
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:5488
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:8168
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:11592
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:12908
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:14428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:15116
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4556
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7196
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10752
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12664
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:14156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:15240
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2872
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10028
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:3032
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9540
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3692
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1748
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:2252
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7268
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7648
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:10804
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:13364
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:15236
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:16820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:5072
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:13544
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:14852
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:15492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:17204
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1132
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2912
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:624
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9156
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10412
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:12892
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:16224
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:17236
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:8492
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8640
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8152
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:4900
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8488
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8136
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:18444
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18452
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18460
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:18476
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18484
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18492
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:18516
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18524
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18532
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:18548
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18556
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18564
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18572
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:18580
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18588
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18596
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:18612
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18620
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18628
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:18644
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18652
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18660
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:18676
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18692
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18708
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:18756
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18772
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18796
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:18836
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21620
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21628
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21636
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:21644
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21652
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21660
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:21676
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21684
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21692
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21700
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:21708
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21716
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21724
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21732
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:21740
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21748
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21756
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21764
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:21772
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21780
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21788
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21796
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:21804
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21812
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21820
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21828
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:21836
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21844
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21852
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21860
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:21868
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21876
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21884
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21892
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:21900
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21908
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21916
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21924
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:21932
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21940
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21948
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:21964
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21972
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21980
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21988
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:21996
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22004
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22012
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22020
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:22028
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22036
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22044
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22052
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:22060
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22068
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22076
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22084
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:22092
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22100
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22108
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22116
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:22124
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22132
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22140
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22148
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:22156
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22164
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22172
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22180
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:22188
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22196
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22204
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22212
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:22220
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22228
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22236
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22244
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:22252
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22260
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22268
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22276
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:22284
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22292
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22300
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22308
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:22316
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22324
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22332
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22340
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:22348
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22356
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22364
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22372
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:22380
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22388
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22396
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22404
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:22412
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22420
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22428
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:22444
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22452
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22460
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22468
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:22476
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22484
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22492
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22500
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:22508
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22516
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22524
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:10428
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10512
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10532
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10576
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:10580
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10584
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10668
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10672
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:10700
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10820
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10908
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10836
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:10928
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10984
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10992
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:11160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:11204
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:11212
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10304
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10872
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:11324
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:11308
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:11316
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:11352
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:23956
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:23964
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:23972
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:23980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:23988
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:23996
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24004
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24012
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24020
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24028
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24036
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24044
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24052
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24060
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24068
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24076
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24084
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24092
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24100
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24116
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24124
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24132
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24140
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24148
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24156
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24164
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24172
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24180
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24188
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24196
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24204
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24212
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24220
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24228
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24236
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24244
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24252
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24260
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24276
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24284
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24292
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24300
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24308
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24316
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24324
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24332
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24340
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24348
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24356
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24364
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24372
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24380
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24388
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24396
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24404
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24412
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24420
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24436
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24444
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24452
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24468
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24476
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24484
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24492
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24500
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24508
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24516
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24532
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24540
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24548
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24556
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24564
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24572
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:22768
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24580
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24588
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24596
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24604
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24612
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24620
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24628
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24636
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24644
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24652
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24660
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24668
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24676
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24684
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24692
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24700
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24716
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24724
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24732
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24740
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24748
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24756
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24764
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K test.bat
        5⤵
        
        PID:24780
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24796
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24804
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:24816
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18908
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18936
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:9084
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9088
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9092
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:9104
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9108
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9120
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:9136
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8080
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5700
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:19476
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19484
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19492
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:19516
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19524
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19532
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:19568
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19576
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19588
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19600
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:19612
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19624
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19636
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19652
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:19660
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19684
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19692
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:19716
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19736
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:15160
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:17124
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7348
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5912
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5440
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:5028
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8848
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10284
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:12752
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:15540
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:17196
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8200
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:13672
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:16948
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7328
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:872
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5608
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:5052
