5e6df1d077436eaa798edebcaf185853235aa57124bc449151f725ded365073e

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000006900630061007200750073005f0072007600720074002e0065007800650000000000	icarus.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	icarus.exe

Executes dropped EXE 14 IoCs

pid	Process
2176	dc-dual-force-run.exe
7448	avast_cleanup_online_setup.exe
8396	icarus.exe
8472	icarus_ui.exe
8996	icarus.exe
9820	pdfix.exe
9312	TuneupSvc.exe
11100	TuneupUI.exe
9300	bysoft-freeram-4.05.031-installer_awH-zM1.exe
9592	bysoft-freeram-4.05.031-installer_awH-zM1.tmp
9808	TuneupUI.exe
10180	TuneupUI.exe
10280	TuneupUI.exe
10852	TuneupUI.exe

Loads dropped DLL 64 IoCs

pid	Process
8996	icarus.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
11100	TuneupUI.exe
11100	TuneupUI.exe
11100	TuneupUI.exe
11100	TuneupUI.exe
11100	TuneupUI.exe
11100	TuneupUI.exe
11100	TuneupUI.exe
11100	TuneupUI.exe
11100	TuneupUI.exe
11100	TuneupUI.exe
11100	TuneupUI.exe
11100	TuneupUI.exe
11100	TuneupUI.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
11100	TuneupUI.exe
11100	TuneupUI.exe
11100	TuneupUI.exe
11100	TuneupUI.exe
11100	TuneupUI.exe
11100	TuneupUI.exe
11100	TuneupUI.exe
9808	TuneupUI.exe
9808	TuneupUI.exe
9808	TuneupUI.exe
9808	TuneupUI.exe
9808	TuneupUI.exe
9808	TuneupUI.exe
9808	TuneupUI.exe
9808	TuneupUI.exe
9808	TuneupUI.exe
9808	TuneupUI.exe
9808	TuneupUI.exe
9808	TuneupUI.exe
9808	TuneupUI.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TuneupUI.exe = "\"C:\\Program Files\\Avast Software\\Cleanup\\TuneupUI.exe\" /nogui"	icarus.exe

Checks for any installed AV software in registry 1 TTPs 7 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast\properties	TuneupSvc.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	TuneupSvc.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	TuneupSvc.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	icarus.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	icarus.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	TuneupSvc.exe
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	TuneupSvc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\Q:	TuneupSvc.exe
File opened (read-only)	\??\W:	TuneupSvc.exe
File opened (read-only)	\??\Y:	TuneupSvc.exe
File opened (read-only)	\??\D:	TuneupSvc.exe
File opened (read-only)	\??\I:	TuneupSvc.exe
File opened (read-only)	\??\M:	TuneupSvc.exe
File opened (read-only)	\??\N:	TuneupSvc.exe
File opened (read-only)	\??\U:	TuneupSvc.exe
File opened (read-only)	\??\B:	TuneupSvc.exe
File opened (read-only)	\??\F:	TuneupSvc.exe
File opened (read-only)	\??\H:	TuneupSvc.exe
File opened (read-only)	\??\P:	TuneupSvc.exe
File opened (read-only)	\??\S:	TuneupSvc.exe
File opened (read-only)	\??\T:	TuneupSvc.exe
File opened (read-only)	\??\V:	TuneupSvc.exe
File opened (read-only)	\??\E:	TuneupSvc.exe
File opened (read-only)	\??\G:	TuneupSvc.exe
File opened (read-only)	\??\J:	TuneupSvc.exe
File opened (read-only)	\??\O:	TuneupSvc.exe
File opened (read-only)	\??\X:	TuneupSvc.exe
File opened (read-only)	\??\Z:	TuneupSvc.exe
File opened (read-only)	\??\A:	TuneupSvc.exe
File opened (read-only)	\??\K:	TuneupSvc.exe
File opened (read-only)	\??\L:	TuneupSvc.exe
File opened (read-only)	\??\R:	TuneupSvc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
276	sites.google.com
277	sites.google.com

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	TuneupSvc.exe
File opened for modification	\??\PhysicalDrive0	avast_cleanup_online_setup.exe

Detected potential entity reuse from brand STEAM.
phishing steam

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\icarus_rvrt.exe	icarus.exe
File opened for modification	C:\Windows\system32\icarus_rvrt.exe	icarus.exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	405	https://bstlar.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=9009503fbac448ad	17

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001400000002b387-13888.dat	upx
behavioral1/memory/11308-14010-0x0000000000400000-0x000000000053A000-memory.dmp	upx
behavioral1/memory/11308-15377-0x0000000000400000-0x000000000053A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Avast Software\Cleanup\event_routing_rpc.dll.ipending.df820133.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\locales\bg.pak.ipending.df820133	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\Resources\dist\assets\vnext\spawn-layout-avg.css.ipending.df820133	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\locales\sk.pak	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\vccorlib140.dll.ipending.df820133	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\locales\kn.pak.ipending.df820133	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\Resources\dist\assets\vnext\spawn-font.css.ipending.df820133	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\api-ms-win-crt-locale-l1-1-0.dll.ipending.df820133	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\Resources\SvgInline.svg.ipending.df820133	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\Resources\dist\vendor-bundle.js.ipending.df820133.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\eula\en-us.html.ipending.df820133	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\msvcp140_1.dll.ipending.df820133	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\Resources\dist\app-bundle.js.ipending.df820133	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\Resources\dist\assets\i18n\ur-PK.json.ipending.df820133	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\Resources\dist\vendor-bundle.js.ipending.df820133	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\api-ms-win-core-handle-l1-1-0.dll	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\api-ms-win-core-namedpipe-l1-1-0.dll	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\locales\ja.pak	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\locales\sr.pak.ipending.df820133	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\su_controller.dll.ipending.df820133	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\commchannel.dll.ipending.df820133	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\api-ms-win-core-file-l1-2-0.dll.ipending.df820133.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\Resources\dist\assets\vnext\spawn-flags.css.ipending.df820133.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\Resources\dist\assets\vnext\NitroMenu.js.ipending.df820133	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\avast.local_vc142.crt.cat.ipending.df820133	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\locales\en-GB.pak.ipending.df820133	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\api-ms-win-core-file-l2-1-0.dll.ipending.df820133.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\api-ms-win-core-handle-l1-1-0.dll.ipending.df820133.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\locales\ta.pak.ipending.df820133	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\api-ms-win-core-timezone-l1-1-0.dll.ipending.df820133	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\msvcp140_2.dll	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\Resources\dist\vendor-bundle.js	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\aswProperty.dll.ipending.df820133	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\Resources\dist\assets\vnext\Kin.js.ipending.df820133	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\api-ms-win-crt-private-l1-1-0.dll.ipending.df820133	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\locales\ml.pak	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\api-ms-win-core-profile-l1-1-0.dll.ipending.df820133.lzma	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\api-ms-win-core-sysinfo-l1-1-0.dll	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\locales\en-US.pak.ipending.df820133	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\locales\vi.pak.ipending.df820133.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\libwaresource.dll.ipending.df820133.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\api-ms-win-core-memory-l1-1-0.dll.ipending.df820133	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\api-ms-win-core-localization-l1-2-0.dll	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\msvcp140_1.dll	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\locales\hi.pak	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\libEGL.dll	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\locales\ca.pak.ipending.df820133	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\Resources\dist\assets\i18n\it.json.ipending.df820133	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\Resources\dist\assets\i18n\lv.json.ipending.df820133	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\api-ms-win-core-console-l1-2-0.dll.ipending.df820133	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\3rdparty_licenses\licenses\3rdparty.txt.ipending.df820133	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\Resources\dist\assets\vnext\spawn-dark.css.ipending.df820133	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\Resources\dist\assets\vnext\spawn-omni.css.ipending.df820133.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\Resources\dist\assets\vnext\spawn-sprite-avg.css.ipending.df820133	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\module_lifetime.dll.ipending.df820133	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\api-ms-win-crt-utility-l1-1-0.dll.ipending.df820133.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\avast.local_vc142.crt\vcruntime140.dll.ipending.df820133.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\Resources\dist\assets\vnext\spawn-dark.css.ipending.df820133.lzma	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\Resources\dist\assets\icons\sprite.symbol.html.ipending.df820133	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\perfstats.dll	icarus.exe
File opened for modification	C:\Program Files\Avast Software\Cleanup\Resources\dist\assets\vnext\spawn-omni.css.ipending.df820133	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\Resources\dist\assets\i18n\de.json.ipending.df820133.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\Resources\dist\assets\vnext\polyfill.min.js.ipending.df820133.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Cleanup\Resources\dist\assets\vnext\spawn-font.css.ipending.df820133.lzma	icarus.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\TEMP	TuneupSvc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\avast_cleanup_online_setup.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\bysoft-freeram-4.05.031-installer_awH-zM1.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x001100000002b472-12854.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2116	4508	WerFault.exe	101
2768	3992	WerFault.exe	105
10224	9592	WerFault.exe	195
9716	9592	WerFault.exe	195

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bysoft-freeram-4.05.031-installer_awH-zM1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bysoft-freeram-4.05.031-installer_awH-zM1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc-dual-force-run.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avast_cleanup_online_setup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
8008	SWUpdater.exe
5260	SWUpdater.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x001400000002b359-13738.dat	nsis_installer_1

Checks processor information in registry 2 TTPs 34 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TuneupUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TuneupUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	TuneupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TuneupUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TuneupUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TuneupUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TuneupUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	TuneupSvc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus_ui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	bysoft-freeram-4.05.031-installer_awH-zM1.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TuneupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TuneupSvc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TuneupUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TuneupUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TuneupUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bysoft-freeram-4.05.031-installer_awH-zM1.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TuneupUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus_ui.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	TuneupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31155376"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3330230663"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	avast_cleanup_online_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "65F115A51CCCDBF623206AEDE3B3D8A4"	avast_cleanup_online_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\5E1D6A55-0134-486E-A166-38C2E4919BB1 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA/WGwmvR8LUG7Nvs9L2qcZAQAAAACAAAAAAAQZgAAAAEAACAAAAD+iuYEYnBTwrbdhKVcgbrm+JDm9Namyi/By3mHXqpapAAAAAAOgAAAAAIAACAAAAB8LzTc+pDkL9NO17vrmTLMu93/pu4EzQd187qhCSAnazAAAAApYL/8BcGseOTF7D7K4q4EPqsHtxQP9QA4KxMRva3BxN3rekwLb+8y66T1Gv4/HINAAAAALilra+Vb1ZwuoF0y5dm3L/ijVEcMmokuyJM4gBUdSuHNU2ivqM4kRLXonWcpx4xsLl0yt+bshz0dBVg6AmtkXw=="	avast_cleanup_online_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avasttu	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avasttu\shell\open\command	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avasttu\shell	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avasttu\shell\open	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "5ce6a575-274b-4a8d-a811-4b49778ae3c5"	avast_cleanup_online_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avasttu\ = "Avast Cleanup"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avasttu\URL Protocol	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avasttu\shell\open\command\ = "\"C:\\Program Files\\Avast Software\\Cleanup\\TuneupUI.exe\" /%1"	icarus.exe

NTFS ADS 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\0P3NME.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\dc-dual-force-run.zip:Zone.Identifier	firefox.exe
File opened for modification	C:\Users\Admin\Downloads\Sin confirmar 180534.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\avast_cleanup_online_setup.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Sin confirmar 331119.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\bysoft-freeram-4.05.031-installer_awH-zM1.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
2176	dc-dual-force-run.exe
5520	msedge.exe
5520	msedge.exe
5516	msedge.exe
5516	msedge.exe
6944	msedge.exe
6944	msedge.exe
1484	identity_helper.exe
1484	identity_helper.exe
6876	msedge.exe
6876	msedge.exe
8472	icarus_ui.exe
8472	icarus_ui.exe
4288	msedge.exe
4288	msedge.exe
9808	TuneupUI.exe
9808	TuneupUI.exe
10180	TuneupUI.exe
10180	TuneupUI.exe
10280	TuneupUI.exe
10280	TuneupUI.exe
10852	TuneupUI.exe
10852	TuneupUI.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9312	TuneupSvc.exe
9592	bysoft-freeram-4.05.031-installer_awH-zM1.tmp
9592	bysoft-freeram-4.05.031-installer_awH-zM1.tmp
9592	bysoft-freeram-4.05.031-installer_awH-zM1.tmp
9592	bysoft-freeram-4.05.031-installer_awH-zM1.tmp
9592	bysoft-freeram-4.05.031-installer_awH-zM1.tmp
9592	bysoft-freeram-4.05.031-installer_awH-zM1.tmp
9592	bysoft-freeram-4.05.031-installer_awH-zM1.tmp
9592	bysoft-freeram-4.05.031-installer_awH-zM1.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	4368	firefox.exe
Token: SeDebugPrivilege	4368	firefox.exe
Token: SeDebugPrivilege	4368	firefox.exe
Token: SeDebugPrivilege	4368	firefox.exe
Token: SeDebugPrivilege	4368	firefox.exe
Token: SeDebugPrivilege	4368	firefox.exe
Token: SeDebugPrivilege	4368	firefox.exe
Token: SeDebugPrivilege	4368	firefox.exe
Token: SeRestorePrivilege	7032	7zG.exe
Token: 35	7032	7zG.exe
Token: SeSecurityPrivilege	7032	7zG.exe
Token: SeSecurityPrivilege	7032	7zG.exe
Token: SeDebugPrivilege	4368	firefox.exe
Token: 33	6264	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6264	AUDIODG.EXE
Token: SeDebugPrivilege	4368	firefox.exe
Token: SeRestorePrivilege	8396	icarus.exe
Token: SeTakeOwnershipPrivilege	8396	icarus.exe
Token: SeRestorePrivilege	8396	icarus.exe
Token: SeTakeOwnershipPrivilege	8396	icarus.exe
Token: SeRestorePrivilege	8396	icarus.exe
Token: SeTakeOwnershipPrivilege	8396	icarus.exe
Token: SeRestorePrivilege	8396	icarus.exe
Token: SeTakeOwnershipPrivilege	8396	icarus.exe
Token: SeDebugPrivilege	8396	icarus.exe
Token: SeDebugPrivilege	8472	icarus_ui.exe
Token: SeRestorePrivilege	8996	icarus.exe
Token: SeTakeOwnershipPrivilege	8996	icarus.exe
Token: SeRestorePrivilege	8996	icarus.exe
Token: SeTakeOwnershipPrivilege	8996	icarus.exe
Token: SeRestorePrivilege	8996	icarus.exe
Token: SeTakeOwnershipPrivilege	8996	icarus.exe
Token: SeRestorePrivilege	8996	icarus.exe
Token: SeTakeOwnershipPrivilege	8996	icarus.exe
Token: SeDebugPrivilege	8996	icarus.exe
Token: SeDebugPrivilege	4368	firefox.exe
Token: SeDebugPrivilege	9312	TuneupSvc.exe
Token: SeDebugPrivilege	11100	TuneupUI.exe
Token: SeDebugPrivilege	9808	TuneupUI.exe
Token: SeDebugPrivilege	10180	TuneupUI.exe
Token: SeDebugPrivilege	10852	TuneupUI.exe
Token: SeDebugPrivilege	10280	TuneupUI.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
7032	7zG.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe

Suspicious use of SetWindowsHookEx 41 IoCs

pid	Process
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
4368	firefox.exe
7448	avast_cleanup_online_setup.exe
8396	icarus.exe
8472	icarus_ui.exe
8472	icarus_ui.exe
8996	icarus.exe
9820	pdfix.exe
9820	pdfix.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 4368	4296	firefox.exe	80
PID 4296 wrote to memory of 4368	4296	firefox.exe	80
PID 4296 wrote to memory of 4368	4296	firefox.exe	80
PID 4296 wrote to memory of 4368	4296	firefox.exe	80
PID 4296 wrote to memory of 4368	4296	firefox.exe	80
PID 4296 wrote to memory of 4368	4296	firefox.exe	80
PID 4296 wrote to memory of 4368	4296	firefox.exe	80
PID 4296 wrote to memory of 4368	4296	firefox.exe	80
PID 4296 wrote to memory of 4368	4296	firefox.exe	80
PID 4296 wrote to memory of 4368	4296	firefox.exe	80
PID 4296 wrote to memory of 4368	4296	firefox.exe	80
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 4228	4368	firefox.exe	81
PID 4368 wrote to memory of 2172	4368	firefox.exe	82
PID 4368 wrote to memory of 2172	4368	firefox.exe	82
PID 4368 wrote to memory of 2172	4368	firefox.exe	82
PID 4368 wrote to memory of 2172	4368	firefox.exe	82
PID 4368 wrote to memory of 2172	4368	firefox.exe	82
PID 4368 wrote to memory of 2172	4368	firefox.exe	82
PID 4368 wrote to memory of 2172	4368	firefox.exe	82
PID 4368 wrote to memory of 2172	4368	firefox.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\submit.gif
1⤵
- Modifies Internet Explorer settings
PID:4764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1468 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e816e52-f5d2-4182-a165-f8d8c0e41d39} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" gpu
    3⤵
    PID:4228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2380 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2364 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ae5f4f0-c80f-4196-9a74-f1f162d1d833} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" socket
    3⤵
    PID:2172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3228 -childID 1 -isForBrowser -prefsHandle 3220 -prefMapHandle 3216 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f241fdb-6287-44e4-9a33-59621dbd8c02} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:1904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3656 -childID 2 -isForBrowser -prefsHandle 3100 -prefMapHandle 3096 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c15f3b40-9a69-4d25-ba96-74c6f6bb1628} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:4864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4052 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4260 -prefMapHandle 4304 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d992af49-74ab-454e-a339-cfffd6b3f479} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" utility
    3⤵
    - Checks processor information in registry
    PID:2648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5364 -childID 3 -isForBrowser -prefsHandle 5372 -prefMapHandle 5440 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0506216a-be0b-48f5-8ed8-e5d8523cb8c4} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:2240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 4 -isForBrowser -prefsHandle 5616 -prefMapHandle 5612 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ff6aa7f-f432-47f7-8dc6-7ea91fd1c69d} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:2888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5756 -childID 5 -isForBrowser -prefsHandle 5520 -prefMapHandle 5524 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58e6985f-2527-4305-9800-c7b1c97e36c4} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:1288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6240 -childID 6 -isForBrowser -prefsHandle 6236 -prefMapHandle 6232 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0c50ab1-3491-49e4-8b65-f2adce674f19} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:1948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6372 -childID 7 -isForBrowser -prefsHandle 6380 -prefMapHandle 6384 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e71c8914-7f53-4772-b7be-9d53cdf50695} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:2448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6648 -parentBuildID 20240401114208 -prefsHandle 6660 -prefMapHandle 6656 -prefsLen 32342 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8075a81-1153-4eda-a843-58f84641609f} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" rdd
    3⤵
    PID:3300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6680 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6672 -prefMapHandle 6668 -prefsLen 32342 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a572f9b-29d0-455f-9f06-0a5ce954c090} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" utility
    3⤵
    - Checks processor information in registry
    PID:2212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7452 -childID 8 -isForBrowser -prefsHandle 7488 -prefMapHandle 7472 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7ce8d4d-7512-403a-8adc-16a840d2b713} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:2596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6956 -childID 9 -isForBrowser -prefsHandle 6960 -prefMapHandle 6964 -prefsLen 27299 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8dca3fdc-3ef3-4c0a-86a6-0d6f62a7f1f4} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:5344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6940 -childID 10 -isForBrowser -prefsHandle 2764 -prefMapHandle 7828 -prefsLen 27299 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {693e1781-2ed3-4ca0-974f-df625ced2d3a} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:5496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5676 -childID 11 -isForBrowser -prefsHandle 5768 -prefMapHandle 6196 -prefsLen 27299 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {39417a7e-2056-4102-9b8f-a903216753aa} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:5804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7924 -childID 12 -isForBrowser -prefsHandle 7944 -prefMapHandle 7968 -prefsLen 27299 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e80ed998-d853-449c-afb1-861dc2707390} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:6372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5240 -childID 13 -isForBrowser -prefsHandle 4188 -prefMapHandle 7756 -prefsLen 28086 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {826a615e-3946-476f-92ce-89f6397412a9} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:6464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7164 -childID 14 -isForBrowser -prefsHandle 5732 -prefMapHandle 6544 -prefsLen 28136 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99d0fdd8-477d-436a-9351-1c307ac8620f} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:6876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8256 -childID 15 -isForBrowser -prefsHandle 8268 -prefMapHandle 8276 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d36a122-4923-4a58-8275-a35b64670c42} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:1352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2724 -childID 16 -isForBrowser -prefsHandle 7916 -prefMapHandle 7260 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0688a8da-ae75-442f-b7bd-146266bf1176} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:1364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8508 -childID 17 -isForBrowser -prefsHandle 8544 -prefMapHandle 8548 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {47d091be-9e7a-41ed-9aed-c23106f95ffb} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:5384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8412 -childID 18 -isForBrowser -prefsHandle 6092 -prefMapHandle 8060 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42404325-1a9a-4961-9efe-d9565afa57ae} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:5812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8448 -childID 19 -isForBrowser -prefsHandle 7740 -prefMapHandle 8124 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {721d7bd9-ea13-4991-b1bc-7a5cdbaaa335} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:5760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7548 -childID 20 -isForBrowser -prefsHandle 7252 -prefMapHandle 6984 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a608d28-f220-4d72-b3a7-8ffadea3ad28} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7264 -childID 21 -isForBrowser -prefsHandle 7464 -prefMapHandle 7336 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af87804e-e605-48ab-bbc3-ee72e4087c4b} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:2448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7720 -childID 22 -isForBrowser -prefsHandle 7032 -prefMapHandle 4012 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed772e6e-ff4e-4123-bba9-a6e19779cda6} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:7072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7892 -childID 23 -isForBrowser -prefsHandle 6372 -prefMapHandle 5728 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f9834a3-cac8-4a4b-a6eb-236e0c78a860} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:3852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7400 -childID 24 -isForBrowser -prefsHandle 8852 -prefMapHandle 2636 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a1d153b-c308-4f8b-9cbf-00baa72850ee} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:4204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7116 -childID 25 -isForBrowser -prefsHandle 7272 -prefMapHandle 7192 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed58dc84-7d9e-480d-847b-bd8ce7ec1dda} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:1836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6500 -childID 26 -isForBrowser -prefsHandle 8864 -prefMapHandle 8876 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d21e651-fe2b-4389-a95a-17ba0377f98c} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9080 -childID 27 -isForBrowser -prefsHandle 1460 -prefMapHandle 8576 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {599ac623-4775-452e-babe-3f03429a6b75} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:7144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5868 -childID 28 -isForBrowser -prefsHandle 4004 -prefMapHandle 9076 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01034294-4555-424e-bd95-47a6fa268825} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:2660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9288 -childID 29 -isForBrowser -prefsHandle 9304 -prefMapHandle 9544 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7424118b-b3ed-4dc2-91c5-3cdf06668fea} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:6120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8984 -childID 30 -isForBrowser -prefsHandle 7732 -prefMapHandle 9004 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbf4c33c-bccf-4839-9110-0ba17a2bc9fd} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:8052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6372 -childID 31 -isForBrowser -prefsHandle 9904 -prefMapHandle 7116 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {984e0e56-7a4c-4a55-af27-3be65916b5f6} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:6576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10048 -childID 32 -isForBrowser -prefsHandle 9840 -prefMapHandle 8908 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80c799cb-faae-429d-850d-c19833a6715b} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:7532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9636 -childID 33 -isForBrowser -prefsHandle 9096 -prefMapHandle 9468 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a610884d-8e18-42b8-9bae-e56ac5831ab9} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:7400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9892 -childID 34 -isForBrowser -prefsHandle 8044 -prefMapHandle 9644 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d2db179-3829-49e2-b7f9-fb61b2b22020} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:3800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10156 -childID 35 -isForBrowser -prefsHandle 9420 -prefMapHandle 9652 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4dc3ec4-b076-4dc1-86a3-f0dbf3911c48} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:3248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8176 -childID 36 -isForBrowser -prefsHandle 8496 -prefMapHandle 7520 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ba5b251-2546-40e8-a4f4-1bd5fc1c23ad} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:2792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7284 -childID 37 -isForBrowser -prefsHandle 9996 -prefMapHandle 10264 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44a707c7-41a9-4705-92e9-33ddba192fc1} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:7724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8524 -childID 38 -isForBrowser -prefsHandle 9544 -prefMapHandle 9304 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eaa352bd-cc48-4a74-9781-9a9cdd61e258} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:7036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11208 -childID 39 -isForBrowser -prefsHandle 11192 -prefMapHandle 9072 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {51daefc9-b54d-457a-9033-219a51ae4c1d} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:4012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9832 -childID 40 -isForBrowser -prefsHandle 10488 -prefMapHandle 11492 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e22760bc-17d5-47e2-a0f8-a197ad2e2465} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:5860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10364 -childID 41 -isForBrowser -prefsHandle 3644 -prefMapHandle 9948 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ab836a0-436e-4e93-92a3-5116629e2c0c} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:3820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7252 -childID 42 -isForBrowser -prefsHandle 5180 -prefMapHandle 11252 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5f2017d-071d-4644-9df7-f741fe997f24} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:11356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5004 -childID 43 -isForBrowser -prefsHandle 3100 -prefMapHandle 10316 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe868ec9-8c97-435f-af89-fe059b65c0e2} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
    3⤵
    PID:2900

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5648

C:\Users\Admin\Downloads\0P3NME\Bootstrapper.exe
"C:\Users\Admin\Downloads\0P3NME\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1404
  2⤵
  - Program crash
  PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4508 -ip 4508
1⤵
PID:400

C:\Users\Admin\Downloads\0P3NME\Bootstrapper.exe
"C:\Users\Admin\Downloads\0P3NME\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 1232
  2⤵
  - Program crash
  PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3992 -ip 3992
1⤵
PID:2304

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\dc-dual-force-run\dc-dual-force-run\" -spe -an -ai#7zMap30535:132:7zEvent4059
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:7032

C:\Users\Admin\Downloads\dc-dual-force-run\dc-dual-force-run\dc-dual-force-run.exe
"C:\Users\Admin\Downloads\dc-dual-force-run\dc-dual-force-run\dc-dual-force-run.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2176

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004CC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:7852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xe0,0x104,0x108,0x84,0x10c,0x7ff9c4493cb8,0x7ff9c4493cc8,0x7ff9c4493cd8
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:7632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:6820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:7568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:8152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:7112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:7012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:7612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:7836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7228 /prefetch:8
  2⤵
  PID:7512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:6876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:5296
- C:\Users\Admin\Downloads\avast_cleanup_online_setup.exe
  "C:\Users\Admin\Downloads\avast_cleanup_online_setup.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:7448
- - C:\Windows\Temp\asw-8f0544cb-c568-4f88-befb-cc9a9ca5ca2d\common\icarus.exe
    C:\Windows\Temp\asw-8f0544cb-c568-4f88-befb-cc9a9ca5ca2d\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-8f0544cb-c568-4f88-befb-cc9a9ca5ca2d\icarus-info.xml /install /sssid:7448
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:8396
  - - C:\Windows\Temp\asw-8f0544cb-c568-4f88-befb-cc9a9ca5ca2d\common\icarus_ui.exe
      C:\Windows\Temp\asw-8f0544cb-c568-4f88-befb-cc9a9ca5ca2d\common\icarus_ui.exe /sssid:7448 /er_master:master_ep_962d80f8-8ef0-40ca-88b7-d72f6238bc91 /er_ui:ui_ep_86269ae8-ae72-4b8e-a924-6c46502162ca
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:8472
  - - C:\Windows\Temp\asw-8f0544cb-c568-4f88-befb-cc9a9ca5ca2d\avast-tu\icarus.exe
      C:\Windows\Temp\asw-8f0544cb-c568-4f88-befb-cc9a9ca5ca2d\avast-tu\icarus.exe /sssid:7448 /er_master:master_ep_962d80f8-8ef0-40ca-88b7-d72f6238bc91 /er_ui:ui_ep_86269ae8-ae72-4b8e-a924-6c46502162ca /er_slave:avast-tu_slave_ep_c9e4920e-6364-4b70-a733-900af620c2fe /slave:avast-tu
      4⤵
      Uses Session Manager for persistence
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks for any installed AV software in registry
      Writes to the Master Boot Record (MBR)
      Drops file in System32 directory
      Drops file in Program Files directory
      Checks processor information in registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:8996
    - - C:\Program Files\Avast Software\Cleanup\pdfix.exe
        
        "C:\Program Files\Avast Software\Cleanup\pdfix.exe" /fixifeo
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:9820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7448 /prefetch:1
  2⤵
  PID:6568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7692 /prefetch:1
  2⤵
  PID:7212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8136 /prefetch:1
  2⤵
  PID:8576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:8824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7464 /prefetch:1
  2⤵
  PID:8948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:8956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:7612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7304 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:8260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7680 /prefetch:1
  2⤵
  PID:6248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7884 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8084 /prefetch:1
  2⤵
  PID:7356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8200 /prefetch:8
  2⤵
  PID:8200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=8072 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4288
- C:\Users\Admin\Downloads\bysoft-freeram-4.05.031-installer_awH-zM1.exe
  "C:\Users\Admin\Downloads\bysoft-freeram-4.05.031-installer_awH-zM1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:9300
- - C:\Users\Admin\AppData\Local\Temp\is-KME8N.tmp\bysoft-freeram-4.05.031-installer_awH-zM1.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-KME8N.tmp\bysoft-freeram-4.05.031-installer_awH-zM1.tmp" /SL5="$9054E,852870,845824,C:\Users\Admin\Downloads\bysoft-freeram-4.05.031-installer_awH-zM1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:9592
  - - C:\Users\Admin\AppData\Local\Temp\is-K8MUQ.tmp\component0_extract\saBSI.exe
      "C:\Users\Admin\AppData\Local\Temp\is-K8MUQ.tmp\component0_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB
      4⤵
      PID:10216
    - - C:\Users\Admin\AppData\Local\Temp\is-K8MUQ.tmp\component0_extract\installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-K8MUQ.tmp\component0_extract\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
        5⤵
        
        PID:2104
      - C:\Program Files\McAfee\Temp3619654612\installer.exe
        
        "C:\Program Files\McAfee\Temp3619654612\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
        6⤵
        
        PID:9276
  - - C:\Users\Admin\AppData\Local\Temp\is-K8MUQ.tmp\component1_extract\OperaSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\is-K8MUQ.tmp\component1_extract\OperaSetup.exe" --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:opera_new_b
      4⤵
      PID:11532
    - - C:\Users\Admin\AppData\Local\Temp\7zSC0D97851\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC0D97851\setup.exe --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:opera_new_b --server-tracking-blob=NDg5MmM0M2NiZmYxOTc2MjY3ZDE3MGIyMzA3NGYyODVjNDZhOGNmNjg5YTA1ZDg5NTRhNThiN2MxZWIzZDk4OTp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cyIsInRpbWVzdGFtcCI6IjE3MzUwMzgwMTIuNzc0NSIsInVzZXJhZ2VudCI6InB5dGhvbi1yZXF1ZXN0cy8yLjMyLjMiLCJ1dG0iOnt9LCJ1dWlkIjoiYWFmNjZmNDQtNWMyYy00ZmJmLTg0YmQtN2Y2OTE0MGY0MGRiIn0=
        5⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\7zSC0D97851\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC0D97851\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=115.0.5322.119 --initial-client-data=0x33c,0x340,0x344,0x31c,0x348,0x723b9d44,0x723b9d50,0x723b9d5c
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --version
        6⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\7zSC0D97851\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSC0D97851\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=es --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=8256 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20250112012420" --session-guid=1f0c46cc-ae10-4228-b519-9b85a13b3849 --server-tracking-blob="NDRiMDBkOWIzMThmMmM5YzVmNjU2NGIxZmY1YzlhNzdmNTg4NDBiM2ExMTE4YTNjNDRjNmVmYTVjYjg5MTgyMjp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczNTAzODAxMi43NzQ1IiwidXNlcmFnZW50IjoicHl0aG9uLXJlcXVlc3RzLzIuMzIuMyIsInV0bSI6eyJjYW1wYWlnbiI6Im9wZXJhX25ld19iIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiYWlzIn0sInV1aWQiOiJhYWY2NmY0NC01YzJjLTRmYmYtODRiZC03ZjY5MTQwZjQwZGIifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=FC05000000000000
        6⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\7zSC0D97851\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC0D97851\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=115.0.5322.119 --initial-client-data=0x34c,0x350,0x354,0x348,0x358,0x71269d44,0x71269d50,0x71269d5c
        7⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202501120124201\assistant\Assistant_116.0.5366.21_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202501120124201\assistant\Assistant_116.0.5366.21_Setup.exe_sfx.exe"
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202501120124201\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202501120124201\assistant\assistant_installer.exe" --version
        6⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202501120124201\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202501120124201\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=116.0.5366.21 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x420ac4,0x420ad0,0x420adc
        7⤵
        
        PID:11080
  - - C:\Users\Admin\Downloads\bysoft-freeram-4.05.031-installer.exe
      "C:\Users\Admin\Downloads\bysoft-freeram-4.05.031-installer.exe"
      4⤵
      PID:9072
    - - C:\Program Files (x86)\BySoft FreeRAM\FreeRAM.exe
        
        "C:\Program Files (x86)\BySoft FreeRAM\FreeRAM.exe"
        5⤵
        
        PID:11308
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.bysoft.com/freeramlinkfirst.html
        6⤵
        
        PID:10940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff9c4493cb8,0x7ff9c4493cc8,0x7ff9c4493cd8
        7⤵
        
        PID:11664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9592 -s 796
      4⤵
      Program crash
      PID:10224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9592 -s 796
      4⤵
      Program crash
      PID:9716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8488 /prefetch:1
  2⤵
  PID:10572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:7984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:9960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=8324 /prefetch:2
  2⤵
  PID:9396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8504 /prefetch:1
  2⤵
  PID:11656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
  2⤵
  PID:12132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8168 /prefetch:1
  2⤵
  PID:12148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8160 /prefetch:1
  2⤵
  PID:11176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1868 /prefetch:1
  2⤵
  PID:11596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7876 /prefetch:1
  2⤵
  PID:11200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:8840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2708 /prefetch:1
  2⤵
  PID:7108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:10900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:9584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:9040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7948 /prefetch:1
  2⤵
  PID:10736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7556 /prefetch:1
  2⤵
  PID:10120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:9680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:12104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8692 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8724 /prefetch:1
  2⤵
  PID:9284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8748 /prefetch:1
  2⤵
  PID:8656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8856 /prefetch:1
  2⤵
  PID:7432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8924 /prefetch:1
  2⤵
  PID:9296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8948 /prefetch:1
  2⤵
  PID:10960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:9020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9552 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9644 /prefetch:1
  2⤵
  PID:8568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9904 /prefetch:1
  2⤵
  PID:9472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10044 /prefetch:1
  2⤵
  PID:10752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10204 /prefetch:1
  2⤵
  PID:11608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9512 /prefetch:1
  2⤵
  PID:10972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10176 /prefetch:1
  2⤵
  PID:8820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10724 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10912 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10940 /prefetch:1
  2⤵
  PID:8888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10888 /prefetch:1
  2⤵
  PID:7768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10996 /prefetch:1
  2⤵
  PID:10532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11088 /prefetch:1
  2⤵
  PID:7036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11040 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10828 /prefetch:1
  2⤵
  PID:12248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10864 /prefetch:1
  2⤵
  PID:11028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10856 /prefetch:1
  2⤵
  PID:8732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8876 /prefetch:1
  2⤵
  PID:7808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9612 /prefetch:1
  2⤵
  PID:9220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --service-sandbox-type=audio --mojo-platform-channel-handle=10848 /prefetch:8
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9888 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9256 /prefetch:1
  2⤵
  PID:9180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --service-sandbox-type=icon_reader --mojo-platform-channel-handle=12016 /prefetch:8
  2⤵
  PID:9476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10076 /prefetch:8
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=7580 /prefetch:8
  2⤵
  PID:11984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=9864 /prefetch:8
  2⤵
  PID:8812
- C:\Users\Admin\Downloads\Wave Browser (1).exe
  "C:\Users\Admin\Downloads\Wave Browser (1).exe"
  2⤵
  PID:11940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11772 /prefetch:1
  2⤵
  PID:9352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11824 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10736 /prefetch:1
  2⤵
  PID:8480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8532 /prefetch:1
  2⤵
  PID:10136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:12544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8756 /prefetch:1
  2⤵
  PID:12996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11880 /prefetch:1
  2⤵
  PID:13240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12184 /prefetch:1
  2⤵
  PID:13248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8480 /prefetch:1
  2⤵
  PID:13256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12268 /prefetch:1
  2⤵
  PID:13264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11172 /prefetch:1
  2⤵
  PID:13272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8828 /prefetch:1
  2⤵
  PID:13280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8812 /prefetch:1
  2⤵
  PID:13292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8768 /prefetch:1
  2⤵
  PID:13300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9908 /prefetch:1
  2⤵
  PID:9532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --service-sandbox-type=collections --mojo-platform-channel-handle=10496 /prefetch:8
  2⤵
  PID:7392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:8416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=10548 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12064 /prefetch:1
  2⤵
  PID:8236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10940 /prefetch:8
  2⤵
  PID:8372
- C:\Users\Admin\Downloads\Wave Browser (1).exe
  "C:\Users\Admin\Downloads\Wave Browser (1).exe"
  2⤵
  PID:10284
- - C:\Users\Admin\AppData\Local\Temp\Wave\SWUpdaterSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\Wave\SWUpdaterSetup.exe" /install "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1"
    3⤵
    PID:5720
  - - C:\Program Files (x86)\Wavesor\Temp\GUMEA46.tmp\SWUpdater.exe
      "C:\Program Files (x86)\Wavesor\Temp\GUMEA46.tmp\SWUpdater.exe" /install "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1"
      4⤵
      PID:4528
    - - C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe
        
        "C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /regserver
        5⤵
        
        PID:7000
      - C:\Users\Admin\Wavesor Software\SWUpdater\1.3.135.0\SWUpdaterComRegisterShell64.exe
        
        "C:\Users\Admin\Wavesor Software\SWUpdater\1.3.135.0\SWUpdaterComRegisterShell64.exe" /user
        6⤵
        
        PID:2432
      - C:\Users\Admin\Wavesor Software\SWUpdater\1.3.135.0\SWUpdaterComRegisterShell64.exe
        
        "C:\Users\Admin\Wavesor Software\SWUpdater\1.3.135.0\SWUpdaterComRegisterShell64.exe" /user
        6⤵
        
        PID:1680
      - C:\Users\Admin\Wavesor Software\SWUpdater\1.3.135.0\SWUpdaterComRegisterShell64.exe
        
        "C:\Users\Admin\Wavesor Software\SWUpdater\1.3.135.0\SWUpdaterComRegisterShell64.exe" /user
        6⤵
        
        PID:8444
    - - C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe
        
        "C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTM1LjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzUuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9InswRjU2RUUwOC0zRDk3LTRCNUEtQUU0MC0yOEVBNjg1OUZBNkN9IiB1c2VyaWQ9InthZjI3MzI2NS01M2ZlLTRlNmMtYjdiOS01NDAxY2JiYjM2ZjJ9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHJlcXVlc3RpZD0iezkwQzM2MzUzLTJFN0MtNDYxRS1BRjIxLTAxRTNDRjY0MUYyOX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntGNkY2MEFDRS03MUFELTQ2MTAtODBENC05MjUzNzI5RkI0Qjd9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMTM1LjAiIGxhbmc9ImVuIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIzNDYiLz48L2FwcD48L3JlcXVlc3Q-
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:8008
    - - C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe
        
        "C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /handoff "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1" /installsource otherinstallcmd /sessionid "{0F56EE08-3D97-4B5A-AE40-28EA6859FA6C}"
        5⤵
        
        PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9768 /prefetch:1
  2⤵
  PID:9536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=11688 /prefetch:8
  2⤵
  PID:13044
- C:\Users\Admin\Downloads\MinecraftInstaller.exe
  "C:\Users\Admin\Downloads\MinecraftInstaller.exe"
  2⤵
  PID:13196
- - C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe
    "C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe" scenarioMinecraft
    3⤵
    PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1308 /prefetch:1
  2⤵
  PID:11436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11500 /prefetch:1
  2⤵
  PID:9032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10472 /prefetch:1
  2⤵
  PID:12148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7216 /prefetch:1
  2⤵
  PID:10920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9376 /prefetch:1
  2⤵
  PID:9472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:6944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2812 /prefetch:1
  2⤵
  PID:12272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8444 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11424 /prefetch:1
  2⤵
  PID:12172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11460 /prefetch:1
  2⤵
  PID:11088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9672 /prefetch:1
  2⤵
  PID:12224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11560 /prefetch:1
  2⤵
  PID:13268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=134 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9448 /prefetch:1
  2⤵
  PID:12456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1812 /prefetch:1
  2⤵
  PID:8012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9212 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9088 /prefetch:1
  2⤵
  PID:9228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10604 /prefetch:1
  2⤵
  PID:10832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1312 /prefetch:1
  2⤵
  PID:8280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9080 /prefetch:1
  2⤵
  PID:7604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11548 /prefetch:1
  2⤵
  PID:11176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=142 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11944 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=143 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10884 /prefetch:1
  2⤵
  PID:8760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=144 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11844 /prefetch:1
  2⤵
  PID:8440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=145 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8840 /prefetch:1
  2⤵
  PID:11776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=147 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=148 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11868 /prefetch:1
  2⤵
  PID:14424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2000,5846572620969467790,920721151744889289,131072 --lang=es --service-sandbox-type=collections --mojo-platform-channel-handle=12120 /prefetch:8
  2⤵
  PID:12428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5872

C:\Program Files\Avast Software\Cleanup\TuneupSvc.exe
"C:\Program Files\Avast Software\Cleanup\TuneupSvc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:9312

C:\Program Files\Avast Software\Cleanup\TuneupUI.exe
"C:\Program Files\Avast Software\Cleanup\TuneupUI.exe" /afterinstall
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:11100
- C:\Program Files\Avast Software\Cleanup\TuneupUI.exe
  "C:\Program Files\Avast Software\Cleanup\TuneupUI.exe" --type=gpu-process --field-trial-handle=2648,14650475901098163585,9113689466231708879,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,ForcedColors,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --no-sandbox --disable-gpu-driver-bug-workarounds --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Cleanup\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --gpu-preferences=SAAAAAAAAADgAABwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Cleanup\log\cef_log.txt" --mojo-platform-channel-handle=2688 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:9808
- C:\Program Files\Avast Software\Cleanup\TuneupUI.exe
  "C:\Program Files\Avast Software\Cleanup\TuneupUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2648,14650475901098163585,9113689466231708879,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,ForcedColors,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=none --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Cleanup\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Cleanup\log\cef_log.txt" --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:10180
- C:\Program Files\Avast Software\Cleanup\TuneupUI.exe
  "C:\Program Files\Avast Software\Cleanup\TuneupUI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2648,14650475901098163585,9113689466231708879,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,ForcedColors,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=utility --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Cleanup\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Cleanup\log\cef_log.txt" --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:10280
- C:\Program Files\Avast Software\Cleanup\TuneupUI.exe
  "C:\Program Files\Avast Software\Cleanup\TuneupUI.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Cleanup\log\cef_log.txt" --field-trial-handle=2648,14650475901098163585,9113689466231708879,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,ForcedColors,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Cleanup\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium" --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:10852
- C:\Program Files\Avast Software\Cleanup\TuneupUI.exe
  "C:\Program Files\Avast Software\Cleanup\TuneupUI.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Cleanup\log\cef_log.txt" --field-trial-handle=2648,14650475901098163585,9113689466231708879,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,ForcedColors,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Cleanup\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium" --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:9192
- C:\Program Files\Avast Software\Cleanup\TuneupUI.exe
  "C:\Program Files\Avast Software\Cleanup\TuneupUI.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Cleanup\log\cef_log.txt" --field-trial-handle=2648,14650475901098163585,9113689466231708879,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,ForcedColors,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Cleanup\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium" --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:9164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s NlaSvc
1⤵
- Modifies data under HKEY_USERS
PID:9640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9592 -ip 9592
1⤵
PID:9196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 9592 -ip 9592
1⤵
PID:5692

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
PID:8648
- C:\Program Files\McAfee\WebAdvisor\UIHost.exe
  "C:\Program Files\McAfee\WebAdvisor\UIHost.exe"
  2⤵
  PID:9432
- C:\Program Files\McAfee\WebAdvisor\updater.exe
  "C:\Program Files\McAfee\WebAdvisor\updater.exe"
  2⤵
  PID:11200

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
PID:10516

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:6568

C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe
"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" -Embedding
1⤵
PID:7112
- C:\Users\Admin\Wavesor Software\SWUpdater\Install\{36FC9A58-302B-4527-8973-62A30341C2BD}\WaveInstaller-v1.5.20.2.exe
  "C:\Users\Admin\Wavesor Software\SWUpdater\Install\{36FC9A58-302B-4527-8973-62A30341C2BD}\WaveInstaller-v1.5.20.2.exe" /installerdata="C:\Users\Admin\AppData\Local\Temp\gui33C3.tmp"
  2⤵
  PID:9456
- - C:\Users\Admin\AppData\Local\Temp\nse36C1.tmp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\nse36C1.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\nse36C1.tmp\wavebrowser.packed.7z" --wid=g4n8u0t2 --installerdata="C:\Users\Admin\AppData\Local\Temp\gui33C3.tmp"
    3⤵
    PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\nse36C1.tmp\setup.exe
      C:\Users\Admin\AppData\Local\Temp\nse36C1.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Crashpad" --annotation=channel= --annotation=plat=Win64 --annotation=prod=WaveBrowser --annotation=ver=1.5.20.2 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff77a2d8980,0x7ff77a2d898c,0x7ff77a2d8998
      4⤵
      PID:12084
  - - C:\Users\Admin\AppData\Local\Temp\nse36C1.tmp\setup.exe
      "C:\Users\Admin\AppData\Local\Temp\nse36C1.tmp\setup.exe" --verbose-logging --installerdata="C:\Users\Admin\AppData\Local\Temp\gui33C3.tmp" --create-shortcuts=0 --install-level=0
      4⤵
      PID:12472
    - - C:\Users\Admin\AppData\Local\Temp\nse36C1.tmp\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\nse36C1.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Crashpad" --annotation=channel= --annotation=plat=Win64 --annotation=prod=WaveBrowser --annotation=ver=1.5.20.2 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff77a2d8980,0x7ff77a2d898c,0x7ff77a2d8998
        5⤵
        
        PID:10408
  - - C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
      "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --install-type=1 --from-installer
      4⤵
      PID:9460
    - - C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
        
        "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\WaveBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\WaveBrowser\User Data" --annotation=channel= --annotation=plat=Win64 --annotation=prod=WaveBrowser --annotation=ver=1.5.20.2 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff995396cf8,0x7ff995396d04,0x7ff995396d10
        5⤵
        
        PID:12976
- C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe
  "C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTM1LjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzUuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9InswRjU2RUUwOC0zRDk3LTRCNUEtQUU0MC0yOEVBNjg1OUZBNkN9IiB1c2VyaWQ9InthZjI3MzI2NS01M2ZlLTRlNmMtYjdiOS01NDAxY2JiYjM2ZjJ9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHJlcXVlc3RpZD0ie0RENjEzRjI5LUM0MzgtNDgwNy04N0JDLTI0NjU1MzQzRkQyMH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntFQjE0OUFEMi1DRTRFLTRGNTEtQjdGQy1BMTQ5RkFBNENDQUZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjUuMjAuMiIgbGFuZz0iZXMiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cHM6Ly9jZG4uc3d1cGRhdGVyLmNvbS9idWlsZC9XYXZlQnJvd3Nlci9zdGFibGUvd2luLzExMjA5ODc3NzQ5NzgvNjQvV2F2ZUluc3RhbGxlci12MS41LjIwLjIuZXhlIiBkb3dubG9hZGVkPSIxMDQwNjU4MDAiIHRvdGFsPSIxMDQwNjU4MDAiIGRvd25sb2FkX3RpbWVfbXM9IjkwOTciLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI0NzEiIGRvd25sb2FkX3RpbWVfbXM9IjEwMDY3IiBkb3dubG9hZGVkPSIxMDQwNjU4MDAiIHRvdGFsPSIxMDQwNjU4MDAiIGluc3RhbGxfdGltZV9tcz0iMTUzOTIiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5260

C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --strtl=ti
1⤵
PID:9836
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\WaveBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\WaveBrowser\User Data" --annotation=channel= --annotation=plat=Win64 --annotation=prod=WaveBrowser --annotation=ver=1.5.20.2 --initial-client-data=0x108,0x104,0x124,0xb0,0x128,0x7ff995396cf8,0x7ff995396d04,0x7ff995396d10
  2⤵
  PID:7036
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2044,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:10596
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --start-stack-profiler --field-trial-handle=1812,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  PID:10752
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2352,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=2364 /prefetch:13
  2⤵
  PID:8188
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3268,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:11764
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3096,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=3364 /prefetch:9
  2⤵
  PID:8608
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=4004,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=4020 /prefetch:14
  2⤵
  PID:6228
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4472,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=4396 /prefetch:14
  2⤵
  PID:9248
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4468,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=4500 /prefetch:14
  2⤵
  PID:8948
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4612,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:10528
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4632,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:8300
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4668,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:9120
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4692,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:7760
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4708,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:7684
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4740,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:6036
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4756,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:12576
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4772,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:8848
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --instant-process --enable-dinosaur-easter-egg-alt-images --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4784,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:8600
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=6156,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:11156
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=6184,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:12300
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6200,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:12484
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6216,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:8916
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6232,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:13084
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6248,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:12460
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6264,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:5748
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=6280,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:9356
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7508,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7560 /prefetch:14
  2⤵
  PID:8776
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7548,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7600 /prefetch:14
  2⤵
  PID:9812
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7568,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7856 /prefetch:14
  2⤵
  PID:11788
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7552,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8048 /prefetch:14
  2⤵
  PID:11940
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7544,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8204 /prefetch:14
  2⤵
  PID:10736
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8020,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8348 /prefetch:14
  2⤵
  PID:11920
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8000,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8484 /prefetch:14
  2⤵
  PID:5448
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7996,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8636 /prefetch:14
  2⤵
  PID:9248
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8036,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8660 /prefetch:14
  2⤵
  PID:11284
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=8956,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8988 /prefetch:1
  2⤵
  PID:10924
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9480,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9496 /prefetch:14
  2⤵
  PID:5400
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9516,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9464 /prefetch:14
  2⤵
  PID:12100
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9468,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9792 /prefetch:14
  2⤵
  PID:10636
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=10096,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10120 /prefetch:9
  2⤵
  PID:10920
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=10212,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10152 /prefetch:1
  2⤵
  PID:8932
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=10228,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10568 /prefetch:1
  2⤵
  PID:4852
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7524,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10248 /prefetch:12
  2⤵
  PID:13404
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9944,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10892 /prefetch:14
  2⤵
  PID:13572
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9804,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11124 /prefetch:14
  2⤵
  PID:13800
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10900,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11272 /prefetch:14
  2⤵
  PID:13812
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10996,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11296 /prefetch:14
  2⤵
  PID:13824
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10956,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11440 /prefetch:14
  2⤵
  PID:13836
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10976,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11704 /prefetch:14
  2⤵
  PID:14048
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10932,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11784 /prefetch:14
  2⤵
  PID:14156
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=11808,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11988 /prefetch:14
  2⤵
  PID:14316
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=11836,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=12132 /prefetch:14
  2⤵
  PID:14328
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=11700,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11820 /prefetch:14
  2⤵
  PID:13400
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7564,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8324 /prefetch:14
  2⤵
  PID:13632
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8624,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7620 /prefetch:14
  2⤵
  PID:13656
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7556,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11280 /prefetch:14
  2⤵
  PID:13652
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10284,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11112 /prefetch:14
  2⤵
  PID:13268
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7560,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=12100 /prefetch:14
  2⤵
  PID:400
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7648,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10336 /prefetch:14
  2⤵
  PID:13768
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8648,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11452 /prefetch:14
  2⤵
  PID:11032
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8800,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=12024 /prefetch:14
  2⤵
  PID:13920
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7656,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11884 /prefetch:14
  2⤵
  PID:9076
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8812,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11612 /prefetch:14
  2⤵
  PID:13828
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7604,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11200 /prefetch:14
  2⤵
  PID:7112
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=12144,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=12248 /prefetch:14
  2⤵
  PID:8784
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7608,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7624 /prefetch:14
  2⤵
  PID:12640
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6768,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=6760 /prefetch:14
  2⤵
  PID:13948
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7572,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9888 /prefetch:14
  2⤵
  PID:10220
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7908,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9900 /prefetch:14
  2⤵
  PID:12972
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4104,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7912 /prefetch:14
  2⤵
  PID:8808
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7972,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8140 /prefetch:14
  2⤵
  PID:13612
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8456,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9932 /prefetch:14
  2⤵
  PID:13608
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8164,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8152 /prefetch:14
  2⤵
  PID:13384
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8412,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8436 /prefetch:14
  2⤵
  PID:14228
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8300,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7960 /prefetch:14
  2⤵
  PID:13980
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=11756,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8408 /prefetch:14
  2⤵
  PID:14040
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9576,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7804 /prefetch:14
  2⤵
  PID:2888
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8288,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11744 /prefetch:14
  2⤵
  PID:8204
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10908,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=12516 /prefetch:14
  2⤵
  PID:14004
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5976,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=12540 /prefetch:14
  2⤵
  PID:13372
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=12796,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=12808 /prefetch:14
  2⤵
  PID:13440
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=12368,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=12832 /prefetch:14
  2⤵
  PID:6296
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=13092,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=13104 /prefetch:14
  2⤵
  PID:11152
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --field-trial-handle=13284,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=13308 /prefetch:9
  2⤵
  PID:14652
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5924,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=13400 /prefetch:14
  2⤵
  PID:14740
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7384,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=13540 /prefetch:14
  2⤵
  PID:14752
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=13408,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=13692 /prefetch:14
  2⤵
  PID:14764
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=13096,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=13852 /prefetch:14
  2⤵
  PID:14836
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=13420,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=13996 /prefetch:14
  2⤵
  PID:15232
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=14132,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=14140 /prefetch:14
  2⤵
  PID:14420
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5928,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=14284 /prefetch:14
  2⤵
  PID:15144
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=14432,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=14444 /prefetch:14
  2⤵
  PID:15344
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=14576,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=14588 /prefetch:14
  2⤵
  PID:14408
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=14436,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=14732 /prefetch:14
  2⤵
  PID:14584
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=13836,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=14880 /prefetch:14
  2⤵
  PID:14924
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --field-trial-handle=15096,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=15168 /prefetch:9
  2⤵
  PID:15000
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --field-trial-handle=15044,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10044 /prefetch:9
  2⤵
  PID:13624
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --field-trial-handle=15200,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8744 /prefetch:9
  2⤵
  PID:14340
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --field-trial-handle=15216,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7640 /prefetch:9
  2⤵
  PID:14348
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --field-trial-handle=15300,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9856 /prefetch:9
  2⤵
  PID:14392
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --field-trial-handle=7644,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=15808 /prefetch:9
  2⤵
  PID:14396
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=15296,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=16084 /prefetch:14
  2⤵
  PID:10312
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --field-trial-handle=15024,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=16152 /prefetch:9
  2⤵
  PID:14440
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --field-trial-handle=8656,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=16404 /prefetch:9
  2⤵
  PID:14592
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --field-trial-handle=15348,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=16472 /prefetch:9
  2⤵
  PID:14468
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --field-trial-handle=15428,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=16748 /prefetch:9
  2⤵
  PID:13904
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --field-trial-handle=16988,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8180 /prefetch:1
  2⤵
  PID:14964
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --field-trial-handle=16928,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=15960 /prefetch:9
  2⤵
  PID:12200
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --field-trial-handle=14596,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=15336 /prefetch:1
  2⤵
  PID:13928
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6736,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=6304 /prefetch:14
  2⤵
  PID:14836
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7684,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=17020 /prefetch:14
  2⤵
  PID:14556
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --field-trial-handle=13780,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=17112 /prefetch:1
  2⤵
  PID:15232
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --field-trial-handle=14872,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=16348 /prefetch:1
  2⤵
  PID:14088
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --field-trial-handle=16768,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11876 /prefetch:1
  2⤵
  PID:13704
- C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe
  "C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --field-trial-handle=16656,i,17123678998072583233,14268153005946913615,262144 --variations-seed-version=15 --mojo-platform-channel-handle=16724 /prefetch:9
  2⤵
  PID:7416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:14096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:14172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery