Câu 101: GCIH: GIAC Certified Incident Handler

Which of the following statements describes the Volatility pstree plugin data shown in the image?

1. A. Notepad.exe was launched with Administrative privileges
2. B. Firefox.exe was the parent process for Explorer.exe — đáp án hiện tại
3. C. Cmd.exe was used to launch Powershell.exe
4. D. Cmd.exe was the child process of OneDrive.exe