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7716
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7728
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:7744
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:11564
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:12876
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:14372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:15092
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:14712
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21332
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4340
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:23484
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7752
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7760
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:7784
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:11476
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:12816
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:14352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:15024
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5756
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:21592
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5064
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7796
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7804
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:7836
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:11688
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:13040
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:14444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:14872
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6456
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7844
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7880
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:7916
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:11884
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:13216
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:14636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:15528
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6512
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6508
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7936
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7944
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:8052
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:11572
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:12884
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:14380
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:14832
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7576
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5236
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8552
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10452
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:12936
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:14856
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:17132
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:5828
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4876
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2956
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:5916
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7476
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7484
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:8632
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:12168
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:12428
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:14712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:15632
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:18980
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1276
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:23500
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10864
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12704
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:14288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:15268
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5588
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:23492
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:636
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11792
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3792
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1764
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:1304
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7688
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7704
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:10216
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12656
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:14216
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:15148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:16908
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5000
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2140
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:3108
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9472
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10432
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:12928
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10948
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:17812
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3296
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:14900
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:17164
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7312
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1288
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6064
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:5860
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8252
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8264
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:8280
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:11892
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:13224
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:14560
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:15432
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8196
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4152
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:12284
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8288
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8296
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:8312
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:11868
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:13200
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:14568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:15440
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3140
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10020
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6320
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8320
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8328
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:8344
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:12036
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:11864
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:14720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:15640
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:20628
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6488
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8356
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8364
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:8380
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:12148
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:12680
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:14696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:15616
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:19004
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6520
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8388
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8396
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:8420
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:11876
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:13208
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:14576
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:15448
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7632
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6572
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8432
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8444
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:8464
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:12160
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:12276
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:14704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:15624
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6640
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8476
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10320
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:12776
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12624
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:16972
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:14872
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7220
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3204
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1896
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:3812
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9824
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10780
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:13632
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:16812
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18376
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:792
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:16104
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:17024
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8012
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5136
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2820
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:1780
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9996
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11024
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:13904
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:17080
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7296
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:14780
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:17228
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7456
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4272
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4420
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:4976
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9496
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10524
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:13096
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:15136
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:16504
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K test.bat
      4⤵
      PID:20884
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:15288
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:16956
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:2336
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5492
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4256
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:5928
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9800
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10712
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:13336
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:16716
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18136
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19788
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:15708
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:17148
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7292
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3764
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5068
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:5080
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9484
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10504
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:13016
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:15820
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:16980
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7204
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:15004
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:17116
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7448
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2908
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5640
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:5116
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10004
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11008
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:13896
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:17092
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6376
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:16344
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:17244
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6440
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5408
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4056
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:1440
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9756
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10692
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:13392
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:16668
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18152
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:20204
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:15780
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:17220
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7440
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6104
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4692
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:6132
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9792
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10788
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:13576
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:16708
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18228
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6220
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:16052
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:17072
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7240
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5208
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3728
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:3340
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9744
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10684
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:13424
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:16652
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18176
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19796
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:15792
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:16964
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:5624
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1020
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3044
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:3564
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9096
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10440
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:13008
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10968
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:17032
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7192
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:14828
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:15072
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:17100
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7176
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1784
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6060
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:4440
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9968
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11016
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:13932
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:16400
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:17804
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:18996
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5868
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4860
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:3768
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9776
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10704
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:13328
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:16696
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18196
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:19380
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:15692
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:17172
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7280
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5400
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3460
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:2644
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9808
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10720
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:13440
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:16660
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6864
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:15824
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:17212
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7548
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:936
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2232
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:3892
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9836
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10772
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:13520
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:16724
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18144
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:20196
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:15944
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:17180
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:4268
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3456
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4348
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:3648
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9816
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10732
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:13448
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:16644
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:18168
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2068
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:15832
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:17252
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7560
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4852
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5004
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:4824
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9480
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10516
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K test.bat
    3⤵
    PID:13032
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:16412
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:17040
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7832
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:15032
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:17108
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7528
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8972
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10360
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K test.bat
  2⤵
  PID:12844
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:16000
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:17188
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7352
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11840
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:17140
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery