4b42a1d0c570587e8085d5f9aa0f012f4f1a0726ebc70d361fd75991b2fe5c55

pid	Process
1508	chrome.exe
4220	chrome.exe
4068	chrome.exe
3700	msedge.exe
6700	chrome.exe
2896	chrome.exe
1348	chrome.exe
6300	chrome.exe
6872	chrome.exe
708	chrome.exe
4564	chrome.exe
2380	chrome.exe
2548	chrome.exe
4124	chrome.exe
5000	chrome.exe
5112	chrome.exe
604	chrome.exe
1744	chrome.exe
2116	chrome.exe
5476	chrome.exe
5148	chrome.exe
1152	chrome.exe
6708	chrome.exe
3384	msedge.exe
1172	chrome.exe
2768	chrome.exe
5620	chrome.exe
3024	chrome.exe
6716	chrome.exe
3508	chrome.exe
6900	chrome.exe
4264	chrome.exe
948	msedge.exe
4140	chrome.exe
4244	chrome.exe
4976	msedge.exe
5628	chrome.exe
5868	msedge.exe
6484	chrome.exe
6476	chrome.exe
6260	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
4860	gamev5.exe
2220	gamev5.exe
1340	gamev5.exe

Loads dropped DLL 10 IoCs

pid	Process
4860	gamev5.exe
4860	gamev5.exe
4860	gamev5.exe
2220	gamev5.exe
1340	gamev5.exe
2220	gamev5.exe
2220	gamev5.exe
2220	gamev5.exe
2220	gamev5.exe
2220	gamev5.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

persistence privilege_escalation

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
6220	tasklist.exe
6908	tasklist.exe
2876	tasklist.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2C056E0E50D0AF41.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI625A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5951a3.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC55C0A4204BFCF5D.TMP	msiexec.exe
File created	C:\Windows\Installer\e5951a1.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF48F0FA8A4F85A4C.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B804D15D-390C-450E-9010-2D13F20530CC}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA6125FFCBB415156.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5951a1.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4232	msiexec.exe

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2560	cmd.exe
5404	cmd.exe
1132	cmd.exe
812	cmd.exe
3872	cmd.exe
4120	cmd.exe
5836	cmd.exe
5140	cmd.exe
2000	cmd.exe
3520	cmd.exe
5768	cmd.exe
6176	cmd.exe
6864	cmd.exe

System Time Discovery 1 TTPs 7 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1516	chrome.exe
4900	chrome.exe
4248	chrome.exe
3192	chrome.exe
4664	chrome.exe
2100	chrome.exe
3332	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000f2192634d2a4d980000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010f2192630000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010f219263000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30f21926300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60f21926300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 9 IoCs

defense_evasion

pid	Process
2628	taskkill.exe
2304	taskkill.exe
4188	taskkill.exe
692	taskkill.exe
1820	taskkill.exe
2100	taskkill.exe
1800	taskkill.exe
2260	taskkill.exe
2804	taskkill.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1388	msiexec.exe
1388	msiexec.exe
3696	WMIC.exe
3696	WMIC.exe
3696	WMIC.exe
3696	WMIC.exe
708	chrome.exe
708	chrome.exe
2896	chrome.exe
2896	chrome.exe
2768	chrome.exe
2768	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
708	chrome.exe
708	chrome.exe
708	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4232	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4232	msiexec.exe
Token: SeSecurityPrivilege	1388	msiexec.exe
Token: SeCreateTokenPrivilege	4232	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4232	msiexec.exe
Token: SeLockMemoryPrivilege	4232	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4232	msiexec.exe
Token: SeMachineAccountPrivilege	4232	msiexec.exe
Token: SeTcbPrivilege	4232	msiexec.exe
Token: SeSecurityPrivilege	4232	msiexec.exe
Token: SeTakeOwnershipPrivilege	4232	msiexec.exe
Token: SeLoadDriverPrivilege	4232	msiexec.exe
Token: SeSystemProfilePrivilege	4232	msiexec.exe
Token: SeSystemtimePrivilege	4232	msiexec.exe
Token: SeProfSingleProcessPrivilege	4232	msiexec.exe
Token: SeIncBasePriorityPrivilege	4232	msiexec.exe
Token: SeCreatePagefilePrivilege	4232	msiexec.exe
Token: SeCreatePermanentPrivilege	4232	msiexec.exe
Token: SeBackupPrivilege	4232	msiexec.exe
Token: SeRestorePrivilege	4232	msiexec.exe
Token: SeShutdownPrivilege	4232	msiexec.exe
Token: SeDebugPrivilege	4232	msiexec.exe
Token: SeAuditPrivilege	4232	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4232	msiexec.exe
Token: SeChangeNotifyPrivilege	4232	msiexec.exe
Token: SeRemoteShutdownPrivilege	4232	msiexec.exe
Token: SeUndockPrivilege	4232	msiexec.exe
Token: SeSyncAgentPrivilege	4232	msiexec.exe
Token: SeEnableDelegationPrivilege	4232	msiexec.exe
Token: SeManageVolumePrivilege	4232	msiexec.exe
Token: SeImpersonatePrivilege	4232	msiexec.exe
Token: SeCreateGlobalPrivilege	4232	msiexec.exe
Token: SeBackupPrivilege	2368	vssvc.exe
Token: SeRestorePrivilege	2368	vssvc.exe
Token: SeAuditPrivilege	2368	vssvc.exe
Token: SeBackupPrivilege	1388	msiexec.exe
Token: SeRestorePrivilege	1388	msiexec.exe
Token: SeRestorePrivilege	1388	msiexec.exe
Token: SeTakeOwnershipPrivilege	1388	msiexec.exe
Token: SeBackupPrivilege	264	srtasks.exe
Token: SeRestorePrivilege	264	srtasks.exe
Token: SeSecurityPrivilege	264	srtasks.exe
Token: SeTakeOwnershipPrivilege	264	srtasks.exe
Token: SeBackupPrivilege	264	srtasks.exe
Token: SeRestorePrivilege	264	srtasks.exe
Token: SeSecurityPrivilege	264	srtasks.exe
Token: SeTakeOwnershipPrivilege	264	srtasks.exe
Token: SeRestorePrivilege	1388	msiexec.exe
Token: SeTakeOwnershipPrivilege	1388	msiexec.exe
Token: SeRestorePrivilege	1388	msiexec.exe
Token: SeTakeOwnershipPrivilege	1388	msiexec.exe
Token: SeRestorePrivilege	1388	msiexec.exe
Token: SeTakeOwnershipPrivilege	1388	msiexec.exe
Token: SeRestorePrivilege	1388	msiexec.exe
Token: SeTakeOwnershipPrivilege	1388	msiexec.exe
Token: SeRestorePrivilege	1388	msiexec.exe
Token: SeTakeOwnershipPrivilege	1388	msiexec.exe
Token: SeRestorePrivilege	1388	msiexec.exe
Token: SeTakeOwnershipPrivilege	1388	msiexec.exe
Token: SeRestorePrivilege	1388	msiexec.exe
Token: SeTakeOwnershipPrivilege	1388	msiexec.exe
Token: SeRestorePrivilege	1388	msiexec.exe
Token: SeTakeOwnershipPrivilege	1388	msiexec.exe
Token: SeRestorePrivilege	1388	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4232	msiexec.exe
4232	msiexec.exe
708	chrome.exe
2896	chrome.exe
2768	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4232	msiexec.exe
1388	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 264	1388	msiexec.exe	94
PID 1388 wrote to memory of 4860	1388	msiexec.exe	98
PID 4860 wrote to memory of 2560	4860	gamev5.exe	99
PID 2560 wrote to memory of 3696	2560	cmd.exe	101
PID 4860 wrote to memory of 1132	4860	gamev5.exe	103
PID 4860 wrote to memory of 2000	4860	gamev5.exe	104
PID 2000 wrote to memory of 2304	2000	cmd.exe	131
PID 1132 wrote to memory of 2876	1132	cmd.exe	108
PID 4860 wrote to memory of 708	4860	gamev5.exe	109
PID 708 wrote to memory of 4912	708	chrome.exe	110
PID 4860 wrote to memory of 2220	4860	gamev5.exe	111
PID 4860 wrote to memory of 2220	4860	gamev5.exe	111
PID 4860 wrote to memory of 1340	4860	gamev5.exe	112
PID 708 wrote to memory of 1516	708	chrome.exe	113
PID 708 wrote to memory of 996	708	chrome.exe	114
PID 708 wrote to memory of 996	708	chrome.exe	114
PID 708 wrote to memory of 4424	708	chrome.exe	115
PID 708 wrote to memory of 4424	708	chrome.exe	115
PID 708 wrote to memory of 2380	708	chrome.exe	117
PID 708 wrote to memory of 2380	708	chrome.exe	117
PID 708 wrote to memory of 5628	708	chrome.exe	118
PID 708 wrote to memory of 5628	708	chrome.exe	118
PID 708 wrote to memory of 4564	708	chrome.exe	119
PID 708 wrote to memory of 4564	708	chrome.exe	119
PID 4860 wrote to memory of 5404	4860	gamev5.exe	120
PID 5404 wrote to memory of 1820	5404	cmd.exe	122
PID 4860 wrote to memory of 4140	4860	gamev5.exe	123
PID 4140 wrote to memory of 3804	4140	chrome.exe	124
PID 4860 wrote to memory of 812	4860	gamev5.exe	125
PID 812 wrote to memory of 2100	812	cmd.exe	182
PID 4860 wrote to memory of 2896	4860	gamev5.exe	128
PID 2896 wrote to memory of 4372	2896	chrome.exe	129
PID 2896 wrote to memory of 4248	2896	chrome.exe	130
PID 2896 wrote to memory of 2304	2896	chrome.exe	131
PID 2896 wrote to memory of 2304	2896	chrome.exe	131
PID 2896 wrote to memory of 2516	2896	chrome.exe	133
PID 2896 wrote to memory of 2516	2896	chrome.exe	133
PID 2896 wrote to memory of 1172	2896	chrome.exe	134
PID 2896 wrote to memory of 1744	2896	chrome.exe	135
PID 2896 wrote to memory of 1172	2896	chrome.exe	134
PID 2896 wrote to memory of 1744	2896	chrome.exe	135
PID 2896 wrote to memory of 2116	2896	chrome.exe	136
PID 2896 wrote to memory of 2116	2896	chrome.exe	136
PID 2896 wrote to memory of 4920	2896	chrome.exe	137
PID 2896 wrote to memory of 4920	2896	chrome.exe	137
PID 4860 wrote to memory of 3520	4860	gamev5.exe	138
PID 3520 wrote to memory of 1800	3520	cmd.exe	140
PID 4860 wrote to memory of 2768	4860	gamev5.exe	141
PID 2768 wrote to memory of 3944	2768	chrome.exe	142
PID 2768 wrote to memory of 5740	2768	chrome.exe	171
PID 2768 wrote to memory of 4900	2768	chrome.exe	144
PID 2768 wrote to memory of 5740	2768	chrome.exe	171
PID 2768 wrote to memory of 2520	2768	chrome.exe	145
PID 2768 wrote to memory of 2520	2768	chrome.exe	145
PID 2768 wrote to memory of 5148	2768	chrome.exe	147
PID 2768 wrote to memory of 5476	2768	chrome.exe	148
PID 2768 wrote to memory of 5148	2768	chrome.exe	147
PID 2768 wrote to memory of 5476	2768	chrome.exe	148
PID 2768 wrote to memory of 5620	2768	chrome.exe	149
PID 2768 wrote to memory of 5620	2768	chrome.exe	149
PID 2768 wrote to memory of 1120	2768	chrome.exe	150
PID 2768 wrote to memory of 1120	2768	chrome.exe	150
PID 4860 wrote to memory of 3872	4860	gamev5.exe	151
PID 3872 wrote to memory of 2260	3872	cmd.exe	153

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4b42a1d0c570587e8085d5f9aa0f012f4f1a0726ebc70d361fd75991b2fe5c55.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4232

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:264
- C:\Users\Admin\AppData\Local\Programs\gamev5\gamev5.exe
  "C:\Users\Admin\AppData\Local\Programs\gamev5\gamev5.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Windows\System32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:/Program Files/Google/Chrome/Application/chrome.exe" --restore-last-session --remote-debugging-port=9184 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --window-position=-32000,-32000 --headless https://mail.google.com
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0xa0,0x138,0x7ffea370c728,0x7ffea370c734,0x7ffea370c740
      4⤵
      PID:4912
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1920,i,33418720177994602,97935323485293116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:11
      4⤵
      System Time Discovery
      PID:1516
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,33418720177994602,97935323485293116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
      4⤵
      PID:996
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1920,i,33418720177994602,97935323485293116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:13
      4⤵
      PID:4424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9184 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1920,i,33418720177994602,97935323485293116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9184 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1920,i,33418720177994602,97935323485293116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9184 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1920,i,33418720177994602,97935323485293116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4564
- - C:\Users\Admin\AppData\Local\Programs\gamev5\gamev5.exe
    "C:\Users\Admin\AppData\Local\Programs\gamev5\gamev5.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\gamev5" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1876 --field-trial-handle=1880,i,16359438596481282161,18156264854594046514,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2220
- - C:\Users\Admin\AppData\Local\Programs\gamev5\gamev5.exe
    "C:\Users\Admin\AppData\Local\Programs\gamev5\gamev5.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\gamev5" --mojo-platform-channel-handle=2296 --field-trial-handle=1880,i,16359438596481282161,18156264854594046514,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:1820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:/Program Files/Google/Chrome/Application/chrome.exe" --restore-last-session --remote-debugging-port=9185 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --window-position=-32000,-32000 --headless https://mail.google.com
    3⤵
    - Uses browser remote debugging
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffea370c728,0x7ffea370c734,0x7ffea370c740
      4⤵
      PID:3804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:812
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:/Program Files/Google/Chrome/Application/chrome.exe" --restore-last-session --remote-debugging-port=9186 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --window-position=-32000,-32000 --headless https://mail.google.com
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0xa4,0x138,0x7ffea6dbc728,0x7ffea6dbc734,0x7ffea6dbc740
      4⤵
      PID:4372
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1976,i,4275691300235160600,16912620170511071312,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:11
      4⤵
      System Time Discovery
      PID:4248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1976,i,4275691300235160600,16912620170511071312,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
      4⤵
      PID:2304
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1976,i,4275691300235160600,16912620170511071312,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:13
      4⤵
      PID:2516
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9186 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1976,i,4275691300235160600,16912620170511071312,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1172
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9186 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1976,i,4275691300235160600,16912620170511071312,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1744
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9186 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1976,i,4275691300235160600,16912620170511071312,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2116
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1976,i,4275691300235160600,16912620170511071312,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14
      4⤵
      PID:4920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:1800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:/Program Files/Google/Chrome/Application/chrome.exe" --restore-last-session --remote-debugging-port=9187 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --window-position=-32000,-32000 --headless https://mail.google.com
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffea6dbc728,0x7ffea6dbc734,0x7ffea6dbc740
      4⤵
      PID:3944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,6059295228648032097,9760204654672689733,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:2
      4⤵
      PID:5740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1832,i,6059295228648032097,9760204654672689733,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:11
      4⤵
      System Time Discovery
      PID:4900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1832,i,6059295228648032097,9760204654672689733,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:13
      4⤵
      PID:2520
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9187 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1832,i,6059295228648032097,9760204654672689733,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9187 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1832,i,6059295228648032097,9760204654672689733,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9187 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1832,i,6059295228648032097,9760204654672689733,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5620
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1832,i,6059295228648032097,9760204654672689733,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14
      4⤵
      PID:1120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:/Program Files/Google/Chrome/Application/chrome.exe" --restore-last-session --remote-debugging-port=9188 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --window-position=-32000,-32000 --headless https://mail.google.com
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    PID:1508
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffea6dbc728,0x7ffea6dbc734,0x7ffea6dbc740
      4⤵
      PID:4632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1924,i,16638578064410717840,9845723313014419553,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
      4⤵
      System Time Discovery
      PID:3192
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1924,i,16638578064410717840,9845723313014419553,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
      4⤵
      PID:3404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,16638578064410717840,9845723313014419553,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:13
      4⤵
      PID:3232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9188 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1924,i,16638578064410717840,9845723313014419553,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9188 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1924,i,16638578064410717840,9845723313014419553,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9188 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1924,i,16638578064410717840,9845723313014419553,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,16638578064410717840,9845723313014419553,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
      4⤵
      PID:4256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4120
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:4188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:/Program Files/Google/Chrome/Application/chrome.exe" --restore-last-session --remote-debugging-port=9189 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --window-position=-32000,-32000 --headless https://mail.google.com
    3⤵
    - Uses browser remote debugging
    PID:4124
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffea6dbc728,0x7ffea6dbc734,0x7ffea6dbc740
      4⤵
      PID:3108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,600617594980011968,10206937440018057247,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
      4⤵
      PID:5496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1908,i,600617594980011968,10206937440018057247,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:11
      4⤵
      System Time Discovery
      PID:4664
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1908,i,600617594980011968,10206937440018057247,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:13
      4⤵
      PID:604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9189 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1908,i,600617594980011968,10206937440018057247,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4244
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9189 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1908,i,600617594980011968,10206937440018057247,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5000
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9189 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1908,i,600617594980011968,10206937440018057247,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1152
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1908,i,600617594980011968,10206937440018057247,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:14
      4⤵
      PID:6100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5836
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:/Program Files/Google/Chrome/Application/chrome.exe" --restore-last-session --remote-debugging-port=9190 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --window-position=-32000,-32000 --headless https://mail.google.com
    3⤵
    - Uses browser remote debugging
    PID:5112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffea6dbc728,0x7ffea6dbc734,0x7ffea6dbc740
      4⤵
      PID:2936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:11
      4⤵
      System Time Discovery
      PID:2100
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
      4⤵
      PID:5692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:13
      4⤵
      PID:764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9190 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9190 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3024
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9190 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
      4⤵
      PID:692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9190 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9190 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9190 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6700
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9190 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9190 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9190 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
      4⤵
      PID:5800
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:4512
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9190 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3508
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9190 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6260
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9190 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
      4⤵
      PID:6272
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
      4⤵
      PID:4776
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9190 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9190 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:6872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
      4⤵
      PID:4408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
      4⤵
      PID:6384
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1920,i,7381716114659855026,5442123656773768558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:6360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5140
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:2628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --restore-last-session --remote-debugging-port=9184 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --window-position=-32000,-32000 --headless https://mail.google.com
    3⤵
    - Uses browser remote debugging
    PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x280,0x7ffea476c188,0x7ffea476c194,0x7ffea476c1a0
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2336,i,18400651040548307246,15904067902925080457,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:11
      4⤵
      System Time Discovery
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2336,i,18400651040548307246,15904067902925080457,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9184 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2336,i,18400651040548307246,15904067902925080457,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2336,i,18400651040548307246,15904067902925080457,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:13
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9184 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2336,i,18400651040548307246,15904067902925080457,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9184 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2336,i,18400651040548307246,15904067902925080457,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9184 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2336,i,18400651040548307246,15904067902925080457,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5768
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    PID:6176
  - - C:\Windows\System32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    PID:6864
  - - C:\Windows\System32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6908

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2100

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5740

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3384

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:7076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Modify Authentication Process

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Authentication Process

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery