66b5c83436316979f3ccb48f440683aa760745b4caa2f71b8658390da7712307

Analysis

max time kernel
12s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
26/07/2024, 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ExeBomb.exe
Size

6KB
MD5

9f659d2064a2753f67c6ac950dccefc2
SHA1

3549bfc7896a841ab2b2ecebfd825263f4c7e4d2
SHA256

66b5c83436316979f3ccb48f440683aa760745b4caa2f71b8658390da7712307
SHA512

6be8112b4dc924b91d4619256072648035e0cbf509544c5f9e24af639ef45caf13023750ec0d2ffa8b02b71375cd0aa9105cfc22918020bb0070638897763b5c
SSDEEP

48:6wGJ8JkQU96crcZRR/FInZTiY7sFhSr6AVNMjA8LqGbAeeOOc0W0tp/TVgDJWZsW:WQU6WcdjFsf6sp1OO5W0ttVgeNrWzNt

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExeBomb.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
10000	pingsender.exe

C:\Users\Admin\AppData\Local\Temp\ExeBomb.exe
"C:\Users\Admin\AppData\Local\Temp\ExeBomb.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4780
- C:\Windows\WinSxS\msil_addinprocess_b77a5c561934e089_10.0.22000.1_none_f1c351dedf09f213\AddInProcess.exe
  "C:\Windows\WinSxS\msil_addinprocess_b77a5c561934e089_10.0.22000.1_none_f1c351dedf09f213\AddInProcess.exe"
  2⤵
  PID:2144
- C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_10.0.22000.1_none_129f03fe4394fb1a\AddInUtil.exe
  "C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_10.0.22000.1_none_129f03fe4394fb1a\AddInUtil.exe"
  2⤵
  PID:5112
- C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.22000.100_none_a1709384527830fe\SecurityHealthService.exe
  "C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.22000.100_none_a1709384527830fe\SecurityHealthService.exe"
  2⤵
  PID:948
- C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.22000.100_none_a1709384527830fe\SecurityHealthHost.exe
  "C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.22000.100_none_a1709384527830fe\SecurityHealthHost.exe"
  2⤵
  PID:2520
- C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseIR.exe
  "C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseIR.exe"
  2⤵
  PID:2236
- C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseCM.exe
  "C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseCM.exe"
  2⤵
  PID:4652
- C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\MsSense.exe
  "C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\MsSense.exe"
  2⤵
  PID:4728
- C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseCncProxy.exe
  "C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseCncProxy.exe"
  2⤵
  PID:5040
- C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.22000.1_none_1be9c0745b95a762\MsMpEng.exe
  "C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.22000.1_none_1be9c0745b95a762\MsMpEng.exe"
  2⤵
  PID:4744
- C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseCE.exe
  "C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseCE.exe"
  2⤵
  PID:1404
- C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.22000.1_none_1be9c0745b95a762\MpCopyAccelerator.exe
  "C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.22000.1_none_1be9c0745b95a762\MpCopyAccelerator.exe"
  2⤵
  PID:1532
- C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseSampleUploader.exe
  "C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseSampleUploader.exe"
  2⤵
  PID:4900
- C:\Windows\WinSxS\amd64_windows-defender-management-v1_31bf3856ad364e35_10.0.22000.1_none_70e9301c0d12b212\ConfigSecurityPolicy.exe
  "C:\Windows\WinSxS\amd64_windows-defender-management-v1_31bf3856ad364e35_10.0.22000.1_none_70e9301c0d12b212\ConfigSecurityPolicy.exe"
  2⤵
  PID:1056
- C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.22000.1_none_1be9c0745b95a762\MpDlpCmd.exe
  "C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.22000.1_none_1be9c0745b95a762\MpDlpCmd.exe"
  2⤵
  PID:5004
- C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.22000.1_none_1be9c0745b95a762\MpCmdRun.exe
  "C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.22000.1_none_1be9c0745b95a762\MpCmdRun.exe"
  2⤵
  PID:1440
- C:\Windows\WinSxS\amd64_wcf-wsatconfig_b03f5f7f11d50a3a_10.0.22000.1_none_a03bdcb625ffa5d4\WsatConfig.exe
  "C:\Windows\WinSxS\amd64_wcf-wsatconfig_b03f5f7f11d50a3a_10.0.22000.1_none_a03bdcb625ffa5d4\WsatConfig.exe"
  2⤵
  PID:2156
- C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.22000.1_none_dd3404b7c9d94b9f\AppHostRegistrationVerifier.exe
  "C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.22000.1_none_dd3404b7c9d94b9f\AppHostRegistrationVerifier.exe"
  2⤵
  PID:1976
- C:\Windows\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.22000.1_none_9ae99fb14da6ce82\OfflineScannerShell.exe
  "C:\Windows\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.22000.1_none_9ae99fb14da6ce82\OfflineScannerShell.exe"
  2⤵
  PID:2832
- C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseNdr.exe
  "C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseNdr.exe"
  2⤵
  PID:1912
- C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.22000.100_none_bac6834bfb16b20d\SecurityHealthSystray.exe
  "C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.22000.100_none_bac6834bfb16b20d\SecurityHealthSystray.exe"
  2⤵
  PID:1776
- C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.22000.1_none_74363da717b88af3\NisSrv.exe
  "C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.22000.1_none_74363da717b88af3\NisSrv.exe"
  2⤵
  PID:4240
- C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.22000.194_none_17fbd7504b9de242\SIHClient.exe
  "C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.22000.194_none_17fbd7504b9de242\SIHClient.exe"
  2⤵
  PID:328
- C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.22000.1_none_b04edc9391a3bdbd\SgrmBroker.exe
  "C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.22000.1_none_b04edc9391a3bdbd\SgrmBroker.exe"
  2⤵
  PID:716
- C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.22000.1_none_12ea1a72b4886bec\scp.exe
  "C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.22000.1_none_12ea1a72b4886bec\scp.exe"
  2⤵
  PID:4572
- C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_10.0.22000.1_none_6c30c077bfa76b21\RegAsm.exe
  "C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_10.0.22000.1_none_6c30c077bfa76b21\RegAsm.exe"
  2⤵
  PID:820
- C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.22000.1_none_b04edc9391a3bdbd\SgrmLpac.exe
  "C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.22000.1_none_b04edc9391a3bdbd\SgrmLpac.exe"
  2⤵
  PID:1876
- C:\Windows\WinSxS\amd64_netfx35linq-addinutil_31bf3856ad364e35_10.0.22000.1_none_2161d6cde824ee93\AddInUtil.exe
  "C:\Windows\WinSxS\amd64_netfx35linq-addinutil_31bf3856ad364e35_10.0.22000.1_none_2161d6cde824ee93\AddInUtil.exe"
  2⤵
  PID:3888
- C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_4.0.15806.0_none_4535bd2753202ac7\RegSvcs.exe
  "C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_4.0.15806.0_none_4535bd2753202ac7\RegSvcs.exe"
  2⤵
  PID:2252
- C:\Windows\WinSxS\amd64_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.22000.1_none_ad50534eecd177c9\LinqWebConfig.exe
  "C:\Windows\WinSxS\amd64_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.22000.1_none_ad50534eecd177c9\LinqWebConfig.exe"
  2⤵
  PID:4476
- C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.22000.1_none_5640d9ef21678ad0\ssh.exe
  "C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.22000.1_none_5640d9ef21678ad0\ssh.exe"
  2⤵
  PID:4632
- C:\Windows\WinSxS\amd64_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.22000.1_none_7512c1e2929b66b7\mscorsvw.exe
  "C:\Windows\WinSxS\amd64_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.22000.1_none_7512c1e2929b66b7\mscorsvw.exe"
  2⤵
  PID:276
- C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.22000.1_none_12ea1a72b4886bec\ssh-keygen.exe
  "C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.22000.1_none_12ea1a72b4886bec\ssh-keygen.exe"
  2⤵
  PID:3288
- C:\Windows\WinSxS\amd64_netfx-dfsvc_b03f5f7f11d50a3a_10.0.22000.1_none_5f1e3da0bccf23b8\dfsvc.exe
  "C:\Windows\WinSxS\amd64_netfx-dfsvc_b03f5f7f11d50a3a_10.0.22000.1_none_5f1e3da0bccf23b8\dfsvc.exe"
  2⤵
  PID:1332
- C:\Windows\WinSxS\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.22000.1_none_53953f4ad73d0675\csc.exe
  "C:\Windows\WinSxS\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.22000.1_none_53953f4ad73d0675\csc.exe"
  2⤵
  PID:996
- C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_10.0.22000.1_none_3f4beb1e121a63d1\RegSvcs.exe
  "C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_10.0.22000.1_none_3f4beb1e121a63d1\RegSvcs.exe"
  2⤵
  PID:1560
- C:\Windows\WinSxS\amd64_netfx35linq-addinprocess_31bf3856ad364e35_10.0.22000.1_none_86dac86e5184145e\AddInProcess.exe
  "C:\Windows\WinSxS\amd64_netfx35linq-addinprocess_31bf3856ad364e35_10.0.22000.1_none_86dac86e5184145e\AddInProcess.exe"
  2⤵
  PID:940
- C:\Windows\WinSxS\amd64_netfx35linq-edmgen_31bf3856ad364e35_10.0.22000.1_none_04bf95b840a7a7c9\EdmGen.exe
  "C:\Windows\WinSxS\amd64_netfx35linq-edmgen_31bf3856ad364e35_10.0.22000.1_none_04bf95b840a7a7c9\EdmGen.exe"
  2⤵
  PID:3752
- C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.22000.1_none_49da5498936ff387\CertEnrollCtrl.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.22000.1_none_49da5498936ff387\CertEnrollCtrl.exe"
  2⤵
  PID:1168
- C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.22000.1_none_5640d9ef21678ad0\ssh-keyscan.exe
  "C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.22000.1_none_5640d9ef21678ad0\ssh-keyscan.exe"
  2⤵
  PID:4528
- C:\Windows\WinSxS\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.22000.1_none_3adcb6f6de313c9e\cvtres.exe
  "C:\Windows\WinSxS\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.22000.1_none_3adcb6f6de313c9e\cvtres.exe"
  2⤵
  PID:5060
- C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_4.0.15806.0_none_721a928100ad3217\RegAsm.exe
  "C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_4.0.15806.0_none_721a928100ad3217\RegAsm.exe"
  2⤵
  PID:1404
- C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.22000.1_none_12ea1a72b4886bec\ssh-agent.exe
  "C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.22000.1_none_12ea1a72b4886bec\ssh-agent.exe"
  2⤵
  PID:1136
- C:\Windows\WinSxS\amd64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.22000.1_none_af37ae793d4cfdf0\xwizard.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.22000.1_none_af37ae793d4cfdf0\xwizard.exe"
  2⤵
  PID:4848
- C:\Windows\WinSxS\amd64_netfx-dw_b03f5f7f11d50a3a_10.0.22000.1_none_22b90aadc55bb953\dw20.exe
  "C:\Windows\WinSxS\amd64_netfx-dw_b03f5f7f11d50a3a_10.0.22000.1_none_22b90aadc55bb953\dw20.exe"
  2⤵
  PID:480
- C:\Windows\WinSxS\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_10.0.22000.1_none_e59a7bd2a1bf4e0f\DataSvcUtil.exe
  "C:\Windows\WinSxS\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_10.0.22000.1_none_e59a7bd2a1bf4e0f\DataSvcUtil.exe"
  2⤵
  PID:4940
- C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.22000.1_none_ae9fb5eb30be85c5\WFServicesReg.exe
  "C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.22000.1_none_ae9fb5eb30be85c5\WFServicesReg.exe"
  2⤵
  PID:4644
- C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.22000.1_none_5640d9ef21678ad0\sftp.exe
  "C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.22000.1_none_5640d9ef21678ad0\sftp.exe"
  2⤵
  PID:1668
- C:\Windows\WinSxS\amd64_microsoft-windows-write_31bf3856ad364e35_10.0.22000.1_none_b5c66fd5e1e0f0bf\write.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-write_31bf3856ad364e35_10.0.22000.1_none_b5c66fd5e1e0f0bf\write.exe"
  2⤵
  PID:1868
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:4476
- C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.22000.120_none_8fd8aab412295721\wlrmdr.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.22000.120_none_8fd8aab412295721\wlrmdr.exe"
  2⤵
  PID:2528
- C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.22000.1_none_12ea1a72b4886bec\ssh-add.exe
  "C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.22000.1_none_12ea1a72b4886bec\ssh-add.exe"
  2⤵
  PID:1752
- C:\Windows\WinSxS\amd64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.22000.1_none_b939484ef91552eb\xcopy.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.22000.1_none_b939484ef91552eb\xcopy.exe"
  2⤵
  PID:5040
- C:\Windows\WinSxS\amd64_netfx-ngen_exe_b03f5f7f11d50a3a_10.0.22000.1_none_ccd97e50f4c65861\ngen.exe
  "C:\Windows\WinSxS\amd64_netfx-ngen_exe_b03f5f7f11d50a3a_10.0.22000.1_none_ccd97e50f4c65861\ngen.exe"
  2⤵
  PID:2632
- C:\Windows\WinSxS\amd64_netfx35linq-csharp_31bf3856ad364e35_10.0.22000.1_none_6d6f4cb018f2ec3c\csc.exe
  "C:\Windows\WinSxS\amd64_netfx35linq-csharp_31bf3856ad364e35_10.0.22000.1_none_6d6f4cb018f2ec3c\csc.exe"
  2⤵
  PID:4012
- C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.22000.318_none_2c6abfb5896ecf7f\wininit.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.22000.318_none_2c6abfb5896ecf7f\wininit.exe"
  2⤵
  PID:2180
- C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.22000.282_none_6ae954e75a4dd338\winlogon.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.22000.282_none_6ae954e75a4dd338\winlogon.exe"
  2⤵
  PID:3140
- C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.22000.120_none_8fd8aab412295721\mpnotify.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.22000.120_none_8fd8aab412295721\mpnotify.exe"
  2⤵
  PID:2116
- C:\Windows\WinSxS\amd64_microsoft-windows-where_31bf3856ad364e35_10.0.22000.1_none_b416d6c5e2f3a677\where.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-where_31bf3856ad364e35_10.0.22000.1_none_b416d6c5e2f3a677\where.exe"
  2⤵
  PID:1348
- C:\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.22000.120_none_26a3fe1b7073b18d\sfc.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.22000.120_none_26a3fe1b7073b18d\sfc.exe"
  2⤵
  PID:5012
- C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.22000.434_none_eef51ebf13d8d8a1\CertEnrollCtrl.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.22000.434_none_eef51ebf13d8d8a1\CertEnrollCtrl.exe"
  2⤵
  PID:4412
- C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.22000.51_none_57505afc50444312\WinBioDataModelOOBE.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.22000.51_none_57505afc50444312\WinBioDataModelOOBE.exe"
  2⤵
  PID:3060
- C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.22000.493_none_a9fee4e32efd000a\wuauclt.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.22000.493_none_a9fee4e32efd000a\wuauclt.exe"
  2⤵
  PID:3604
- C:\Windows\WinSxS\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_10.0.22000.1_none_d1d8957ebc230c6a\WinSAT.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_10.0.22000.1_none_d1d8957ebc230c6a\WinSAT.exe"
  2⤵
  PID:1092
- C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.22000.1_none_6cefaf05d980bc3b\UserAccountBroker.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.22000.1_none_6cefaf05d980bc3b\UserAccountBroker.exe"
  2⤵
  PID:3940
- C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.22000.37_none_4ebd7bd997a97fcb\wifitask.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.22000.37_none_4ebd7bd997a97fcb\wifitask.exe"
  2⤵
  PID:3660
- C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.22000.194_none_841924fc9a413271\wimserv.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.22000.194_none_841924fc9a413271\wimserv.exe"
  2⤵
  PID:1824
- C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\runexehelper.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\runexehelper.exe"
  2⤵
  PID:3588
- C:\Windows\WinSxS\amd64_microsoft-windows-whoami_31bf3856ad364e35_10.0.22000.1_none_24c01bfc869f3c31\whoami.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-whoami_31bf3856ad364e35_10.0.22000.1_none_24c01bfc869f3c31\whoami.exe"
  2⤵
  PID:2684
- C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.282_none_55f322479d33cb0a\VSSVC.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.282_none_55f322479d33cb0a\VSSVC.exe"
  2⤵
  PID:3232
- C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.22000.194_none_a9ffdf7b2efc21ec\wuauclt.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.22000.194_none_a9ffdf7b2efc21ec\wuauclt.exe"
  2⤵
  PID:2040
- C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.469_none_560fc7f19d1d3ed7\VSSVC.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.469_none_560fc7f19d1d3ed7\VSSVC.exe"
  2⤵
  PID:4560
- C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\dtdump.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\dtdump.exe"
  2⤵
  PID:180
- C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.22000.1_none_87bb487f5d189323\TSWbPrxy.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.22000.1_none_87bb487f5d189323\TSWbPrxy.exe"
  2⤵
  PID:4964
- C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.22000.120_none_0e11f85980658aa8\ShellAppRuntime.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.22000.120_none_0e11f85980658aa8\ShellAppRuntime.exe"
  2⤵
  PID:2144
- C:\Windows\WinSxS\amd64_microsoft-windows-userdeviceregistration_31bf3856ad364e35_10.0.22000.1_none_6f9cd989a95b27f0\dsregcmd.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-userdeviceregistration_31bf3856ad364e35_10.0.22000.1_none_6f9cd989a95b27f0\dsregcmd.exe"
  2⤵
  PID:3428
- C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.22000.1_none_998102c905a7b94f\prevhost.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.22000.1_none_998102c905a7b94f\prevhost.exe"
  2⤵
  PID:1420
- C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.120_none_83fc3979242f7e2e\CustomShellHost.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.120_none_83fc3979242f7e2e\CustomShellHost.exe"
  2⤵
  PID:1012
- - C:\Windows\explorer.exe
    explorer.exe /NoShellRegistrationCheck
    3⤵
    PID:820
- C:\Windows\WinSxS\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.22000.1_none_5917b556ccc10b5e\shutdown.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.22000.1_none_5917b556ccc10b5e\shutdown.exe"
  2⤵
  PID:2236
- C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_6f399112972db672\MusNotificationUx.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_6f399112972db672\MusNotificationUx.exe"
  2⤵
  PID:1484
- C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_f9601eae71d90785\TpmTool.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_f9601eae71d90785\TpmTool.exe"
  2⤵
  PID:4916
- C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.469_none_04a25ac34c904574\poqexec.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.469_none_04a25ac34c904574\poqexec.exe"
  2⤵
  PID:3820
- C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.469_none_04a25ac34c904574\TiWorker.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.469_none_04a25ac34c904574\TiWorker.exe"
  2⤵
  PID:2128
- C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_5fa2feeecc138dd4\TiWorker.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_5fa2feeecc138dd4\TiWorker.exe"
  2⤵
  PID:2008
- C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.22000.1_none_2c29ad827f986a34\TSTheme.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.22000.1_none_2c29ad827f986a34\TSTheme.exe"
  2⤵
  PID:2464
- C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.22000.282_none_8a68951ea6251dba\wkspbroker.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.22000.282_none_8a68951ea6251dba\wkspbroker.exe"
  2⤵
  PID:1056
- C:\Windows\WinSxS\amd64_microsoft-windows-s..up-drivepreparation_31bf3856ad364e35_10.0.22000.1_none_f73525016dc68d1a\BdeHdCfg.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-s..up-drivepreparation_31bf3856ad364e35_10.0.22000.1_none_f73525016dc68d1a\BdeHdCfg.exe"
  2⤵
  PID:5044
- C:\Windows\WinSxS\amd64_microsoft-windows-shell-oneoffs-em_31bf3856ad364e35_10.0.22000.318_none_ed2b4c25cc173a5f\EM.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-shell-oneoffs-em_31bf3856ad364e35_10.0.22000.318_none_ed2b4c25cc173a5f\EM.exe"
  2⤵
  PID:3176
- C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.280_none_0483b4854ca89ef9\TiWorker.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.280_none_0483b4854ca89ef9\TiWorker.exe"
  2⤵
  PID:5192
- C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.22000.469_none_8c502cfed26c810b\TrustedInstaller.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.22000.469_none_8c502cfed26c810b\TrustedInstaller.exe"
  2⤵
  PID:5200
- C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.469_none_04a25ac34c904574\TiFileFetcher.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.469_none_04a25ac34c904574\TiFileFetcher.exe"
  2⤵
  PID:5240
- C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.22000.1_none_30a652d7a8697eb8\BitLockerDeviceEncryption.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.22000.1_none_30a652d7a8697eb8\BitLockerDeviceEncryption.exe"
  2⤵
  PID:5268
- C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.22000.1_none_b9b90ea0c63699c2\RdpSaProxy.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.22000.1_none_b9b90ea0c63699c2\RdpSaProxy.exe"
  2⤵
  PID:5292
- C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.280_none_0483b4854ca89ef9\TiFileFetcher.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.280_none_0483b4854ca89ef9\TiFileFetcher.exe"
  2⤵
  PID:5300
- C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_5fa2feeecc138dd4\TiFileFetcher.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_5fa2feeecc138dd4\TiFileFetcher.exe"
  2⤵
  PID:5340
- C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.280_none_0483b4854ca89ef9\poqexec.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.280_none_0483b4854ca89ef9\poqexec.exe"
  2⤵
  PID:5380
- C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.22000.1_none_95efb09bcb1d48b8\ShapeCollector.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.22000.1_none_95efb09bcb1d48b8\ShapeCollector.exe"
  2⤵
  PID:5388
- C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.22000.1_none_a061a9a7af162f02\spaceman.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.22000.1_none_a061a9a7af162f02\spaceman.exe"
  2⤵
  PID:5416
- C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_5fa2feeecc138dd4\poqexec.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_5fa2feeecc138dd4\poqexec.exe"
  2⤵
  PID:5476
- C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.22000.1_none_95efb09bcb1d48b8\InputPersonalization.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.22000.1_none_95efb09bcb1d48b8\InputPersonalization.exe"
  2⤵
  PID:5496
- C:\Windows\WinSxS\amd64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.22000.120_none_9c5aa041b6a59db2\RMActivate.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.22000.120_none_9c5aa041b6a59db2\RMActivate.exe"
  2⤵
  PID:5520
- C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_f927204bf41f3d61\quickassist.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_f927204bf41f3d61\quickassist.exe"
  2⤵
  PID:5532
- C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.22000.258_none_570e91ed5ac8ebe3\Microsoft.AAD.BrokerPlugin.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.22000.258_none_570e91ed5ac8ebe3\Microsoft.AAD.BrokerPlugin.exe"
  2⤵
  PID:5804
- C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.469_none_83da02152447c976\CustomShellHost.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.469_none_83da02152447c976\CustomShellHost.exe"
  2⤵
  PID:5828
- - C:\Windows\explorer.exe
    explorer.exe /NoShellRegistrationCheck
    3⤵
    PID:5948
- C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.22000.65_none_99e34b544b7754a7\provtool.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.22000.65_none_99e34b544b7754a7\provtool.exe"
  2⤵
  PID:5848
- C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_eb1a21d23daf2030\NcsiUwpApp.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_eb1a21d23daf2030\NcsiUwpApp.exe"
  2⤵
  PID:5884
- C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.22000.282_none_8c338754d2830d3e\TrustedInstaller.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.22000.282_none_8c338754d2830d3e\TrustedInstaller.exe"
  2⤵
  PID:5892
- C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.22000.1_none_f3742a79955a9d97\ctfmon.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.22000.1_none_f3742a79955a9d97\ctfmon.exe"
  2⤵
  PID:5932
- C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.22000.1_none_f24d5bd1a5bd0380\resmon.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.22000.1_none_f24d5bd1a5bd0380\resmon.exe"
  2⤵
  PID:5940
- - C:\Windows\System32\perfmon.exe
    "C:\Windows\System32\perfmon.exe" /res
    3⤵
    PID:820
- C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.22000.1_none_c0cc1dd788bbd3ed\provlaunch.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.22000.1_none_c0cc1dd788bbd3ed\provlaunch.exe"
  2⤵
  PID:6044
- C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.22000.1_none_0bfef7470a16d155\svchost.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.22000.1_none_0bfef7470a16d155\svchost.exe"
  2⤵
  PID:5288
- C:\Windows\WinSxS\amd64_microsoft-windows-n..pture-wmiv2provider_31bf3856ad364e35_10.0.22000.1_none_3ad96689f86d60ce\NetEvtFwdr.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-n..pture-wmiv2provider_31bf3856ad364e35_10.0.22000.1_none_3ad96689f86d60ce\NetEvtFwdr.exe"
  2⤵
  PID:5360
- C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.22000.120_none_8faca973dc064b74\NarratorQuickStart.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.22000.120_none_8faca973dc064b74\NarratorQuickStart.exe"
  2⤵
  PID:5684
- C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.22000.1_none_e4c8388cb4892f1c\BackgroundTransferHost.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.22000.1_none_e4c8388cb4892f1c\BackgroundTransferHost.exe"
  2⤵
  PID:3032
- C:\Windows\WinSxS\amd64_microsoft-windows-s..executionprevention_31bf3856ad364e35_10.0.22000.1_none_20270749296283d2\SystemPropertiesDataExecutionPrevention.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-s..executionprevention_31bf3856ad364e35_10.0.22000.1_none_20270749296283d2\SystemPropertiesDataExecutionPrevention.exe"
  2⤵
  PID:1824
- C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.22000.71_none_688486d306b27285\msinfo32.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.22000.71_none_688486d306b27285\msinfo32.exe"
  2⤵
  PID:2128
- C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_8e1bee8f157fdd6d\msinfo32.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_8e1bee8f157fdd6d\msinfo32.exe"
  2⤵
  PID:1404
- C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.22000.1_none_04376727db53ed5d\unregmp2.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.22000.1_none_04376727db53ed5d\unregmp2.exe"
  2⤵
  PID:4300
- C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.22000.1_none_418429ddc6d1eb8f\logagent.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.22000.1_none_418429ddc6d1eb8f\logagent.exe"
  2⤵
  PID:2216
- C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.22000.1_none_713e4e4444c3d34d\wmlaunch.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.22000.1_none_713e4e4444c3d34d\wmlaunch.exe"
  2⤵
  PID:5872
- C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.22000.1_none_04376727db53ed5d\setup_wm.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.22000.1_none_04376727db53ed5d\setup_wm.exe"
  2⤵
  PID:6008
- C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.22000.1_none_f24d5bd1a5bd0380\perfmon.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.22000.1_none_f24d5bd1a5bd0380\perfmon.exe"
  2⤵
  PID:6056
- C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.22000.348_none_a3b217b55cca1de2\IESettingSync.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.22000.348_none_a3b217b55cca1de2\IESettingSync.exe"
  2⤵
  PID:5472
- C:\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.22000.1_none_30b748e419e103b5\iscsicli.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.22000.1_none_30b748e419e103b5\iscsicli.exe"
  2⤵
  PID:1092
- C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.22000.318_none_a3d287795cb1ca0f\IESettingSync.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.22000.318_none_a3d287795cb1ca0f\IESettingSync.exe"
  2⤵
  PID:5260
- C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.282_none_04af1ce80d4a389a\ie4ushowIE.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.282_none_04af1ce80d4a389a\ie4ushowIE.exe"
  2⤵
  PID:5668
- C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.22000.1_none_7ae3697a4deac0fe\ImagingDevices.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.22000.1_none_7ae3697a4deac0fe\ImagingDevices.exe"
  2⤵
  PID:2556
- C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.282_none_04af1ce80d4a389a\ie4uinit.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.282_none_04af1ce80d4a389a\ie4uinit.exe"
  2⤵
  PID:2784
- C:\Windows\WinSxS\amd64_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.22000.1_none_63ba7822f6e64972\odbcconf.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.22000.1_none_63ba7822f6e64972\odbcconf.exe"
  2⤵
  PID:2616
- C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.22000.1_none_72d0f19d01454ec8\ieinstal.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.22000.1_none_72d0f19d01454ec8\ieinstal.exe"
  2⤵
  PID:6048
- C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.22000.194_none_ecba39f8d9cbe846\bdechangepin.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.22000.194_none_ecba39f8d9cbe846\bdechangepin.exe"
  2⤵
  PID:420
- C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.22000.120_none_f759261c81fa2ed8\SecureAssessmentBrowser.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.22000.120_none_f759261c81fa2ed8\SecureAssessmentBrowser.exe"
  2⤵
  PID:4892
- C:\Windows\WinSxS\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.22000.1_none_f9cba295aacd52e9\ucsvc.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.22000.1_none_f9cba295aacd52e9\ucsvc.exe"
  2⤵
  PID:4640
- C:\Windows\WinSxS\amd64_microsoft-windows-proquota_31bf3856ad364e35_10.0.22000.1_none_7e0a957d972e3b59\proquota.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-proquota_31bf3856ad364e35_10.0.22000.1_none_7e0a957d972e3b59\proquota.exe"
  2⤵
  PID:2568
- C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.22000.1_none_544784bd2f04ca1d\SensorDataService.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.22000.1_none_544784bd2f04ca1d\SensorDataService.exe"
  2⤵
  PID:2296
- C:\Windows\WinSxS\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_97c4601a91ef2a4b\mfpmp.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_97c4601a91ef2a4b\mfpmp.exe"
  2⤵
  PID:640
- C:\Windows\WinSxS\amd64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.22000.1_none_f8cbc2844276ec6f\grpconv.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.22000.1_none_f8cbc2844276ec6f\grpconv.exe"
  2⤵
  PID:4884
- C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.22000.1_none_bb5ad6287475565d\gpscript.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.22000.1_none_bb5ad6287475565d\gpscript.exe"
  2⤵
  PID:5888
- C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.22000.1_none_7d7329085e7dbaf4\findstr.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.22000.1_none_7d7329085e7dbaf4\findstr.exe"
  2⤵
  PID:6188
- C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.22000.1_none_a3f177b107b8418a\dmclient.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.22000.1_none_a3f177b107b8418a\dmclient.exe"
  2⤵
  PID:6232
- C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.22000.1_none_c36af850083330df\PresentationSettings.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.22000.1_none_c36af850083330df\PresentationSettings.exe"
  2⤵
  PID:6280
- C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.22000.376_none_742ed331adb702b6\FXSCOVER.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.22000.376_none_742ed331adb702b6\FXSCOVER.exe"
  2⤵
  PID:6288
- C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.22000.376_none_742ed331adb702b6\WFS.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.22000.376_none_742ed331adb702b6\WFS.exe"
  2⤵
  PID:6296
- C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.22000.1_none_cf3d4a0d2d2f7851\WFS.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.22000.1_none_cf3d4a0d2d2f7851\WFS.exe"
  2⤵
  PID:6352
- C:\Windows\WinSxS\amd64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.22000.1_none_d679057128e7af90\RmClient.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.22000.1_none_d679057128e7af90\RmClient.exe"
  2⤵
  PID:6368
- C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.22000.120_none_64d060998298410d\FileExplorer.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.22000.120_none_64d060998298410d\FileExplorer.exe"
  2⤵
  PID:6412
- C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.22000.71_none_152ef1c98c20fad4\fodhelper.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.22000.71_none_152ef1c98c20fad4\fodhelper.exe"
  2⤵
  PID:6436
- C:\Windows\WinSxS\amd64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.22000.1_none_316d384508ae771e\extrac32.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.22000.1_none_316d384508ae771e\extrac32.exe"
  2⤵
  PID:6568
- C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.65_none_a2e87bc198c20e5a\wevtutil.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.65_none_a2e87bc198c20e5a\wevtutil.exe"
  2⤵
  PID:6648
- C:\Windows\WinSxS\amd64_microsoft-windows-security-easinvoker_31bf3856ad364e35_10.0.22000.1_none_e267df21b2c3a4b4\easinvoker.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-security-easinvoker_31bf3856ad364e35_10.0.22000.1_none_e267df21b2c3a4b4\easinvoker.exe"
  2⤵
  PID:6696
- C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.22000.1_none_5151408d797c08f9\wecutil.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.22000.1_none_5151408d797c08f9\wecutil.exe"
  2⤵
  PID:6800
- C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.469_none_bc172f1a0215d298\wevtutil.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.469_none_bc172f1a0215d298\wevtutil.exe"
  2⤵
  PID:6808
- C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.22000.120_none_c4a02f7c0324c157\SearchApp.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.22000.120_none_c4a02f7c0324c157\SearchApp.exe"
  2⤵
  PID:6816
- C:\Windows\WinSxS\amd64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.22000.1_none_4cb865a88c5f8f71\efsui.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.22000.1_none_4cb865a88c5f8f71\efsui.exe"
  2⤵
  PID:6824
- C:\Windows\WinSxS\amd64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.22000.1_none_10af78bda18479ba\verifiergui.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.22000.1_none_10af78bda18479ba\verifiergui.exe"
  2⤵
  PID:6940
- C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.348_none_04e0603a0d245e07\ie4ushowIE.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.348_none_04e0603a0d245e07\ie4ushowIE.exe"
  2⤵
  PID:6948
- C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.22000.1_none_d08b70dc5fb929d4\DpiScaling.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.22000.1_none_d08b70dc5fb929d4\DpiScaling.exe"
  2⤵
  PID:6964
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" ms-settings:display
    3⤵
    PID:6192
- C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.22000.1_none_16e170d778007420\wmprph.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.22000.1_none_16e170d778007420\wmprph.exe"
  2⤵
  PID:6972
- C:\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.22000.1_none_38261a83872276db\dnscacheugc.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.22000.1_none_38261a83872276db\dnscacheugc.exe"
  2⤵
  PID:6992
- C:\Windows\WinSxS\amd64_microsoft-windows-dlna-mdeserver_31bf3856ad364e35_10.0.22000.1_none_2c4bd0ba27aaecad\MDEServer.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-dlna-mdeserver_31bf3856ad364e35_10.0.22000.1_none_2c4bd0ba27aaecad\MDEServer.exe"
  2⤵
  PID:7148
- C:\Windows\WinSxS\amd64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.22000.1_none_0812eff10a63b4d2\diskusage.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.22000.1_none_0812eff10a63b4d2\diskusage.exe"
  2⤵
  PID:6168
- C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.22000.1_none_43054e9f294487ea\DisplaySwitch.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.22000.1_none_43054e9f294487ea\DisplaySwitch.exe"
  2⤵
  PID:2504
- C:\Windows\WinSxS\amd64_microsoft-windows-diskraid_31bf3856ad364e35_10.0.22000.1_none_bbcd41b69cc34513\diskraid.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-diskraid_31bf3856ad364e35_10.0.22000.1_none_bbcd41b69cc34513\diskraid.exe"
  2⤵
  PID:6164
- C:\Windows\WinSxS\amd64_microsoft-windows-deviceproperties_31bf3856ad364e35_10.0.22000.1_none_408e00a93eb2182b\DeviceProperties.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-deviceproperties_31bf3856ad364e35_10.0.22000.1_none_408e00a93eb2182b\DeviceProperties.exe"
  2⤵
  PID:6300
- C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.22000.1_none_dabf9817b86a5921\recdisc.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.22000.1_none_dabf9817b86a5921\recdisc.exe"
  2⤵
  PID:5060
- C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.22000.1_none_cf3d4a0d2d2f7851\FXSCOVER.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.22000.1_none_cf3d4a0d2d2f7851\FXSCOVER.exe"
  2⤵
  PID:6640
- C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.22000.1_none_1dbf6d61cb1e8d8c\Defrag.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.22000.1_none_1dbf6d61cb1e8d8c\Defrag.exe"
  2⤵
  PID:6404
- C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.22000.1_none_b1116c83034868d0\BrowserCore.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.22000.1_none_b1116c83034868d0\BrowserCore.exe"
  2⤵
  PID:6240
- C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.22000.1_none_afdc224bc4473aa9\eudcedit.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.22000.1_none_afdc224bc4473aa9\eudcedit.exe"
  2⤵
  PID:6476
- C:\Windows\WinSxS\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.22000.1_none_2ba66e4a445cef6c\eventcreate.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.22000.1_none_2ba66e4a445cef6c\eventcreate.exe"
  2⤵
  PID:6784
- C:\Windows\WinSxS\amd64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.22000.1_none_8c9a2fb8a1b7c01a\ddodiag.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.22000.1_none_8c9a2fb8a1b7c01a\ddodiag.exe"
  2⤵
  PID:7108
- C:\Windows\WinSxS\amd64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.22000.1_none_087395c681a80760\IMJPSET.EXE
  "C:\Windows\WinSxS\amd64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.22000.1_none_087395c681a80760\IMJPSET.EXE"
  2⤵
  PID:6656
- C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.22000.1_none_d41670a1d239e747\dpapimig.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.22000.1_none_d41670a1d239e747\dpapimig.exe"
  2⤵
  PID:2520
- C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.22000.1_none_5e2e482310a0f2c5\rekeywiz.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.22000.1_none_5e2e482310a0f2c5\rekeywiz.exe"
  2⤵
  PID:6516
- C:\Windows\WinSxS\amd64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.22000.1_none_ec66691b99d2b34c\driverquery.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.22000.1_none_ec66691b99d2b34c\driverquery.exe"
  2⤵
  PID:6936
- C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.22000.1_none_90cfdfd0a3fa1534\IMEPADSV.EXE
  "C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.22000.1_none_90cfdfd0a3fa1534\IMEPADSV.EXE"
  2⤵
  PID:6928
- C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.22000.434_none_2ca09768f8a7e2e6\DiagnosticsHub.StandardCollector.Service.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.22000.434_none_2ca09768f8a7e2e6\DiagnosticsHub.StandardCollector.Service.exe"
  2⤵
  PID:4704
- C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.348_none_04e0603a0d245e07\ie4uinit.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.348_none_04e0603a0d245e07\ie4uinit.exe"
  2⤵
  PID:3240
- C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_d3608b4d6c1da7eb\subst.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_d3608b4d6c1da7eb\subst.exe"
  2⤵
  PID:6884
- C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.22000.1_none_bf1c03009ab5fa34\diskpart.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.22000.1_none_bf1c03009ab5fa34\diskpart.exe"
  2⤵
  PID:7144
- C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.22000.1_none_d6935f7d69086fe5\DiskSnapshot.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.22000.1_none_d6935f7d69086fe5\DiskSnapshot.exe"
  2⤵
  PID:6876
- C:\Windows\WinSxS\amd64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.22000.1_none_23fdac7926f37c5a\Windows.WARP.JITService.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.22000.1_none_23fdac7926f37c5a\Windows.WARP.JITService.exe"
  2⤵
  PID:2384
- C:\Windows\WinSxS\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.22000.1_none_c5e1ff5406d59ba1\DevicePairingWizard.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.22000.1_none_c5e1ff5406d59ba1\DevicePairingWizard.exe"
  2⤵
  PID:2364
- C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.22000.1_none_9b2806fb34e0407f\dispdiag.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.22000.1_none_9b2806fb34e0407f\dispdiag.exe"
  2⤵
  PID:1500
- C:\Windows\WinSxS\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.22000.1_none_87d7d1a32f788c55\reg.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.22000.1_none_87d7d1a32f788c55\reg.exe"
  2⤵
  PID:1148
- C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.22000.1_none_ef59ac64950e06d9\dfrgui.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.22000.1_none_ef59ac64950e06d9\dfrgui.exe"
  2⤵
  PID:2324
- C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.22000.1_none_0c0c8e31403fe0c1\omadmprc.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.22000.1_none_0c0c8e31403fe0c1\omadmprc.exe"
  2⤵
  PID:1532
- C:\Windows\WinSxS\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.22000.1_none_e0831539ba1f6df0\schtasks.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.22000.1_none_e0831539ba1f6df0\schtasks.exe"
  2⤵
  PID:3468
- C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.22000.1_none_3feb76eef41741bf\mtstocom.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.22000.1_none_3feb76eef41741bf\mtstocom.exe"
  2⤵
  PID:5412
- C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_f8757a3e115338fd\Microsoft.ECApp.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_f8757a3e115338fd\Microsoft.ECApp.exe"
  2⤵
  PID:5460
- C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.22000.469_none_5704c6175ad01b79\Microsoft.AAD.BrokerPlugin.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.22000.469_none_5704c6175ad01b79\Microsoft.AAD.BrokerPlugin.exe"
  2⤵
  PID:6352
- C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.22000.1_none_b60008c7dd9ead92\CompPkgSrv.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.22000.1_none_b60008c7dd9ead92\CompPkgSrv.exe"
  2⤵
  PID:5208
- C:\Windows\WinSxS\amd64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.22000.1_none_404d1be794382b1e\comrepl.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.22000.1_none_404d1be794382b1e\comrepl.exe"
  2⤵
  PID:2448
- C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.22000.1_none_8a2a9fc5ca3ef1e1\dwm.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.22000.1_none_8a2a9fc5ca3ef1e1\dwm.exe"
  2⤵
  PID:3172
- C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.22000.1_none_fddec9b335fe82b5\dxgiadaptercache.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.22000.1_none_fddec9b335fe82b5\dxgiadaptercache.exe"
  2⤵
  PID:7212
- C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-host_31bf3856ad364e35_10.0.22000.1_none_83af12232e1bdf0d\DismHost.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-host_31bf3856ad364e35_10.0.22000.1_none_83af12232e1bdf0d\DismHost.exe"
  2⤵
  PID:7272
- C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.22000.318_none_2cba3682f8941339\DiagnosticsHub.StandardCollector.Service.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.22000.318_none_2cba3682f8941339\DiagnosticsHub.StandardCollector.Service.exe"
  2⤵
  PID:7280
- C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.22000.1_none_3b4f9cda237a17ee\ChsIME.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.22000.1_none_3b4f9cda237a17ee\ChsIME.exe"
  2⤵
  PID:7352
- C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.22000.1_none_06eb615b4d01a4ce\dcomcnfg.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.22000.1_none_06eb615b4d01a4ce\dcomcnfg.exe"
  2⤵
  PID:7508
- - C:\Windows\system32\mmc.exe
    C:\Windows\system32\mmc.exe C:\Windows\system32\comexp.msc
    3⤵
    PID:7676
- C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_d3608b4d6c1da7eb\print.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_d3608b4d6c1da7eb\print.exe"
  2⤵
  PID:7516
- C:\Windows\WinSxS\amd64_microsoft-windows-corruptedfilerecovery_31bf3856ad364e35_10.0.22000.1_none_ddfd55862d9061d5\cofire.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-corruptedfilerecovery_31bf3856ad364e35_10.0.22000.1_none_ddfd55862d9061d5\cofire.exe"
  2⤵
  PID:7524
- C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe
  "C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe"
  2⤵
  PID:7928
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"
  2⤵
  PID:8056
- C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
  "C:\Windows\System32\wbem\WmiPrvSE.exe"
  2⤵
  PID:8176
- C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_d3608b4d6c1da7eb\doskey.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_d3608b4d6c1da7eb\doskey.exe"
  2⤵
  PID:8184
- C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe
  "C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe"
  2⤵
  PID:3012
- C:\Windows\SysWOW64\wbem\mofcomp.exe
  "C:\Windows\System32\wbem\mofcomp.exe"
  2⤵
  PID:7000
- C:\Windows\SysWOW64\wbem\WMIADAP.exe
  "C:\Windows\System32\wbem\WMIADAP.exe"
  2⤵
  PID:4640
- C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_28babea403fb06cb\CallingShellApp.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_28babea403fb06cb\CallingShellApp.exe"
  2⤵
  PID:7104
- C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.22000.120_none_0b04aa9dcb2db938\CredDialogHost.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.22000.120_none_0b04aa9dcb2db938\CredDialogHost.exe"
  2⤵
  PID:552
- C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe
  "C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe"
  2⤵
  PID:7712
- C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe
  "C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe"
  2⤵
  PID:7740
- C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe
  "C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe"
  2⤵
  PID:7688
- C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe
  "C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe"
  2⤵
  PID:7704
- C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.22000.1_none_b8730bce9cba86d4\wpr.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.22000.1_none_b8730bce9cba86d4\wpr.exe"
  2⤵
  PID:7728
- C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe
  "C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe"
  2⤵
  PID:7904
- C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.22000.100_none_c98e4ba1fbb1ffd8\WorkFolders.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.22000.100_none_c98e4ba1fbb1ffd8\WorkFolders.exe"
  2⤵
  PID:7520
- - C:\Windows\System32\control.exe
    "C:\Windows\System32\control.exe" /name Microsoft.Workfolders
    3⤵
    PID:8336
- C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.22000.1_none_c0a088f7530491ea\browserexport.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.22000.1_none_c0a088f7530491ea\browserexport.exe"
  2⤵
  PID:2080
- C:\Windows\WinSxS\amd64_microsoft-windows-label_31bf3856ad364e35_10.0.22000.1_none_ad72a96dcf11931c\label.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-label_31bf3856ad364e35_10.0.22000.1_none_ad72a96dcf11931c\label.exe"
  2⤵
  PID:7504
- C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_9ecf8c975ae30adc\replace.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_9ecf8c975ae30adc\replace.exe"
  2⤵
  PID:2156
- C:\Windows\SysWOW64\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe"
  2⤵
  PID:8060
- C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.22000.41_none_87f7650fac06c0f2\CredentialEnrollmentManager.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.22000.41_none_87f7650fac06c0f2\CredentialEnrollmentManager.exe"
  2⤵
  PID:5356
- C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.22000.1_none_e84b398796060bdb\CloudNotifications.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.22000.1_none_e84b398796060bdb\CloudNotifications.exe"
  2⤵
  PID:6484
- C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\wmpshare.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\wmpshare.exe"
  2⤵
  PID:7772
- C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe
  "C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe"
  2⤵
  PID:8220
- C:\Windows\SysWOW64\wbem\WinMgmt.exe
  "C:\Windows\System32\wbem\WinMgmt.exe"
  2⤵
  PID:8476
- C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe
  "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe"
  2⤵
  PID:8484
- C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe"
  2⤵
  PID:8784
- C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
  "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"
  2⤵
  PID:8808
- C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.22000.1_none_f318e861ad1b476f\convert.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.22000.1_none_f318e861ad1b476f\convert.exe"
  2⤵
  PID:8820
- C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe
  "C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe"
  2⤵
  PID:8932
- C:\Windows\WinSxS\amd64_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_10.0.22000.1_none_e08d858702e7237a\Eap3Host.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_10.0.22000.1_none_e08d858702e7237a\Eap3Host.exe"
  2⤵
  PID:8940
- C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.22000.1_none_9454ea72d50a2bf6\bootim.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.22000.1_none_9454ea72d50a2bf6\bootim.exe"
  2⤵
  PID:8948
- C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe
  "C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe"
  2⤵
  PID:8960
- C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe
  "C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe"
  2⤵
  PID:8968
- C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_9ecf8c975ae30adc\find.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_9ecf8c975ae30adc\find.exe"
  2⤵
  PID:8976
- C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.22000.1_none_7789bf018f4fe34a\LanguageComponentsInstallerComHandler.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.22000.1_none_7789bf018f4fe34a\LanguageComponentsInstallerComHandler.exe"
  2⤵
  PID:7564
- C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\wmplayer.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\wmplayer.exe"
  2⤵
  PID:656
- - C:\Windows\System32\unregmp2.exe
    "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
    3⤵
    PID:7420
- C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe
  "C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe"
  2⤵
  PID:3344
- C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe
  "C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe"
  2⤵
  PID:8608
- C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.22000.1_none_54e342fafa4dc4d4\DWWIN.EXE
  "C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.22000.1_none_54e342fafa4dc4d4\DWWIN.EXE"
  2⤵
  PID:9080
- C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.22000.1_none_165d5ffaf262c602\MuiUnattend.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.22000.1_none_165d5ffaf262c602\MuiUnattend.exe"
  2⤵
  PID:404
- C:\Program Files\VideoLAN\VLC\uninstall.exe
  "C:\Program Files\VideoLAN\VLC\uninstall.exe"
  2⤵
  PID:6304
- - C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
    "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Program Files\VideoLAN\VLC\
    3⤵
    PID:8352
- C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe
  "C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe"
  2⤵
  PID:6636
- C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.22000.1_none_05f7f490e9af5ded\MicrosoftEdgeDevTools.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.22000.1_none_05f7f490e9af5ded\MicrosoftEdgeDevTools.exe"
  2⤵
  PID:552
- C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\wmpconfig.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\wmpconfig.exe"
  2⤵
  PID:3012
- C:\Program Files\Windows Media Player\wmplayer.exe
  "C:\Program Files\Windows Media Player\wmplayer.exe"
  2⤵
  PID:8476
- - C:\Windows\System32\unregmp2.exe
    "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
    3⤵
    PID:8184
- C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe
  "C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe"
  2⤵
  PID:7212
- C:\Program Files\Mozilla Firefox\plugin-container.exe
  "C:\Program Files\Mozilla Firefox\plugin-container.exe"
  2⤵
  PID:7432
- C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe
  "C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe"
  2⤵
  PID:7388
- C:\Program Files\Mozilla Firefox\maintenanceservice.exe
  "C:\Program Files\Mozilla Firefox\maintenanceservice.exe"
  2⤵
  PID:2120
- C:\Windows\SysWOW64\SystemUWPLauncher.exe
  Microsoft.DesktopAppInstaller_8wekyb3d8bbwe!App PackagedDataInfo: "C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe"
  2⤵
  PID:6872
- C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.22000.1_none_9fc512728ae2f615\msiexec.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.22000.1_none_9fc512728ae2f615\msiexec.exe"
  2⤵
  PID:5460
- C:\Program Files\Mozilla Firefox\uninstall\helper.exe
  "C:\Program Files\Mozilla Firefox\uninstall\helper.exe"
  2⤵
  PID:3232
- - C:\Program Files\Mozilla Firefox\uninstall\uninstaller.exe
    "C:\Program Files\Mozilla Firefox\uninstall\uninstaller.exe"
    3⤵
    PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_B.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_B.exe" _?=C:\Program Files\Mozilla Firefox\uninstall\
      4⤵
      PID:8188
- C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\CallingShellApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\CallingShellApp.exe"
  2⤵
  PID:9208
- C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.22000.1_none_2fcf8aa3ca0a349d\esentutl.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.22000.1_none_2fcf8aa3ca0a349d\esentutl.exe"
  2⤵
  PID:8700
- C:\Program Files\Windows Media Player\wmpconfig.exe
  "C:\Program Files\Windows Media Player\wmpconfig.exe"
  2⤵
  PID:8328
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE"
  2⤵
  PID:8924
- C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.22000.318_none_94e400242f9bfd4a\control.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.22000.318_none_94e400242f9bfd4a\control.exe"
  2⤵
  PID:7400
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE"
  2⤵
  PID:7352
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:6220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:8820
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 25749 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9541256-3428-4b98-9596-d59ffe2a4cd2} 8820 "\\.\pipe\gecko-crash-server-pipe.8820" gpu
      4⤵
      PID:10108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2380 -prefMapHandle 2376 -prefsLen 25785 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ce2f7fc-4505-46d0-9ceb-6c7ea1b5ea34} 8820 "\\.\pipe\gecko-crash-server-pipe.8820" socket
      4⤵
      PID:9396
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3328 -childID 1 -isForBrowser -prefsHandle 3064 -prefMapHandle 3060 -prefsLen 25926 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f10ad931-d8c4-44ad-9c03-5a1327ce2e12} 8820 "\\.\pipe\gecko-crash-server-pipe.8820" tab
      4⤵
      PID:9772
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3108 -childID 2 -isForBrowser -prefsHandle 3120 -prefMapHandle 3264 -prefsLen 31159 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04369b17-f929-4129-95a5-91345b7779fc} 8820 "\\.\pipe\gecko-crash-server-pipe.8820" tab
      4⤵
      PID:10216
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4180 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4200 -prefMapHandle 4220 -prefsLen 31159 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d231c1b6-ae0c-433f-859a-26b435fd087f} 8820 "\\.\pipe\gecko-crash-server-pipe.8820" utility
      4⤵
      PID:9424
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5128 -childID 3 -isForBrowser -prefsHandle 4728 -prefMapHandle 5516 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e8d55cc-d3b6-4ba8-8cc1-43271f56ddd7} 8820 "\\.\pipe\gecko-crash-server-pipe.8820" tab
      4⤵
      PID:11176
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5772 -childID 4 -isForBrowser -prefsHandle 5752 -prefMapHandle 4728 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8627049e-50e4-4be1-80f8-95582a1c577e} 8820 "\\.\pipe\gecko-crash-server-pipe.8820" tab
      4⤵
      PID:10296
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5728 -childID 5 -isForBrowser -prefsHandle 5764 -prefMapHandle 5760 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {97e14958-3700-403b-9c1c-72a16170433a} 8820 "\\.\pipe\gecko-crash-server-pipe.8820" tab
      4⤵
      PID:10404
- C:\Program Files\Windows Photo Viewer\ImagingDevices.exe
  "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe"
  2⤵
  PID:9784
- C:\Program Files\Mozilla Firefox\pingsender.exe
  "C:\Program Files\Mozilla Firefox\pingsender.exe"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:10000
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE"
  2⤵
  PID:10100
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe
    3⤵
    PID:10144
- C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
  "C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe"
  2⤵
  PID:10160
- C:\Program Files\Mozilla Firefox\updater.exe
  "C:\Program Files\Mozilla Firefox\updater.exe"
  2⤵
  PID:10184
- C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE
  "C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE"
  2⤵
  PID:10196
- C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.22000.1_none_bb5cdd91d9f726ea\fsquirt.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.22000.1_none_bb5cdd91d9f726ea\fsquirt.exe"
  2⤵
  PID:10204
- C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE
  "C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE"
  2⤵
  PID:7420
- C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE
  "C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE"
  2⤵
  PID:9252
- C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE
  "C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE"
  2⤵
  PID:9368
- C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe"
  2⤵
  PID:9376
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  "C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe"
  2⤵
  PID:9576
- C:\Program Files\Windows Media Player\wmlaunch.exe
  "C:\Program Files\Windows Media Player\wmlaunch.exe"
  2⤵
  PID:9656
- C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.22000.1_none_2c5da28e7efb5c65\IMCCPHR.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.22000.1_none_2c5da28e7efb5c65\IMCCPHR.exe"
  2⤵
  PID:6056
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe"
  2⤵
  PID:10648
- C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe
  "C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe"
  2⤵
  PID:11196
- C:\Program Files\Mozilla Firefox\default-browser-agent.exe
  "C:\Program Files\Mozilla Firefox\default-browser-agent.exe"
  2⤵
  PID:1716
- C:\Program Files\Mozilla Firefox\minidump-analyzer.exe
  "C:\Program Files\Mozilla Firefox\minidump-analyzer.exe"
  2⤵
  PID:1552
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  PID:9232
- C:\Program Files\Microsoft Office\root\Office16\msoev.exe
  "C:\Program Files\Microsoft Office\root\Office16\msoev.exe"
  2⤵
  PID:9416
- - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /t "C:\Program Files\Microsoft Office\Root\Office16\1033\TelemetryLog.xltx" /x
    3⤵
    PID:11356
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE"
  2⤵
  PID:9444
- C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
  "C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe"
  2⤵
  PID:9720
- C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE
  "C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE"
  2⤵
  PID:10440
- C:\Program Files\Windows Media Player\setup_wm.exe
  "C:\Program Files\Windows Media Player\setup_wm.exe"
  2⤵
  PID:10468
- C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE
  "C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE"
  2⤵
  PID:10492
- C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
  "C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe"
  2⤵
  PID:6744
- C:\Program Files\Mozilla Firefox\private_browsing.exe
  "C:\Program Files\Mozilla Firefox\private_browsing.exe"
  2⤵
  PID:9488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
    3⤵
    PID:10336
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
      4⤵
      PID:10436
- C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.22000.1_none_bb5cdd91d9f726ea\bthudtask.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.22000.1_none_bb5cdd91d9f726ea\bthudtask.exe"
  2⤵
  PID:9612
- C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
  "C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe"
  2⤵
  PID:10356
- C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE
  "C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE"
  2⤵
  PID:10616
- C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe
  "C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe"
  2⤵
  PID:10540
- C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE
  "C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE"
  2⤵
  PID:11440
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE"
  2⤵
  PID:11448
- C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE
  "C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE"
  2⤵
  PID:11596
- C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe
  "C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe"
  2⤵
  PID:11768
- C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE
  "C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE"
  2⤵
  PID:11776
- C:\Program Files\Java\jre-1.8\bin\ktab.exe
  "C:\Program Files\Java\jre-1.8\bin\ktab.exe"
  2⤵
  PID:11784
- C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
  "C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe"
  2⤵
  PID:11792
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe"
  2⤵
  PID:11888
- C:\Program Files\Mozilla Firefox\crashreporter.exe
  "C:\Program Files\Mozilla Firefox\crashreporter.exe"
  2⤵
  PID:12092
- C:\Program Files\Java\jre-1.8\bin\rmid.exe
  "C:\Program Files\Java\jre-1.8\bin\rmid.exe"
  2⤵
  PID:12136
- C:\Program Files\Windows Media Player\wmpshare.exe
  "C:\Program Files\Windows Media Player\wmpshare.exe"
  2⤵
  PID:12144
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE"
  2⤵
  PID:12152
- C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe
  "C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe"
  2⤵
  PID:12160
- - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe" install
    3⤵
    PID:8692
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe"
  2⤵
  PID:10476
- C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
  "C:\Program Files\Microsoft Office\root\Office16\msoasb.exe"
  2⤵
  PID:11324
- C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
  "C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe"
  2⤵
  PID:7796
- C:\Program Files\Java\jre-1.8\bin\klist.exe
  "C:\Program Files\Java\jre-1.8\bin\klist.exe"
  2⤵
  PID:7848
- C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe
  "C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe"
  2⤵
  PID:8032
- - C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe
    "C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe" C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe /permachine /silent /childprocess /enableOMCTelemetry /cusid:S-1-5-21-2087971895-212656400-463594913-1000
    3⤵
    PID:12860
- - C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe
    C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe /peruser /childprocess /enableOMCTelemetry
    3⤵
    PID:12384
- C:\Program Files\Windows Mail\wabmig.exe
  "C:\Program Files\Windows Mail\wabmig.exe"
  2⤵
  PID:8076
- C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
  "C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe"
  2⤵
  PID:8600
- C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe
  "C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe"
  2⤵
  PID:8720
- C:\Program Files\Java\jre-1.8\bin\javacpl.exe
  "C:\Program Files\Java\jre-1.8\bin\javacpl.exe"
  2⤵
  PID:9576
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Xbootclasspath/a:"C:\Program Files\Java\jre-1.8\bin\..\lib\deploy.jar" -Djava.locale.providers=HOST,JRE,SPI -Djdk.disableLastUsageTracking -Dsun.java2d.dpiaware=true -Duser.home="C:\Users\Admin" com.sun.deploy.panel.ControlPanel
    3⤵
    PID:9936
- C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe
  "C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe"
  2⤵
  PID:6304
- C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe"
  2⤵
  PID:11756
- C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe
  "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe"
  2⤵
  PID:9228
- C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe"
  2⤵
  PID:12148
- C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.22000.1_none_c0a088f7530491ea\browser_broker.exe
  "C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.22000.1_none_c0a088f7530491ea\browser_broker.exe"
  2⤵
  PID:10324
- C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE
  "C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE"
  2⤵
  PID:8168
- C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE
  "C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE"
  2⤵
  PID:7700
- C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe"
  2⤵
  PID:2784
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe"
  2⤵
  PID:10676
- C:\Program Files\Microsoft Office\root\Office16\msoia.exe
  "C:\Program Files\Microsoft Office\root\Office16\msoia.exe"
  2⤵
  PID:11728
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  "C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE"
  2⤵
  PID:11972
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe"
  2⤵
  PID:11980
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe"
  2⤵
  PID:5368
- C:\Program Files\Java\jre-1.8\bin\policytool.exe
  "C:\Program Files\Java\jre-1.8\bin\policytool.exe"
  2⤵
  PID:12016
- C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe"
  2⤵
  PID:7876
- C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
  "C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe"
  2⤵
  PID:8892
- - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    OfficeClickToRun.exe platform=
    3⤵
    PID:11432
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE"
  2⤵
  PID:10996
- C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe"
  2⤵
  PID:9208
- C:\Program Files\Windows Media Player\wmprph.exe
  "C:\Program Files\Windows Media Player\wmprph.exe"
  2⤵
  PID:12172
- C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe
  "C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe"
  2⤵
  PID:2776
- C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE
  "C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE"
  2⤵
  PID:2000
- C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE
  "C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE"
  2⤵
  PID:11724
- C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
  "C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe"
  2⤵
  PID:8736
- C:\Program Files\Java\jre-1.8\bin\kinit.exe
  "C:\Program Files\Java\jre-1.8\bin\kinit.exe"
  2⤵
  PID:12208
- C:\Program Files\Java\jre-1.8\bin\java.exe
  "C:\Program Files\Java\jre-1.8\bin\java.exe"
  2⤵
  PID:12104
- C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
  "C:\Program Files\Microsoft Office\root\Integration\Integrator.exe"
  2⤵
  PID:12260
- C:\Program Files\Windows Mail\wab.exe
  "C:\Program Files\Windows Mail\wab.exe"
  2⤵
  PID:12056
- C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
  "C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe"
  2⤵
  PID:12396
- C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe"
  2⤵
  PID:12452
- C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe"
  2⤵
  PID:12516
- C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe"
  2⤵
  PID:12524
- C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
  "C:\Program Files\Java\jdk-1.8\bin\unpack200.exe"
  2⤵
  PID:12660
- C:\Program Files\Java\jdk-1.8\bin\policytool.exe
  "C:\Program Files\Java\jdk-1.8\bin\policytool.exe"
  2⤵
  PID:12948
- C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
  "C:\Program Files\Java\jdk-1.8\bin\jstatd.exe"
  2⤵
  PID:13104
- C:\Program Files\Microsoft Office\root\Office16\msotd.exe
  "C:\Program Files\Microsoft Office\root\Office16\msotd.exe"
  2⤵
  PID:13248
- - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /t "C:\Program Files\Microsoft Office\Root\Office16\1033\TelemetryDashboard.xltx" /x
    3⤵
    PID:7108
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe"
  2⤵
  PID:8440
- C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
  "C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe"
  2⤵
  PID:10168
- C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe"
  2⤵
  PID:9280
- C:\Program Files\Java\jdk-1.8\bin\jstat.exe
  "C:\Program Files\Java\jdk-1.8\bin\jstat.exe"
  2⤵
  PID:11064
- C:\Program Files\Java\jdk-1.8\bin\pack200.exe
  "C:\Program Files\Java\jdk-1.8\bin\pack200.exe"
  2⤵
  PID:9612
- C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
  "C:\Program Files\Java\jdk-1.8\bin\jinfo.exe"
  2⤵
  PID:10724
- C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
  "C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe"
  2⤵
  PID:11908
- C:\Program Files\Java\jdk-1.8\bin\jps.exe
  "C:\Program Files\Java\jdk-1.8\bin\jps.exe"
  2⤵
  PID:12788
- C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe"
  2⤵
  PID:12684
- C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe"
  2⤵
  PID:13252
- C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe
  "C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe"
  2⤵
  PID:12144
- C:\Program Files\Java\jdk-1.8\bin\jstack.exe
  "C:\Program Files\Java\jdk-1.8\bin\jstack.exe"
  2⤵
  PID:8720
- C:\Program Files\Java\jdk-1.8\bin\orbd.exe
  "C:\Program Files\Java\jdk-1.8\bin\orbd.exe"
  2⤵
  PID:12024
- C:\Program Files\Java\jdk-1.8\bin\jhat.exe
  "C:\Program Files\Java\jdk-1.8\bin\jhat.exe"
  2⤵
  PID:11112
- C:\Program Files\Java\jdk-1.8\bin\servertool.exe
  "C:\Program Files\Java\jdk-1.8\bin\servertool.exe"
  2⤵
  PID:11808
- C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe"
  2⤵
  PID:9800
- C:\Program Files\Java\jdk-1.8\bin\jmap.exe
  "C:\Program Files\Java\jdk-1.8\bin\jmap.exe"
  2⤵
  PID:8260
- C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
  "C:\Program Files\Java\jdk-1.8\bin\jconsole.exe"
  2⤵
  PID:5784
- C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
  "C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe"
  2⤵
  PID:13384
- C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
  "C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe"
  2⤵
  PID:13520
- C:\Program Files\Java\jdk-1.8\bin\serialver.exe
  "C:\Program Files\Java\jdk-1.8\bin\serialver.exe"
  2⤵
  PID:13564
- C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
  "C:\Program Files\Java\jdk-1.8\bin\jdeps.exe"
  2⤵
  PID:14180
- C:\Program Files\Java\jdk-1.8\bin\jjs.exe
  "C:\Program Files\Java\jdk-1.8\bin\jjs.exe"
  2⤵
  PID:3240
- C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
  "C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe"
  2⤵
  PID:12672
- C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
  "C:\Program Files\Java\jdk-1.8\bin\javadoc.exe"
  2⤵
  PID:12324
- C:\Program Files\Java\jdk-1.8\bin\ktab.exe
  "C:\Program Files\Java\jdk-1.8\bin\ktab.exe"
  2⤵
  PID:14684
- C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
  "C:\Program Files\Java\jdk-1.8\bin\extcheck.exe"
  2⤵
  PID:15168

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:236

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2156

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2792

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1180

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:420

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2836

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3508

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4360

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2484

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2080

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4748

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3660

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3012

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1632

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1672

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1972

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4704

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1532

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4392

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4136

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2256

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3500

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4948

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1556

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3188

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1132

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2500

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4892

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2848

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4920

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2140

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4048

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1796

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5060

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3232

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:572

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4148

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3828

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3604

C:\Program Files\Common Files\Microsoft Shared\Ink\ShapeCollector.exe
"C:\Program Files\Common Files\Microsoft Shared\Ink\ShapeCollector.exe" -Embedding
1⤵
PID:5488

C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
"C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe" -Embedding
1⤵
PID:5416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:6552
- C:\Windows\system32\dashost.exe
  dashost.exe {d21799a1-7c37-45fe-b262c0b920ff8ac9}
  2⤵
  PID:6188
- C:\Windows\system32\dashost.exe
  dashost.exe {889b72cc-6207-4665-9cfdfdec61c48275}
  2⤵
  PID:7176
- C:\Windows\system32\dashost.exe
  dashost.exe {9b4543a9-6caa-42ea-87f38e80ad5e0c06}
  2⤵
  PID:7664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:6644

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2652

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:7400

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
PID:7752

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:7800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k McpManagementServiceGroup
1⤵
PID:2912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicePickerUserSvc
1⤵
PID:8460

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:8640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:9124

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
PID:9004

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" OptionalFeaturesAdminHelper
1⤵
PID:6688

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
PID:6724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:8812

C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe
"C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe" -ServerName:App.AppX9rwyqtrq9gw3wnmrap9a412nsc7145qh.mca
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
PID:5476

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:10996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:9556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:14188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log

Filesize
266B

MD5
56665d2727f98fa0d15bfb6c49bfbfb0

SHA1
54b37f8d16c9f030e521ec94e360095b06d51e5d

SHA256
3d6c65466f3ca36b9816c73bac5900ae14e0279aa6cd1c1244db91a2bf6e0229

SHA512
c4ec0c6aa8c5a91a59cdfa886d56d4e66e7f0282a3ddeb6344bc40534d63bc43c7a7c9b6552c46c201a5daa320a74a43c4393fd9baac6e10b7280b1946fc03dd

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe

Filesize
233KB

MD5
47b61a3787718ef6e3b0f4867dfd77b6

SHA1
ca3cc47dbd686fe15a124576192aee45339f1be7

SHA256
78d5ba607a68d835f89f6f79b2686d3fb71f6f1e414517acc8435fb02c994d84

SHA512
10bb4ef3cb7d17e732e29821deada7fa4883cc45d154b6d28322110102404dfe3744ff79aab7159e6da604bc1c3ac77bc740e1cfd46f8d1a08c48bd7f58d4c68

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
63506b2fe62cfa704a2dd3b2313a524a

SHA1
6490c22356c4f23313f420d6c9382577defee800

SHA256
6b674f1b8eb6ed129178c28ead4cbb41e797cfc1912a5b44b3342161414f0a57

SHA512
f225b1a086b91867cc9db139d72838c2b530dd945429bd1be5cd2a41169af7a04885ac9afaa1fa5d4f6a12fb12c29ddea8baba9e5ac96d799a6332db6230216a

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
4c4894f131c6a9e4d5804b9e55509976

SHA1
c5854e8fbb100866de371747c78bbb202eddf58d

SHA256
eedb238056f978e7cfbf6c48a5a12ddd32ed60503441709dcae1fbf176e2bcdf

SHA512
25d936dbcc5a19701e641a7ce83157e30441c1e950bb0763c5ab5ff1d38dec8947f1a090c3b43e63f1fd15a3c0bf81865d129f7052f4b14d76a03cc87c3df834

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
17e9e5a3d1bd17594f42eaebba941ac5

SHA1
2b263ca9d846c061c000e637ef2717adfa38ed55

SHA256
cde59c638c156a983f5408891221d69578445cd6ede90ab5e36770e958be67e4

SHA512
eda54df25b58e7a76621be550fcdfceb082ae69b5fb1e5b727801d6cd777a2070c07340e7507e600b753a1b68de4c1c930b17c5937dfe417beef6cba8a983434

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
07eb491d6b325fc182a4529109535078

SHA1
39741c53c8b0abd6a7798ba6a455f7ec4286162b

SHA256
dac050c4c02b6e56aa74c15506c5b8f5b7c81b57ee4d3f87c77c4bc7b22ed37b

SHA512
1a843d9cb372be70530284eda7052554c6acf37d2ff58eee576d2a9ce2f505e769eec346b18530698db5ee9c216c5765a432233671cb44b87c6ff2376b14cd00

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
46bea13e32a18bb0543c871638bcccdc

SHA1
d8987f6185bf6cc507fae520072ed417cf755589

SHA256
1fc8c6fac276a2e83fdbc99f1d0d72b1f83bd7289fa1ad89a0e4803a9658a1b4

SHA512
2b34662de49c7b20e5a78ecae5748123f4387d288d742be677d6860945d5e37f445d00c1d092e13b8328bd20e88a7c19081a353bc96ceae8e9527c92d960f658

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp

Filesize
50B

MD5
2b8664f4f5706f07e6d31177f5918587

SHA1
aa50ac704d715b5fd2d00eb15d3330fea358848a

SHA256
3b6ba7481c793fc161810f15cacc7f39f43dd34d07cfe264d1cbf87258e05245

SHA512
f3773a6a3778f26151cdf3d4c4d7cde18ad0b975e28aa5264e7198b8de927d3c6078abb5cae133371a6d02fea83d9d9d6d1bbb0adbddd2ff426863cd610f5ab7

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp

Filesize
50B

MD5
04b5b90462846af87beb72dc3d63a545

SHA1
2631d8cdcca16f943a5f1584ade6cfaee0d28d17

SHA256
b60d68fc517f3052b6665b4aa5fc08e5b6917947ed3793ba9e1135e0b0458432

SHA512
2584c8a64c830b0de342c922e0009c1cb3f765db6ba7026bc578d57b947c2e64caeee6172af0119e33de2e01f096fd6484acae597ac969a2e6b2c368c27337bf

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp

Filesize
50B

MD5
fc59204639640fff5594932ddd3616bb

SHA1
0e26f7d5434f04d6260206e654d4279a696d174a

SHA256
ceea91e44b823dd4285195ea6716baac1ce0e6e22211261fdcd94a13d83d4eea

SHA512
3e9df8b86f98aac819adbe2a91691d148f19ed738d49b6e5a683bbeb08148d205fa1129a0e60f97fbec10b55544752087ef4ca40f8a9bf88ae7c1a7a2febf8ba

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp

Filesize
50B

MD5
f70fd719dc1dd533402592326737e7a6

SHA1
acd7b2280bd1a1b704ef9e8280ec8e31c2050c7d

SHA256
1e7d5bbf7274df6c78fe9930d41816f0a27a1e137199dcc86eb87fb380b09610

SHA512
38567797126fac6478dcca745a82c1f0727579cb385727af148ac9d0335e87da9d4720879c5e1a267dbc74321b3ea2c973dc51d021ab7c3aab3de98e6b654445

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp

Filesize
50B

MD5
3bea1082cfec07da67a90fac957b74b7

SHA1
3c13ed0800260bbfdb3557a7739d40f43151e5e0

SHA256
1aa6b76538b66aee97739ca7438837c1e6ea5d172e0a559b151e39b2d347bec2

SHA512
666b69b6f13cc353c695d06fca0f9763d8002c0eeaf6ffe668a452d1880b52920eeb9d8740b8d7dadb784b4849269271d3860c77cfe67b356b1f373d15b0be9a

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp

Filesize
50B

MD5
5879fd8fcc18ce3c55852a8f2d9ec237

SHA1
aca0d41320e7a28b42098f33f5f80a80934e8a66

SHA256
a3aaa5961a1d179e030c9cf0a9fe9b23c1f4b3560050b6c2ce578596e73dbc39

SHA512
1fea3a70a43c44c4b6fffd0f5eccb86fd3ef35051635d19a2c4a1adfd8cd972530b2552d937613e73bf946f95407272a349042707613ca9413b07214faf8884a

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp

Filesize
50B

MD5
2c80c7c8f7566fac8c608c041b0195fe

SHA1
d702b7acee3432b5cb08ccae292828aa6095480c

SHA256
c0d4b1ba36502532e51e6e2e10b108d2f64caeba167483a22e55f111226f63d1

SHA512
92087b8467dba7cf2f234ed1151a7f0972942f79624121cabe60c0d43e149bcf55faa60e2b3e16006d1d24ba1c5e4c38916f254105acf3ff876f03890b9ad9a4

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp

Filesize
50B

MD5
92784e6a0c9cc99f5b2c2a22b8d2a0f1

SHA1
d2ca2b21ebb214b26f5346643cdb9a8d9cd7f6dc

SHA256
b802855200d62bb17238e6becde1bb0228bbae708337600f103b9eab62f6928a

SHA512
3fb997a29a083ef55d930aac28a96b2e6901e8e6799db3e4705234170b43fd90bf89ecdfea92b0457916164bf1a7e7f353f070e446c02f8eafb638138c7171bb

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp

Filesize
50B

MD5
5d6456986c43b96c9b1ffc16e7eaacff

SHA1
250e439c59b13aae1c27e0c3f92bd866c0b80ca4

SHA256
137ba99519e52d73c9ebe91f99a61163cf6039fc048eede16b762be10f6c8559

SHA512
3ef6731d18b13ec501cebfe0431eae6ba260fd7e87d6274c901050213357dff81b865ef507f8c161253989ec865307697f735553f005e8cb6406b9c799bf61cd

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp

Filesize
50B

MD5
1d40d86d8613a9d64eea95552afd5024

SHA1
5b42438b3c223073d6e9df498a765f4484cdf407

SHA256
ca429c56c257d4be73628ed7c9137b1b48ad6fba851696235eddc9d640a39f79

SHA512
22be25b0ef7d2952b1c75cea19db2ce6d27f042a6be656a1086c088c1b3f462027009ff916bd5b742ead3949193f85d484ebf03cbef86cc0f75e84dbb228ad5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
471B

MD5
8c7eea0d9dfc394ac13dab1638ef9897

SHA1
7073583d06f35b0c43d1ffe45f76d4ae1d9fbe5c

SHA256
3b7a99a4c1504e974e71b7c1c2b3658f53cb9a9496a359b2e10c45ae9ced306f

SHA512
14a7594e8aa9bc6d97e63ac30ece2b383e7bfaccbfd8770b1f28ecf906c544d829832b624e32d0c0e8fedc2adbd06da1db53a292e7bcec6f2316a3e91e02a92b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
471B

MD5
fae54ce1c9c27a507d1bc31ab392c277

SHA1
ae7d29153f7f7bb59d9af76225447efea5320bfe

SHA256
a8b8e071b1e3ab33760fc3f2c14a8584811ba1c0957d6ceabdd859e8f4174c87

SHA512
1e30c9861cc923ce51d66c1d8bdc96d6aa723e6a428d80a049be3442446f6d0777b7533089e8b72a2a099e265ae768108ecbc606c12b923ef72828e8fcb440ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
412B

MD5
ea3af57496e9573628a9ecc21f7651ef

SHA1
1444785e24347c29a5462a0fe1e33d51e98ed654

SHA256
4511d61bed04532062b931d5b341284bb0b7d12a7d366768845c7d9a1f559d98

SHA512
5eab184deb27599775e52febfaa64818346828eb3578c80e68e8ab051617267d1fd62a0aa51aabe2de9862a2c5cd68c98f1c8ffff2b12e9ebff2f3112a230c5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
412B

MD5
cbccf4ff55414852164ade9a02003e10

SHA1
99fe14afd5147c54d0529e944a77ecb1fe281ffa

SHA256
76274b0b2a313578f6fab2eb6b6d532657adf32a3a6e30c16a4b7f68228beec4

SHA512
c91f22d5b45c31f900a77d980fe92175ff2e7c8674a3df3a29093ea864ae42c93256e9068e2740064b12ee5116b4260b70ccabc0ea277a7a4e7635bb35258b83

Download Submit
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

Filesize
896B

MD5
0911d2236ecfe7250ce31777db73027b

SHA1
1cfe0598959ef2dd0a5bbc68ff3dc423dd9713b3

SHA256
bd70b20b2a349fb0f91a90bcd5ac7620e8d93f83ba88caa514b02fae8b3a8e87

SHA512
572a390e1c7befcb0190fa7856a42986d3cc953e2f00e55536e37b8e1a35a8ac050bce152a4d8c36e1578c5ff48fafc6da7040291a74924b1c0e1927e57351a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\AddInProcess.exe.log

Filesize
313B

MD5
f24a5e82541c128ab3936ac968b94d79

SHA1
3b572e7aa78ee3ff330cfa55b0bc47ed950b372f

SHA256
277caf396d16ddae4eca284320f1ec7c9721a965656d912482d2cef91f109ff9

SHA512
30643b795ee60fcbbcc888550e90a6a06bfbee67e222f5647a65fe9843f25d49290f7fd56783b8117f9aede8094c5ce1a78209ed3ac5afdc00e819aba2bb25d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\AddInUtil.exe.log

Filesize
107B

MD5
c16012bf7caea9174866d086eba79838

SHA1
10aa7c7e2a24e06a8bae444aa55f6b497f4f1f07

SHA256
2f28e244c788ff9993a534a8b866a80608af318f0d65a9ea86911049922bc66f

SHA512
8d727bea44f1abbce2bb8aca843fd91c612f0bca4bd265dba93f3a5fbda8c53738e71b9c8c0d3da28c63a58fea67ae77ca271145b3c4c0ef0428e4d26f519385

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
62023ac42836cad80eb53b723dbe6b57

SHA1
7ca664f2e348488c63815278e58126340354cb97

SHA256
7025d79012bf33ade74157262ca5af112cde60f2a77963a929bd1487f80ce55d

SHA512
7fe50cde9bf30f75d4f6b2d12ad007eed9e31ea6bf07a78b2b85987318f99ce57b722d6f8fc51bd130de6d0cfa154d444704c7114e597de678816d7a937828be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
0676ff4c090c7ae3c6f373fcbe141030

SHA1
ce346b0eabbb188001fae277bb1b1ce07bed4f56

SHA256
f104ff27d16de89586a38e2264a0150dca48b332cf036a7a3a3d22ed3c4f01ca

SHA512
65c53a628359f42c14cf111c710bb650b0c8c2cd80c54b5ede8c55ee1a90e604f43b61021c1e0cddb0ab432cb5231066118bdaf18b4fe4dc101fde7e7d4845cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
75c2f34b029e339a0b1506b5ef0025ca

SHA1
3cd8f721ef8dd33f20b111025a9c172a2f640ba8

SHA256
3357f22f7cc1f3355b30d3f52d9f0505a42a710059c692e9e2c5e9f4badd58de

SHA512
5c64768f7fe719a41b559844ab06d2647a04698a72e37887b548e00ac606b7088338183533fad529a2923c098a5d025e3a5d9d5e3c6568765c63f0eb79209d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
7793ce5a919142e04411bd333b488621

SHA1
10f5ad6e9a1392a3a947f30d03239dfed4532fe2

SHA256
8269ae6d377beb6c27215f8c86a6b8aeb59843c771ed7f11f46f07a292610e95

SHA512
0cd430fe73f933e96c957298ad50e763bdc3484a1debaa9f096174816a8885d0c448a9593bd81607de372483b976a9218c45b7e065f75a83465d33c93b2b30e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
1c71f2ee4427510b8f5b1d3606d2c1d1

SHA1
dc84840ed5da09857cd4d708169ebdf5007cdcbe

SHA256
96cfdf146341830d98f4f19e8c22564132f9d47d6b98f0731a6db60d26209490

SHA512
6c8fcf7260f26603040277a421e2b11679ee48842e624278d01bc07004675a897875480b5a648ad7feb4f04b8dacb3ee1ae2f9dffc4eeab96bc1fec050d4b84c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.accdb

Filesize
512KB

MD5
4da6d6d76856e9625d19439854d75501

SHA1
bb34fcfd724fb420ab6002932af0820fb83b3aa7

SHA256
bdd11e756ff7989e3a154325782a26dab561dbbb9c513652cec14e0d343e2b60

SHA512
d89b178e373e6e6ca651ffbaeae05b81a2ceefd4d37ecd682b4adf22529bcd70898144cc1d662534a3f4378bc4bc54b177e6e200886af3ab1061334e051524de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb

Filesize
128B

MD5
7b5feb51de906efa6d11b64462344637

SHA1
81505ffebd606e40768ba6af181fa55c81b1b1b3

SHA256
02732d8aa1c0592b32bf6088ff8bc10512ac677d40634d793e384da32fb6c311

SHA512
8b0cdab5517445823d72a6742d0fd6484d76ec365e6cda55de03ce3374fb1295065b125ad92062ee247de9644ee0add02c88b10204207ef7f8057bdcac1a3cd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\4DD27116-141D-4411-BEAD-2ED43275A3F0

Filesize
169KB

MD5
2c085825e39b17f21c122aa5d2e8d7da

SHA1
a83cdb8839d2eebe254902cc901c5b0da4b5182a

SHA256
08db836a05b60dea0ad73533a9fb50689d3e26f3cb6ce11d0fbdd1f3b65c7697

SHA512
c8a57b99df200b8641cb6b473948f46780ea555cae1bb61078aecfba9c8d4d3c09b61e9a3995c14a8989902a96b2e9be0100096746119d8707b76397b02e68fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\80C34697-B6E0-42A0-AE62-001500B89A53

Filesize
169KB

MD5
9280f4b5da1b5fb875571cc782ec1188

SHA1
3ef93d27b24d6628684fb9ec2b88b977f1453759

SHA256
14626022a2b58eb236e960b248391b53c355259cd714e2dea9f2b0ddbc2f88b8

SHA512
d993bb7cb30f1591da5f0f8a460e377b353673b6aa4030762549e9d4b139ffd71c9d12f080abe9e3e90c6b586a5fe8eeefbbf9e5e65155ed842cecaa660a4b7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\90FA7EA6-B78A-4ADC-9FEA-BB5F04D055E8

Filesize
169KB

MD5
2bb94fd33601007508ff1b31b2b82666

SHA1
007c6c207f00d81d7e4022b2bda0330b8e609710

SHA256
ae2c6be819f1fc971ec720a1f5b9da3f9ecc3509512a12f6f0fc6a2f7f7b6bbb

SHA512
91c93a070ac7b24494475124f906aa823093f234df49cb93fd3987cea321902d0d1f905a74875b24b838f32796a931b3a0ab3200544ff42a417ae845b5e36a16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\setup\Install-PerMachine-2024-7-26.716.12860.1.odl

Filesize
256B

MD5
a086e8a6483735c343548121c7a9443a

SHA1
adf2789280871cd7531f427d25e5ec2d63ff91b7

SHA256
b45b7bd9600fbaf04742d9e3d81750d8521f70286554f312c92b108580ae8be4

SHA512
8a438f3dc38bfb787556e9d6d2f18d9f94a3ff48a711561c3cc3d74d80252dfa6001a11d41639bf59058a4acc9e049626b066c865596d04d59f73d8faeb83337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
3e81ecd6f35114fed2498b92e2c2b5cd

SHA1
064aecf36b3d538b7484e0ec94517716bb0cbe5b

SHA256
a395cd8bd9b722ea5ea087bcd4458a4ef4c2da8c12e3e73cbce26d6f3671c939

SHA512
d26289fa5de2db6c992de93d95760de38787b476d7c9998db26a181fbcb08dc450c8a70afb8d1116aa13f665941b2e74f5824592506f143cdaeef5aac501942c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\activity-stream.discovery_stream.json

Filesize
24KB

MD5
c6d3bfeef7bcbbd00dcc503fc5afca0a

SHA1
5491598ba909a0d221bc2d3cf111d89c32c9131f

SHA256
3dc3b02f0bcde4bd434be4e95419c9f660b3110738821d674ffcf2c6fb302edd

SHA512
2200b7c47944768fe31919ed0fe07446c8deff351e67c7604217e1c8db95a4d481241a9288da2a35e46c758d0f20043dda4a5abbb4e86468f044240a890b784c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\AILog.txt

Filesize
917B

MD5
bc486fec9d170c5aa0883e2fc2936d85

SHA1
87955ba20a5e0db462c83322385f909d263c5087

SHA256
27c234ea64e20a1f592ae55a75a9672650704164283108afe4ac17bfadde4133

SHA512
9376f290fc706a373751573a461034643fa7bc10e6e2e70cdbfe9879cb5923fca3a3df019835e4a309e20b4d49617e3a59330b53f33e44535f119a8ab3f8fdbc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\AILog.txt

Filesize
1KB

MD5
2c48f30daa4f05fb9cf1eb8ed26835c2

SHA1
2815280338cdb8a6da63b69bba7a3a0cdca6a35c

SHA256
38a16b22446572b726457156420e874c9ebbc7a5f0d0112b13f75d2c12d29f6d

SHA512
e630141b6fa85554ce55dc316d2c888cf18b613931bc7d5c029086b77e9b7eace9daea3982bca7379af470ddfdd85a01d5ccd9b2e89db262916c00e95f4c914c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\AILog.txt

Filesize
1KB

MD5
26aa8fc7cec60c39091cf085d5a2a450

SHA1
8caadf3d5245a15075c73b0ef00bde2e4d922ac0

SHA256
6e7e2055e69395c50ac30353944582a8daac3c585265a1c734e707141254a45a

SHA512
2df67303c8e2cf4f0ad6ae860491bcf8525d417397291f7669117b72e1128cb11b80b9de5ea3f9180192f87b653d14268b04163f04982e31105168dbe2d4f917

Download Submit
C:\Users\Admin\AppData\Local\Temp\log\Logfile.1

Filesize
8B

MD5
e675cc21c1f78217cf5d6a5b1929afde

SHA1
07aae1b618f604c684ee3189fa1723bef8656fe4

SHA256
cd04a4754498e06db5a13c5f371f1f04ff6d2470f24aa9bd886540e5dce77f70

SHA512
dfa8db1c35931931a6007f85a9f4035928cf159357ff8d682a50b6a0f3dfa0e020ed4eb377f6011446f351f7001bae06932ad0cb662e01f07acf6aee257d3bad

Download Submit
C:\Users\Admin\AppData\Local\Temp\log\Snapshot.1

Filesize
1KB

MD5
b6067566dab91782b6ae7897718b492a

SHA1
bf1287590982685b3a210afcd86ce4c25e4e2327

SHA256
d5bb33bcf278db0a36edd30ab0dc02fda3d65168b1df1344db69970e32dd6451

SHA512
c65c662b7f7bd2d463452455af76c0e74c82331e809686bcc59633e1b8bf348b0951b7bccd6f3a76fba4d1bbfddd721312250766d5aa50326e2b0f41e644c37e

Download Submit
C:\Users\Admin\AppData\Local\Temp\log\Version_Number

Filesize
4B

MD5
f1450306517624a57eafbbf8ed995985

SHA1
479e04f3d12d112b5c04c9ee67e4b1e6e201ea4e

SHA256
b40711a88c7039756fb8a73827eabe2c0fe5a0346ca7e0a104adc0fc764f528d

SHA512
57c365278e08f99674dd24f08425b17c71b0511dea3b5ffa474deeb26d64cb993ebda4650583b29cba6307d7f4dbb42ca11b093de2b8ecab16ff52445401facf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd3F86.tmp\BitsUtils.dll

Filesize
15KB

MD5
8dd17c172a24ebf9601308b949a9ea22

SHA1
507e586c9f69ddc7e58442631efc44f3fe58089c

SHA256
ab77c0a6c79e76ab0f509d655273b2ee5c682c702217f4f884bbab3d2fdfc4c0

SHA512
7de5a35771ac8ead2e3096de29bdedd8e94696d35dc304388c1cff2a14bb264e389a576dae21aaf9cbac79de6c99606b61f1dc5f0ba35fd261b2f5553d389e59

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd3F86.tmp\CityHash.dll

Filesize
53KB

MD5
2021acc65fa998daa98131e20c4605be

SHA1
2e8407cfe3b1a9d839ea391cfc423e8df8d8a390

SHA256
c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14

SHA512
cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd3F86.tmp\InstallOptions.dll

Filesize
25KB

MD5
fd249bc508706f04a18e0bc0afddec82

SHA1
b94efda9f41c89fc6120ed385867125d03f28bea

SHA256
c34f095e200db420ce9af5489c3e392be285e43c3f4c9fbe34686b1f0a1531ad

SHA512
c820c06ad5ae21101602d9e7864fed9b470b25fa9a0ee025d05e72697d88c7e03cbee7ad476f4e3d5b6e467248b8ad1fefa2710c76011e2156b85068961404ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd3F86.tmp\System.dll

Filesize
22KB

MD5
b361682fa5e6a1906e754cfa08aa8d90

SHA1
c6701aee0c866565de1b7c1f81fd88da56b395d3

SHA256
b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04

SHA512
2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd3F86.tmp\ioSpecial.ini

Filesize
1KB

MD5
10101ff644478a59571b4842d76819bd

SHA1
cc74c86655b3d57055a33402ebd1b596cdb4ea80

SHA256
31a5d74f18d3ffb82c95c6dfd8933e7abeedb8f34244280efcaa9442094306aa

SHA512
e83e7c3af2176d02cc59bf7a6241812297a63d5a4597e786cff00102e7846680d2f2c09b2d6ef26742e97c586c7de92427ce9990f320bd8c8dc05ff06e69f17d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd3F86.tmp\ioSpecial.ini

Filesize
1KB

MD5
a93fa8f86b8f1a5ac852d82d7aa85c96

SHA1
26be51de104f209c0d305663aba6a3c943a9f0a3

SHA256
2a96ab6a345eeadb86b15ce885dcc8c128db97010bb3a355c9c2a1dd1c6efef0

SHA512
7d3425d0b8290f9a49a690efeff7dfe2c0aeb9a1313282ebf8672612f329a51fddc6fad837a7bc5d4960cae22540e7bd50e3097628a2becb5a4e49437a10b35d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd3F86.tmp\modern-wizard.bmp

Filesize
150KB

MD5
49ff8ad8f51875597f3e919e8770c24c

SHA1
1e840ce0f68281e312317bcbdbc10fdfcd3959c3

SHA256
76da716588b8e51e36ee7a674cd873a8069e27fef73851d1e190face5a67fc66

SHA512
dcf29bbef46b1bd8d9f6c6221955ab06da23bc6661c603c188ce34fed80984a3b6d2006ab38b49aa9d1908d714cc0f40e63b6230244e4d4a0c9baebbbda1ddb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv394D.tmp\LangDLL.dll

Filesize
7KB

MD5
20850d4d5416fbfd6a02e8a120f360fc

SHA1
ac34f3a34aaa4a21efd6a32bc93102639170e219

SHA256
860b409b065b747aab2a9937f02d08b6fd7309993b50d8e4b53983c8c2b56b61

SHA512
c8048b9ae0ced72a384c5ab781083a76b96ae08d5c8a5c7797f75a7e54e9cd9192349f185ee88c9cf0514fc8d59e37e01d88b9c8106321c0581659ebe1d1c276

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp96DD.tmp

Filesize
12.1MB

MD5
8b175636818d7d1509fd855b1f44900b

SHA1
283292b225a3e2910df6f2c058f0c26a25bfdbf2

SHA256
b9f0f889402de749e8b2594a1f180a6cba8eb3f02d3f472af06540e633bdcaaa

SHA512
a6c7b3ad15de8dc1b47f94c42187f935121de39efb65bd8ccfbaf9705c8f780c4fa04db669f541f3aad94149f591e319ee9d2c6698ffdf082738e28dda6a10bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
0ce38481985ec135891072a7ff1b34a7

SHA1
21aaaa1378be04f01844de1d50e0489254acb024

SHA256
86a824d33fe528471f480341f9891d52c67333552f4b4abcad56c65c86dce1dc

SHA512
e10778b87e5d4b7414f4b2b1151cf833e63c7de097c44bb9f6573a0fc068bbad92096ff97ebb2a95f1f7ba1ad2b39fc2a1704fd8710879f26dfb2bd4eb9c2d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
adea002a38cdee4275cd209ab6715e02

SHA1
cee27fa9c18beca6403a3435600f29bacd7953bc

SHA256
5c90da590351c6d294d3380b4af26a84c0276a065c67c6bbb6f4f0cafb760722

SHA512
fd1db588e133438cf996be0be438f875e8f795c853df80fdaca348ce9a345dcfcf35ced5dcae035715d6714dd1902975263975257b1e3ab11c987c8d44d7d966

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
921B

MD5
e9ff9cefe7bb09a5d2fe9ce6d81156a6

SHA1
a185ba519c9f7140302871866e816986a799f12e

SHA256
1d551b637c23aa7aa88bb7ac58e17cc069b65c33c8be166f9d326c1d38242b70

SHA512
9ca0e22a500e9c511500a07787e604a6ff0ea2b090ca921a700a57803bc9eb5ba2a9bedc37960e3914a5082e0f29d6486a1e5f119cee50c02e97756b6cd918ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
2KB

MD5
434784b7d035e46ca213c07be201b881

SHA1
9d792fc034341f4ceeabc6657af1ff95e9c4130f

SHA256
2eca8085569b4366b3cd3ea3c7ddd936c8d40a914c5764649af55602f92df50b

SHA512
a7cbcb192018850137a016120b0bc21544f4d8010c89c43d6be3007111567be774bb87e695e2c8c427c1abe4013b7fa0159ed28e9c62a383d06796bbb0978ea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
237KB

MD5
cf93bcbabd558cf3a4643084ec339248

SHA1
b1157a1a90ae5681bf9b1bc91a76a02bcb7c0358

SHA256
9688e690947d9e5fa9d0f871c39742e29ef14f391d9301fc82c6eb7f7534f916

SHA512
e3b9b2065db071e862d3af20dc2ac995a4dce01c60b148395887ef530acdd0668f64fa5d5a6d40adf0e6f850a4c4251bf74382bfde9ed8ee51b9645ae635bb34

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_B.exe

Filesize
686KB

MD5
28ccf15ea46074d78f6bcc5be86057c5

SHA1
26fd7745a2faeee058a1b688ff72a9211eb1125f

SHA256
e993ccd63d1eca188f9fa95760e2478f9c9ef5fb4da1548b10bd03d8734d8b95

SHA512
ca75af1f2d2bbd27e5c99782f0db76fb9ce7fb3f587c18c11d60c57c95de2b9922b5c5469aa3fd0662f362bcc9aa388c28aba50e47557d47ecc5a337d77ba462

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2087971895-212656400-463594913-1000\83aa4cc77f591dfc2374580bbd95f6ba_6094aa0e-9896-4899-aee7-8dc28a78668b

Filesize
45B

MD5
c8366ae350e7019aefc9d1e6e6a498c6

SHA1
5731d8a3e6568a5f2dfbbc87e3db9637df280b61

SHA256
11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

SHA512
33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_7A7EF0C9EC4F494A8070057A026668D7.dat

Filesize
940B

MD5
01077d8e601d08da8d8157f2d57c23af

SHA1
8ab42e671dc93cdc8258b4290538b71a39ee5bcd

SHA256
363fc1bcf56dedbdd8e449eaa54b75f51c69e40fe54c4d76237456e46d6c1de9

SHA512
dccc5eac696e24a0294f7007127acaeab0b42efffcfe1c454c91d44d73d77cc63dd4b6a586b8d5e65ec05d736d9eb2b07274e6bc64138c8685a0df9ae56f866a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
d4aae92263baf1f0f5b58b662aec76c8

SHA1
1348acfccd59586a4b5491490fcfe66c8eebb63c

SHA256
e0d3c1a9ce395414516365f0c3f10dfacd07fbdbd59fa03f78bc634b87052742

SHA512
9c2bc460d939c79fe3fabd176c6529f6a9fe2a108375768b8eac27f2dba06e3d1f0162f4bca0077a5c506809e595e34e3e61e8b0f11c2c6d3c0a59812b598d4c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
ed50888c06b3ecb9058b5cc933396ebe

SHA1
4ea41802ee25f1a9e854ca81513c522736924120

SHA256
8882fbb84c1913917c818781aef9b4f1e671e6c3c6e6dadbcc611953503efa5e

SHA512
43a27c159d45c4ba9a4a33158599d2182792c5fe49ca4ab0c0a50c347f5c37a1f6abbcb758e33bf2a98d36ee3bea6fb2b412a2ada0da22f79a59242abd9c3720

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
8f19eb1daa90c5ba700dc1ffe991e5d7

SHA1
d0664ca912fbe95e0cb3def7383d9d3d935c8817

SHA256
940dc9e099909410546356691b64e59208eeecc85f87bbebc9701c007f2d2e0e

SHA512
12b67a6b2eb5543cf068b6b3e0ba982deb957853d1257afa6893583c290db3c225cd6e2f61fca933c85c4eb682230de40cdb2200d51690bb81140c30fd38a11f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\pending_pings\802af202-b15f-4880-8196-5ea19f0c72ae

Filesize
671B

MD5
2f9cbee121f32798c5e11371798d3fc1

SHA1
c795312387063c778ecf195fb28f51dfd99a8bc6

SHA256
ca4303cf0ccb8516c1933e7af75e1e4489871e65ba15e3d960c89baf090cde0a

SHA512
a853d2fabd4d199d535e1b729c5abd1ef39f68f45f8d8fd7016a02bfac7339041ae71177abbabda469b11a221a6ba15b93a03a42d7a7c8c0b8a15055d730248b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\pending_pings\a821053c-1a66-4b59-9433-1ca87bff7fe7

Filesize
25KB

MD5
61320f3fd5c7f6e9345d30cbde95b652

SHA1
45f0a1cea32c46741016c77247b77ae81b04d7e4

SHA256
ea3e75331d89a83dcdfd46e6583e29e1687b206447b58919dcd478faed2e6e9f

SHA512
d5e1f0e50c2f89003072dab7eb489f051ffc203ad75e71ba01942e5e6637863503db6d8c752dc0119fd80b2b98c9679632a5d3633da3e619b0ca4754ace117eb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\pending_pings\aa96e1be-4c5d-44d3-8646-c541bf1dcbfa

Filesize
982B

MD5
87caaa388f0622f0459d4f6b491c9aba

SHA1
53009eb1e0392d9c02a89443ae03b60afdc97838

SHA256
c9b3c56077fe7779091af0e928be8b31b09558a1f528bfe133f53a4df5dfbf91

SHA512
091b7c60155ffbf61010daf15e2cf73528110a4b3247c4e115119948418b605d7b7855bac2cf9ab162b4bec777888fff9c02cf00d27762f0b03d63d83fc48d71

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\prefs-1.js

Filesize
11KB

MD5
7affc385bd10f3791fbeb6bd5d27157b

SHA1
3359b0fed7de0c89c28c18afdbca1cde549c1525

SHA256
439479bbbe979adbbce78bc125726da9a160fb9cf98bef80bcf819af8a666bb1

SHA512
1bbe22e0bd46f5b8dc7eeec457c9ed388529f4f6f5a43aed51581ec85351160199eb4412d20843d284e747f422ef222f9c4618edd4dfcf56e623d6a6eeccc7f6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\prefs.js

Filesize
8KB

MD5
8080d36a866e2e248893b3c04d41193b

SHA1
161b2295ca161e50ff57989a2243edfa9242b263

SHA256
5b4ffdb8e6b318affde05c38951950a90aa0d587df87421ce5db0a9c3f5ae37a

SHA512
78d8fd14bd1e6667290df91a595637f5427809558829f4433f3259122a72a3e647a4494520e48a466eecc94f49050088a062eaac0cdf7ed6b1dfe1b4432feed4

Download Submit
C:\Users\Admin\Documents\Fax\Personal CoverPages\desktop.ini

Filesize
83B

MD5
598e1a868a65c0b66b59c088f52360ba

SHA1
54418059a2190ee09d84dd1dfb80ce44f1fc661e

SHA256
c183370acb893e1c862bb094ffa9abc34af886933ef45a572d4bcf52f845bbb2

SHA512
dce894ce4ffd8c2cc14a83d1416c0a2ea2d4abe02eda88cee571ecdba094c2d458b4f6644969cf0e96baf3367c286bfa01099400ae5d0cbe0b3ed97f8e803edd

Download Submit
C:\Windows\Panther\UnattendGC\diagerr.xml

Filesize
12KB

MD5
7b3d57d9be02f5e2b6b038340a7ce56c

SHA1
5979bb47f9f8ca8ce75e6e1fd9be788aee134ff6

SHA256
00f4acdb2543202d1b8e7e80350ae9731952b0cb2da7622dec01a7ae780242f2

SHA512
ef56b1b21c99ea483ed8551df0ccf4cae134720884775ccba8aa6fe82653c3a6e0502fd500a09a13d3ad71e3831df9aa6975b622fd169ac04311c73e86564946

Download Submit
C:\Windows\Panther\UnattendGC\diagwrn.xml

Filesize
12KB

MD5
4e43f0152da06e91d51c5658810d1677

SHA1
16728e62d0e0812f3c1aaff3eb539dc89faecb3f

SHA256
e70ef07891ed69e7def8ce6ea71da050bee47e00c9df3e05090a2a8da81d3a76

SHA512
fb2f0337697c824feeb8bea951aeaefb83ae786cadf441dd1db05f5bc7164794146a6a628a18084a24ede268eeffeda61f0ddbd0bb200fe0011ca731afb78b7b

Download Submit
C:\Windows\Panther\UnattendGC\setupact.log

Filesize
46KB

MD5
5d03d501b280cb5926cdae2ff12c52fa

SHA1
59924bb342c6a04a8695a3f5ed3550cf8e6a056a

SHA256
108916f58b9494962def3d2d0de52cfe097de7486cf5bad687a6e89a39e73022

SHA512
3d24d31c5956c886bdbdf2a968c692303f58b17760b86d73f6930d6a4837094cb9bd87bcb2d016d1a46a58d5a976b9589e2b5c2fa12d7a4b58044997e09de666

Download Submit
C:\Windows\Panther\UnattendGC\setuperr.log

Filesize
637B

MD5
93a1beadc3ce8efa07a55f6ecf194a60

SHA1
94c18c12d49239c38aadaf407456650d136c21b0

SHA256
16d5e325c642309d1cde7ce65133d0f927efa71d982e94eb5fd21ddedf44d139

SHA512
2781814516e536f534d0d74cfffd1af254c1b2e3f364c12e0524df9e8c74e4d01bf7ec1303332ae91ab25f089bb516f39af38b45076500f940cb3b504338f7a1

Download Submit
memory/1332-14-0x000000001B400000-0x000000001B4D2000-memory.dmp

Filesize
840KB

Download
memory/1332-15-0x000000001B9B0000-0x000000001BE7E000-memory.dmp

Filesize
4.8MB

Download
memory/1332-16-0x000000001B680000-0x000000001B71C000-memory.dmp

Filesize
624KB

Download
memory/1404-31-0x0000020A7B6B0000-0x0000020A7B6C0000-memory.dmp

Filesize
64KB

Download
memory/1560-20-0x0000000001540000-0x000000000157E000-memory.dmp

Filesize
248KB

Download
memory/1560-21-0x000000001C070000-0x000000001C097000-memory.dmp

Filesize
156KB

Download
memory/2144-3-0x0000000001840000-0x000000000188C000-memory.dmp

Filesize
304KB

Download
memory/2252-17-0x000002468DE80000-0x000002468DE8C000-memory.dmp

Filesize
48KB

Download
memory/2252-19-0x000002468E290000-0x000002468E2B6000-memory.dmp

Filesize
152KB

Download
memory/2252-18-0x000002468E300000-0x000002468E33A000-memory.dmp

Filesize
232KB

Download
memory/2776-1086-0x0000018C61F30000-0x0000018C61F38000-memory.dmp

Filesize
32KB

Download
memory/3752-28-0x000000001B2C0000-0x000000001B582000-memory.dmp

Filesize
2.8MB

Download
memory/3752-29-0x000000001B5D0000-0x000000001B60C000-memory.dmp

Filesize
240KB

Download
memory/4780-0-0x0000000074F8E000-0x0000000074F8F000-memory.dmp

Filesize
4KB

Download
memory/4780-1-0x00000000002F0000-0x00000000002F8000-memory.dmp

Filesize
32KB

Download
memory/4780-2-0x0000000074F80000-0x0000000075731000-memory.dmp

Filesize
7.7MB

Download
memory/4780-38-0x0000000074F80000-0x0000000075731000-memory.dmp

Filesize
7.7MB

Download
memory/4780-22-0x0000000074F8E000-0x0000000074F8F000-memory.dmp

Filesize
4KB

Download
memory/4892-65-0x000001DF53680000-0x000001DF5368A000-memory.dmp

Filesize
40KB

Download
memory/4892-64-0x000001DF53250000-0x000001DF53272000-memory.dmp

Filesize
136KB

Download
memory/4892-67-0x000001DF536C0000-0x000001DF536C8000-memory.dmp

Filesize
32KB

Download
memory/5112-5-0x0000000001690000-0x00000000016BC000-memory.dmp

Filesize
176KB

Download
memory/5112-6-0x0000000001540000-0x000000000154E000-memory.dmp

Filesize
56KB

Download
memory/5520-39-0x0000023C2BA10000-0x0000023C2BA20000-memory.dmp

Filesize
64KB

Download
memory/5520-42-0x0000023C2BA10000-0x0000023C2BA20000-memory.dmp

Filesize
64KB

Download
memory/5520-45-0x0000023C2BA10000-0x0000023C2BA20000-memory.dmp

Filesize
64KB

Download
memory/5520-41-0x0000023C2BA10000-0x0000023C2BA20000-memory.dmp

Filesize
64KB

Download
memory/5520-40-0x0000023C2BA10000-0x0000023C2BA20000-memory.dmp

Filesize
64KB

Download
memory/5520-46-0x0000023C2BA10000-0x0000023C2BA20000-memory.dmp

Filesize
64KB

Download
memory/6304-174-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/7212-123-0x000001D5F6FF0000-0x000001D5F6FF1000-memory.dmp

Filesize
4KB

Download
memory/7212-120-0x000001D5F6FF0000-0x000001D5F6FF1000-memory.dmp

Filesize
4KB

Download
memory/7212-116-0x000001D5F6FF0000-0x000001D5F6FF1000-memory.dmp

Filesize
4KB

Download
memory/7212-115-0x000001D5F6FF0000-0x000001D5F6FF1000-memory.dmp

Filesize
4KB

Download
memory/7212-114-0x000001D5F6FF0000-0x000001D5F6FF1000-memory.dmp

Filesize
4KB

Download
memory/7212-126-0x000001D5F6FF0000-0x000001D5F6FF1000-memory.dmp

Filesize
4KB

Download
memory/7212-125-0x000001D5F6FF0000-0x000001D5F6FF1000-memory.dmp

Filesize
4KB

Download
memory/7212-124-0x000001D5F6FF0000-0x000001D5F6FF1000-memory.dmp

Filesize
4KB

Download
memory/7212-122-0x000001D5F6FF0000-0x000001D5F6FF1000-memory.dmp

Filesize
4KB

Download
memory/7212-121-0x000001D5F6FF0000-0x000001D5F6FF1000-memory.dmp

Filesize
4KB

Download
memory/7352-238-0x00007FFDA7A50000-0x00007FFDA7A60000-memory.dmp

Filesize
64KB

Download
memory/7352-253-0x00007FFDA7A50000-0x00007FFDA7A60000-memory.dmp

Filesize
64KB

Download
memory/7352-236-0x00007FFDA7A50000-0x00007FFDA7A60000-memory.dmp

Filesize
64KB

Download
memory/7352-250-0x00007FFDA7A50000-0x00007FFDA7A60000-memory.dmp

Filesize
64KB

Download
memory/7352-249-0x00007FFDA7A50000-0x00007FFDA7A60000-memory.dmp

Filesize
64KB

Download
memory/7352-251-0x00007FFDA7A50000-0x00007FFDA7A60000-memory.dmp

Filesize
64KB

Download
memory/7352-252-0x00007FFDA7A50000-0x00007FFDA7A60000-memory.dmp

Filesize
64KB

Download
memory/7352-234-0x00007FFDA7A50000-0x00007FFDA7A60000-memory.dmp

Filesize
64KB

Download
memory/7352-235-0x00007FFDA7A50000-0x00007FFDA7A60000-memory.dmp

Filesize
64KB

Download
memory/7432-184-0x00007FFDA6E30000-0x00007FFDA7E30000-memory.dmp

Filesize
16.0MB

Download
memory/8700-373-0x0000026626210000-0x0000026626220000-memory.dmp

Filesize
64KB

Download
memory/8720-900-0x000001E21F860000-0x000001E21F868000-memory.dmp

Filesize
32KB

Download
memory/8924-213-0x0000000004C40000-0x0000000004C4A000-memory.dmp

Filesize
40KB

Download
memory/8924-206-0x00000000051A0000-0x0000000005746000-memory.dmp

Filesize
5.6MB

Download
memory/8924-207-0x0000000004C90000-0x0000000004D22000-memory.dmp

Filesize
584KB

Download
memory/8924-204-0x0000000000290000-0x00000000002C0000-memory.dmp

Filesize
192KB

Download
memory/10160-782-0x000001A3CB930000-0x000001A3CB93A000-memory.dmp

Filesize
40KB

Download
memory/10160-747-0x000001A3B3020000-0x000001A3B3028000-memory.dmp

Filesize
32KB

Download
memory/10160-791-0x000001A3CB970000-0x000001A3CB998000-memory.dmp

Filesize
160KB

Download
memory/10160-780-0x000001A3CC790000-0x000001A3CD520000-memory.dmp

Filesize
13.6MB

Download
memory/10196-410-0x00007FFDA7A50000-0x00007FFDA7A60000-memory.dmp

Filesize
64KB

Download
memory/10196-405-0x00007FFDA7A50000-0x00007FFDA7A60000-memory.dmp

Filesize
64KB

Download
memory/10196-406-0x00007FFDA7A50000-0x00007FFDA7A60000-memory.dmp

Filesize
64KB

Download
memory/10196-403-0x00007FFDA7A50000-0x00007FFDA7A60000-memory.dmp

Filesize
64KB

Download
memory/10196-404-0x00007FFDA7A50000-0x00007FFDA7A60000-memory.dmp

Filesize
64KB

Download
memory/11196-738-0x000001637CD20000-0x000001637CD2A000-memory.dmp

Filesize
40KB

Download
memory/11196-724-0x000001637DB60000-0x000001637E8F0000-memory.dmp

Filesize
13.6MB

Download
memory/11196-740-0x000001637E920000-0x000001637E948000-memory.dmp

Filesize
160KB

Download
memory/11448-1053-0x0000000008B60000-0x0000000008B6E000-memory.dmp

Filesize
56KB

Download
memory/11448-1052-0x0000000009010000-0x000000000907C000-memory.dmp

Filesize
432KB

Download
memory/11448-833-0x0000000005A10000-0x0000000005A22000-memory.dmp

Filesize
72KB

Download
memory/11448-911-0x00000000084E0000-0x0000000008502000-memory.dmp

Filesize
136KB

Download
memory/11448-797-0x0000000005400000-0x000000000540A000-memory.dmp

Filesize
40KB

Download
memory/11448-822-0x0000000006410000-0x0000000006767000-memory.dmp

Filesize
3.3MB

Download
memory/11448-1013-0x0000000008430000-0x000000000843A000-memory.dmp

Filesize
40KB

Download
memory/11448-844-0x00000000071A0000-0x0000000007516000-memory.dmp

Filesize
3.5MB

Download
memory/11448-796-0x0000000000B80000-0x0000000000BF4000-memory.dmp

Filesize
464KB

Download
memory/11448-820-0x0000000006250000-0x0000000006408000-memory.dmp

Filesize
1.7MB

Download
memory/11448-843-0x0000000006EF0000-0x0000000007192000-memory.dmp

Filesize
2.6MB

Download
memory/11448-841-0x0000000006B30000-0x0000000006EEA000-memory.dmp

Filesize
3.7MB

Download
memory/11448-842-0x00000000061F0000-0x000000000623E000-memory.dmp

Filesize
312KB

Download
memory/11888-821-0x0000029B18740000-0x0000029B1874A000-memory.dmp

Filesize
40KB

Download
memory/11980-1009-0x0000000000BE0000-0x0000000000BEC000-memory.dmp

Filesize
48KB

Download