Overview

overview

10

Static

static

1

12897e2e24...9c.vbs

windows7-x64

10

12897e2e24...9c.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    50s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/03/2025, 02:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    12897e2e24f1a59cf08655fcb274c08747ef550b16741e6306a0a8f94aefcb9c.vbs

  • Size

    25KB

  • MD5

    5c4dad0f397077e5e9cc55febfc096bd

  • SHA1

    eed1a50a4818890cb4c474792f8ad0258ab115a8

  • SHA256

    12897e2e24f1a59cf08655fcb274c08747ef550b16741e6306a0a8f94aefcb9c

  • SHA512

    90290ac0ca91e5cca3b2e19c4b5baec11523d7fe4ce674bd5f3db7e47f83deda55d923a635e2ad9e584af61c36e83209f548cfca867f9720a58a8a2181ac47c4

  • SSDEEP

    384:y8enbIbpBStxYUQHSH7l+ix/J/b6GvPpSy+tNywUTZEC:inucJb6UAUqC

Score
10/10
phorphiexxmrigdefense_evasiondiscoveryexecutionimpactloaderminerpersistenceransomwaretrojanupxworm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://45.93.20.18/
Wallets

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9

AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z

LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT

MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

0xCa90599132C4D88907Bd8E046540284aa468a035

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3ESHude8zUHksQg1h6hHmzY79BS36L91Yn

CSLKveRL2zqkbV2TqiFVuW6twtpqgFajoUZLAJQTTQk2

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2

bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr
Attributes
  • mutex

    k9ubbn6sdfs

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Extracted

Family

phorphiex

C2

http://185.215.113.66

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Phorphiex family
    phorphiex
  • Phorphiex payload 1 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • XMRig Miner payload 17 IoCs
    miner
  • Blocklisted process makes network request 6 IoCs
  • Blocks application from running via registry modification 14 IoCs

    Adds application to list of disallowed applications.

    defense_evasion
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables RegEdit via registry modification 2 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 5 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    remove IFEO.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 56 IoCs
    defense_evasion
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Modifies registry class 4 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 51 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 19 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\12897e2e24f1a59cf08655fcb274c08747ef550b16741e6306a0a8f94aefcb9c.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\12897e2e24f1a59cf08655fcb274c08747ef550b16741e6306a0a8f94aefcb9c.vbs" /elevated
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Blocklisted process makes network request
      • Blocks application from running via registry modification
      • Disables RegEdit via registry modification
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Indicator Removal: Clear Persistence
      • Drops file in System32 directory
      • Sets desktop wallpaper using registry
      • Drops file in Windows directory
      • Modifies Control Panel
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:5572
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Set-MpPreference -DisableRealtimeMonitoring $true
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1408
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c "C:\Program Files\Bitdefender\Bitdefender 2025\bdnserv.exe" -disable
        3⤵
          PID:1044
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2025\avp.com" disable
          3⤵
            PID:3708
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3136
            • C:\Windows\system32\vssadmin.exe
              vssadmin delete shadows /all /quiet
              4⤵
              • Interacts with shadow copies
              PID:1708
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c wbadmin delete catalog -quiet
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4820
            • C:\Windows\system32\wbadmin.exe
              wbadmin delete catalog -quiet
              4⤵
              • Deletes backup catalog
              PID:4688
          • C:\Windows\System32\notepad.exe
            "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\READMEPLEASE.txt
            3⤵
            • Opens file in notepad (likely ransom note)
            PID:3752
          • C:\Windows\System32\RUNDLL32.EXE
            "C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters
            3⤵
              PID:5308
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Windows\SysWOW64\msvcr80.dll.bat" "
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5296
              • C:\Windows\system32\calc.exe
                calc
                4⤵
                • Modifies registry class
                PID:3868
              • C:\Windows\system32\cmd.exe
                cmd
                4⤵
                  PID:5884
                • C:\Windows\system32\calc.exe
                  calc
                  4⤵
                  • Modifies registry class
                  PID:1936
                • C:\Windows\system32\cmd.exe
                  cmd
                  4⤵
                    PID:2120
                  • C:\Windows\system32\calc.exe
                    calc
                    4⤵
                    • Modifies registry class
                    PID:2188
                  • C:\Windows\system32\cmd.exe
                    cmd
                    4⤵
                      PID:5552
                  • C:\Windows\System32\wscript.exe
                    "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                    3⤵
                    • Checks computer location settings
                    • Suspicious use of WriteProcessMemory
                    PID:4076
                    • C:\Windows\System32\wscript.exe
                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                      4⤵
                      • Checks computer location settings
                      • Suspicious use of WriteProcessMemory
                      PID:4696
                      • C:\Windows\System32\wscript.exe
                        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1200
                        • C:\Windows\System32\wscript.exe
                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                          6⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5776
                          • C:\Windows\System32\wscript.exe
                            "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                            7⤵
                            • Checks computer location settings
                            • Suspicious use of WriteProcessMemory
                            PID:2524
                            • C:\Windows\System32\wscript.exe
                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                              8⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2928
                              • C:\Windows\System32\wscript.exe
                                "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                9⤵
                                • Checks computer location settings
                                • Suspicious use of WriteProcessMemory
                                PID:2652
                                • C:\Windows\System32\wscript.exe
                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                  10⤵
                                  • Checks computer location settings
                                  • Suspicious use of WriteProcessMemory
                                  PID:1356
                                  • C:\Windows\System32\wscript.exe
                                    "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                    11⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:5468
                                    • C:\Windows\System32\wscript.exe
                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                      12⤵
                                        PID:804
                                        • C:\Windows\System32\wscript.exe
                                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                          13⤵
                                          • Checks computer location settings
                                          PID:1672
                                          • C:\Windows\System32\wscript.exe
                                            "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                            14⤵
                                              PID:3524
                                              • C:\Windows\System32\wscript.exe
                                                "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                15⤵
                                                • Checks computer location settings
                                                PID:5744
                                                • C:\Windows\System32\wscript.exe
                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                  16⤵
                                                    PID:3676
                                                    • C:\Windows\System32\wscript.exe
                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                      17⤵
                                                        PID:1484
                                                        • C:\Windows\System32\wscript.exe
                                                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                          18⤵
                                                            PID:288
                                                            • C:\Windows\System32\wscript.exe
                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                              19⤵
                                                                PID:4372
                                                                • C:\Windows\System32\wscript.exe
                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                  20⤵
                                                                    PID:5680
                                                                    • C:\Windows\System32\wscript.exe
                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                      21⤵
                                                                      • Checks computer location settings
                                                                      PID:5520
                                                                      • C:\Windows\System32\wscript.exe
                                                                        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                        22⤵
                                                                          PID:6060
                                                                          • C:\Windows\System32\wscript.exe
                                                                            "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                            23⤵
                                                                            • Checks computer location settings
                                                                            PID:3868
                                                                            • C:\Windows\System32\wscript.exe
                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                              24⤵
                                                                                PID:1936
                                                                                • C:\Windows\System32\wscript.exe
                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                  25⤵
                                                                                    PID:1472
                                                                                    • C:\Windows\System32\wscript.exe
                                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                      26⤵
                                                                                      • Checks computer location settings
                                                                                      PID:624
                                                                                      • C:\Windows\System32\wscript.exe
                                                                                        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                        27⤵
                                                                                        • Checks computer location settings
                                                                                        PID:2076
                                                                                        • C:\Windows\System32\wscript.exe
                                                                                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                          28⤵
                                                                                          • Checks computer location settings
                                                                                          PID:6404
                                                                                          • C:\Windows\System32\wscript.exe
                                                                                            "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                            29⤵
                                                                                            • Checks computer location settings
                                                                                            PID:6868
                                                                                            • C:\Windows\System32\wscript.exe
                                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                              30⤵
                                                                                              • Checks computer location settings
                                                                                              PID:7044
                                                                                              • C:\Windows\System32\wscript.exe
                                                                                                "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                31⤵
                                                                                                • Checks computer location settings
                                                                                                PID:6656
                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                  32⤵
                                                                                                    PID:2756
                                                                                                    • C:\Windows\System32\wscript.exe
                                                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                      33⤵
                                                                                                        PID:316
                                                                                                        • C:\Windows\System32\wscript.exe
                                                                                                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                          34⤵
                                                                                                          • Checks computer location settings
                                                                                                          PID:6220
                                                                                                          • C:\Windows\System32\wscript.exe
                                                                                                            "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                            35⤵
                                                                                                            • Checks computer location settings
                                                                                                            PID:2228
                                                                                                            • C:\Windows\System32\wscript.exe
                                                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                              36⤵
                                                                                                              • Checks computer location settings
                                                                                                              PID:3948
                                                                                                              • C:\Windows\System32\wscript.exe
                                                                                                                "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                37⤵
                                                                                                                • Checks computer location settings
                                                                                                                PID:5556
                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                  38⤵
                                                                                                                    PID:7100
                                                                                                                    • C:\Windows\System32\wscript.exe
                                                                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                      39⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      PID:8988
                                                                                                                      • C:\Windows\System32\wscript.exe
                                                                                                                        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                        40⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        PID:9104
                                                                                                                        • C:\Windows\System32\wscript.exe
                                                                                                                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                          41⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          PID:9208
                                                                                                                          • C:\Windows\System32\wscript.exe
                                                                                                                            "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                            42⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            PID:8820
                                                                                                                            • C:\Windows\System32\wscript.exe
                                                                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                              43⤵
                                                                                                                                PID:9144
                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                  44⤵
                                                                                                                                    PID:9320
                                                                                                                                    • C:\Windows\System32\wscript.exe
                                                                                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                      45⤵
                                                                                                                                        PID:9500
                                                                                                                                        • C:\Windows\System32\wscript.exe
                                                                                                                                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                          46⤵
                                                                                                                                            PID:9648
                                                                                                                                            • C:\Windows\System32\wscript.exe
                                                                                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                              47⤵
                                                                                                                                                PID:9792
                                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                  48⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  PID:9920
                                                                                                                                                  • C:\Windows\System32\wscript.exe
                                                                                                                                                    "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                    49⤵
                                                                                                                                                      PID:10004
                                                                                                                                                      • C:\Windows\System32\wscript.exe
                                                                                                                                                        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                        50⤵
                                                                                                                                                          PID:10108
                                                                                                                                                          • C:\Windows\System32\wscript.exe
                                                                                                                                                            "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                            51⤵
                                                                                                                                                              PID:10212
                                                                                                                                                              • C:\Windows\System32\wscript.exe
                                                                                                                                                                "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                52⤵
                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                PID:8972
                                                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                  53⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  PID:9304
                                                                                                                                                                  • C:\Windows\System32\wscript.exe
                                                                                                                                                                    "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                    54⤵
                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                    PID:9328
                                                                                                                                                                    • C:\Windows\System32\wscript.exe
                                                                                                                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                      55⤵
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      PID:9704
                                                                                                                                                                      • C:\Windows\System32\wscript.exe
                                                                                                                                                                        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                        56⤵
                                                                                                                                                                          PID:9912
                                                                                                                                                                          • C:\Windows\System32\wscript.exe
                                                                                                                                                                            "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                            57⤵
                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                            PID:10048
                                                                                                                                                                            • C:\Windows\System32\wscript.exe
                                                                                                                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                              58⤵
                                                                                                                                                                                PID:10224
                                                                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                  59⤵
                                                                                                                                                                                    PID:9448
                                                                                                                                                                                    • C:\Windows\System32\wscript.exe
                                                                                                                                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                      60⤵
                                                                                                                                                                                        PID:9404
                                                                                                                                                                                        • C:\Windows\System32\wscript.exe
                                                                                                                                                                                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                          61⤵
                                                                                                                                                                                            PID:9720
                                                                                                                                                                                            • C:\Windows\System32\wscript.exe
                                                                                                                                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                              62⤵
                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                              PID:6496
                                                                                                                                                                                              • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                63⤵
                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                PID:8824
                                                                                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                    PID:10092
                                                                                                                                                                                                    • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                      65⤵
                                                                                                                                                                                                        PID:10016
                                                                                                                                                                                                        • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                          PID:10296
                                                                                                                                                                                                          • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                            "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                            67⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            PID:10404
                                                                                                                                                                                                            • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                              68⤵
                                                                                                                                                                                                                PID:10524
                                                                                                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                                    PID:10616
                                                                                                                                                                                                                    • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                        PID:10724
                                                                                                                                                                                                                        • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                          71⤵
                                                                                                                                                                                                                            PID:10896
                                                                                                                                                                                                                            • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                PID:11016
                                                                                                                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                                    PID:11100
                                                                                                                                                                                                                                    • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                        PID:11164
                                                                                                                                                                                                                                        • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                          75⤵
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          PID:11236
                                                                                                                                                                                                                                          • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                            PID:10396
                                                                                                                                                                                                                                            • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                              77⤵
                                                                                                                                                                                                                                                PID:10560
                                                                                                                                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                  78⤵
                                                                                                                                                                                                                                                    PID:10504
                                                                                                                                                                                                                                                    • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                      PID:10708
                                                                                                                                                                                                                                                      • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                        80⤵
                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                        PID:6800
                                                                                                                                                                                                                                                        • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                          81⤵
                                                                                                                                                                                                                                                            PID:10984
                                                                                                                                                                                                                                                            • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                              PID:10604
                                                                                                                                                                                                                                                              • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                PID:10372
                                                                                                                                                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                    PID:10788
                                                                                                                                                                                                                                                                    • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                      PID:10836
                                                                                                                                                                                                                                                                      • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                        PID:11140
                                                                                                                                                                                                                                                                        • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                          87⤵
                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                          PID:4284
                                                                                                                                                                                                                                                                          • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                              PID:3092
                                                                                                                                                                                                                                                                              • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                89⤵
                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                PID:6780
                                                                                                                                                                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                                                                                    PID:11272
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                                                                                                        PID:11344
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                                                            PID:11392
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                              PID:11440
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                PID:11500
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                                                                                                    PID:11564
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                                                                                                        PID:11620
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                                                                                                            PID:11728
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                              PID:11876
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                PID:12056
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                  PID:12160
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                                                                                                      PID:11472
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                                                                                                          PID:12012
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                            PID:12120
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                                                                                PID:12284
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                                                                                                    PID:12276
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                        PID:11956
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                                                                                                                            PID:11960
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                                                                                                                                PID:12392
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                  PID:12468
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                    PID:12564
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                      PID:12648
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                          PID:12744
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                            PID:12852
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                              PID:13012
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:13084
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                    PID:13200
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:13288
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4984
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:12384
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                  PID:12532
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                    PID:12376
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:13176
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                          PID:11640
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:12732
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3656
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:13160
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:13280
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                PID:7128
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9136
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13356
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13524
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13584
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:13644
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13752
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13804
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            138⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13856
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13916
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:14012
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:14088
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:14152
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:14212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  144⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:14268
                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                              29⤵
                                                                                                                                                                                                                                PID:2228
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                                29⤵
                                                                                                                                                                                                                                  PID:6420
                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                              27⤵
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:4012
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                              27⤵
                                                                                                                                                                                                                                PID:1640
                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                              26⤵
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:4732
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                              26⤵
                                                                                                                                                                                                                                PID:6204
                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                            24⤵
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:6948
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                            24⤵
                                                                                                                                                                                                                              PID:1408
                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                            23⤵
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:6976
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                            23⤵
                                                                                                                                                                                                                              PID:6716
                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                              PID:7036
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                PID:6964
                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:6952
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                                PID:6688
                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:5788
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                              PID:5456
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x360,0x7ff8686df208,0x7ff8686df214,0x7ff8686df220
                                                                                                                                                                                                                                21⤵
                                                                                                                                                                                                                                  PID:5996
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=77549930217664 --process=256 /prefetch:7 --thread=3776
                                                                                                                                                                                                                                    22⤵
                                                                                                                                                                                                                                      PID:7016
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1792,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
                                                                                                                                                                                                                                    21⤵
                                                                                                                                                                                                                                      PID:2456
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2200,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
                                                                                                                                                                                                                                      21⤵
                                                                                                                                                                                                                                        PID:3476
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2364,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:8
                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                          PID:60
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3452,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                            PID:1132
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3560,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
                                                                                                                                                                                                                                            21⤵
                                                                                                                                                                                                                                              PID:4260
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4544,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
                                                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                                                PID:6536
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5048,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
                                                                                                                                                                                                                                                21⤵
                                                                                                                                                                                                                                                  PID:6312
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5020,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
                                                                                                                                                                                                                                                  21⤵
                                                                                                                                                                                                                                                    PID:4868
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5104,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
                                                                                                                                                                                                                                                    21⤵
                                                                                                                                                                                                                                                      PID:1492
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5028,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
                                                                                                                                                                                                                                                      21⤵
                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                      PID:1732
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5124,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
                                                                                                                                                                                                                                                      21⤵
                                                                                                                                                                                                                                                        PID:7016
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5132,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
                                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                                          PID:6628
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5244,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
                                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                                            PID:6420
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=5288,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:1
                                                                                                                                                                                                                                                            21⤵
                                                                                                                                                                                                                                                              PID:6316
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=5300,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:1
                                                                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                                                                PID:6328
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=5352,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:1
                                                                                                                                                                                                                                                                21⤵
                                                                                                                                                                                                                                                                  PID:6800
                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=5416,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:1
                                                                                                                                                                                                                                                                  21⤵
                                                                                                                                                                                                                                                                    PID:6480
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=5424,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
                                                                                                                                                                                                                                                                    21⤵
                                                                                                                                                                                                                                                                      PID:6256
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=5452,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:1
                                                                                                                                                                                                                                                                      21⤵
                                                                                                                                                                                                                                                                        PID:6180
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=5460,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
                                                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                                                          PID:7148
                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=5512,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
                                                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                                                            PID:7004
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=5540,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
                                                                                                                                                                                                                                                                            21⤵
                                                                                                                                                                                                                                                                              PID:6640
                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=7112,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:1
                                                                                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                                                                                PID:6996
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=5612,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:1
                                                                                                                                                                                                                                                                                21⤵
                                                                                                                                                                                                                                                                                  PID:6456
                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=5628,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:1
                                                                                                                                                                                                                                                                                  21⤵
                                                                                                                                                                                                                                                                                    PID:3112
                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=5636,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:1
                                                                                                                                                                                                                                                                                    21⤵
                                                                                                                                                                                                                                                                                      PID:6888
                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=5684,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:1
                                                                                                                                                                                                                                                                                      21⤵
                                                                                                                                                                                                                                                                                        PID:5296
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=5660,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:1
                                                                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                                                                          PID:6976
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=5756,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:1
                                                                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                                                                            PID:6768
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=5740,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:1
                                                                                                                                                                                                                                                                                            21⤵
                                                                                                                                                                                                                                                                                              PID:6336
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=5772,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:1
                                                                                                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                                                                                                PID:6068
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=6228,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:1
                                                                                                                                                                                                                                                                                                21⤵
                                                                                                                                                                                                                                                                                                  PID:4064
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=6048,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:1
                                                                                                                                                                                                                                                                                                  21⤵
                                                                                                                                                                                                                                                                                                    PID:6736
                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --field-trial-handle=6032,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:1
                                                                                                                                                                                                                                                                                                    21⤵
                                                                                                                                                                                                                                                                                                      PID:1252
                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=5880,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:1
                                                                                                                                                                                                                                                                                                      21⤵
                                                                                                                                                                                                                                                                                                        PID:6292
                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=6004,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:1
                                                                                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                                                                                          PID:5176
                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=5960,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:1
                                                                                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                                                                                            PID:6352
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=5944,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:1
                                                                                                                                                                                                                                                                                                            21⤵
                                                                                                                                                                                                                                                                                                              PID:7140
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=5828,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:1
                                                                                                                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                                                                                                                PID:6708
                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=6164,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:1
                                                                                                                                                                                                                                                                                                                21⤵
                                                                                                                                                                                                                                                                                                                  PID:7000
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=6124,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:1
                                                                                                                                                                                                                                                                                                                  21⤵
                                                                                                                                                                                                                                                                                                                    PID:6972
                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --field-trial-handle=6096,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:1
                                                                                                                                                                                                                                                                                                                    21⤵
                                                                                                                                                                                                                                                                                                                      PID:6320
                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=7296,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:1
                                                                                                                                                                                                                                                                                                                      21⤵
                                                                                                                                                                                                                                                                                                                        PID:6192
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=6188,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:1
                                                                                                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                                                                                                          PID:1772
                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --field-trial-handle=6300,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7792 /prefetch:1
                                                                                                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                                                                                                            PID:6792
                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --field-trial-handle=6328,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:1
                                                                                                                                                                                                                                                                                                                            21⤵
                                                                                                                                                                                                                                                                                                                              PID:7064
                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=6368,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7876 /prefetch:1
                                                                                                                                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                                                                                                                                PID:1052
                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --field-trial-handle=6396,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7940 /prefetch:1
                                                                                                                                                                                                                                                                                                                                21⤵
                                                                                                                                                                                                                                                                                                                                  PID:6748
                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --field-trial-handle=6432,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7916 /prefetch:1
                                                                                                                                                                                                                                                                                                                                  21⤵
                                                                                                                                                                                                                                                                                                                                    PID:5232
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --field-trial-handle=6464,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:1
                                                                                                                                                                                                                                                                                                                                    21⤵
                                                                                                                                                                                                                                                                                                                                      PID:2892
                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --field-trial-handle=6484,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:1
                                                                                                                                                                                                                                                                                                                                      21⤵
                                                                                                                                                                                                                                                                                                                                        PID:2604
                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --field-trial-handle=6516,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=8116 /prefetch:1
                                                                                                                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                                                                                                                          PID:5728
                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --field-trial-handle=6556,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=8048 /prefetch:1
                                                                                                                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                                                                                                                            PID:5016
                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --field-trial-handle=6584,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=8176 /prefetch:1
                                                                                                                                                                                                                                                                                                                                            21⤵
                                                                                                                                                                                                                                                                                                                                              PID:4664
                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --field-trial-handle=6612,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=8224 /prefetch:1
                                                                                                                                                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                                                                                                                                                PID:6548
                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --field-trial-handle=6644,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=8228 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                21⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6156
                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --field-trial-handle=13372,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                  21⤵
                                                                                                                                                                                                                                                                                                                                                    PID:8956
                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=11272,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                    21⤵
                                                                                                                                                                                                                                                                                                                                                      PID:11812
                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=11220,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=11260 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                      21⤵
                                                                                                                                                                                                                                                                                                                                                        PID:11824
                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5644,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=10220 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                                                                                                                                          PID:11852
                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=704,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=13896 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                                                                                                                                            PID:11336
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10180,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                            21⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4376
                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5672,i,13454172063354252045,12603059543510483936,262144 --variations-seed-version --mojo-platform-channel-handle=13928 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                                                                                                                                                                PID:11420
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                                                                                                                                                            19⤵
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                            PID:6964
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                                                                                                                                                            19⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6628
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                            PID:4280
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6716
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                            PID:1588
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4520
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                            PID:3628
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4800
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                            PID:1168
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1744
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                            PID:1408
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6316
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                            PID:2800
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1052
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                            PID:3204
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3496
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                            PID:5664
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6748
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                            PID:3820
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6908
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                            PID:2596
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5308
                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6312
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                              PID:1684
                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6300
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4852
                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6428
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                PID:852
                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6348
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                PID:1640
                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6528
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c time 00:00
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                PID:1744
                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:7084
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\wscript.exe" C:\Windows\advapi32_ext.vbs
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                PID:2304
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM powershell.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:3628
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM taskmgr.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:408
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM cmd.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:2248
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM regedit.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:2076
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM control.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:3940
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM gp.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:1492
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM msconfig.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:1640
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM MsMpEng.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:1608
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM avp.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:304
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM AvastSvc.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:4968
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM avgsvc.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:5308
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM avc.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:2892
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM NortonSecurity.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:4092
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM Protegent.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:3496
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM pavsrvx.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:4472
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM mbam.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:6772
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM avguard.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:6032
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM mcshield.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:7024
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM powershell.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:8708
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM taskmgr.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:9288
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM cmd.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:9628
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM regedit.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:9852
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM control.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:9996
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM gp.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:10144
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM msconfig.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:9132
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM MsMpEng.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:9480
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM avp.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:9680
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM AvastSvc.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:10028
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM avgsvc.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:9228
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM avc.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:9316
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM NortonSecurity.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:6776
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM Protegent.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:9380
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM pavsrvx.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:5216
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM mbam.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:10288
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM avguard.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:10496
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM mcshield.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:10664
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM powershell.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:11676
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM taskmgr.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:11928
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM cmd.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:12168
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM regedit.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:11928
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM control.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:11532
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM gp.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:11928
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM msconfig.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:12328
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM MsMpEng.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:12508
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM avp.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:12708
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM AvastSvc.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:12900
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM avgsvc.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:13128
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM avc.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:13260
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM NortonSecurity.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:12408
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM Protegent.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:10256
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM pavsrvx.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:8376
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM mbam.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:13280
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM avguard.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:9424
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM mcshield.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:12596
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\taskkill.exe" /IM powershell.exe /F
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:13452
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\pei.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\pei.exe"
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:7580
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1821129085.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\1821129085.exe
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:7216
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\sysldrvcs.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\sysldrvcs.exe
                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:13660
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2838429677.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2838429677.exe
                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:13964
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\638814105.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\638814105.exe
                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:7880
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\156775930.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\156775930.exe
                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:7744
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\566429452.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\566429452.exe
                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:7596
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\sc.exe delete "MgrDrvSvc"
                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                        PID:7144
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\sc.exe create "MgrDrvSvc" binpath= "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe" start= "auto"
                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                        PID:7688
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop eventlog
                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                        PID:11888
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\sc.exe start "MgrDrvSvc"
                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                        PID:4544
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\745621045.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\745621045.exe
                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:14240
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\taskkill.exe" /F /IM explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                PID:7448
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\BackupSearch.dxf.lcryx
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                • Opens file in notepad (likely ransom note)
                                                                                                                                                                                                                                                                                                                                                                                PID:8104
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                            PID:776
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wbengine.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\wbengine.exe"
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                            PID:4676
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\vdsldr.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\vdsldr.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2352
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\vds.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\vds.exe
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                              PID:5420
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                              PID:4164
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                              PID:3824
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                              PID:1168
                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4976
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\AUDIODG.EXE 0x4a0 0x39c
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:8624
                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:7924
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:14332
                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:13668
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\dwm.exe
                                                                                                                                                                                                                                                                                                                                                                                              dwm.exe
                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:8948
                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3056
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\dwm.exe
                                                                                                                                                                                                                                                                                                                                                                                                  dwm.exe
                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\dwm.exe
                                                                                                                                                                                                                                                                                                                                                                                                      dwm.exe
                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:10648
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\dwm.exe
                                                                                                                                                                                                                                                                                                                                                                                                    dwm.exe
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:7796
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:7424

                                                                                                                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                    Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                                                                                                                                                                                                    Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                    T1059

                                                                                                                                                                                                                                                                                                                                                                                                    PowerShell

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1059.001

                                                                                                                                                                                                                                                                                                                                                                                                    System Services

                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                    T1569

                                                                                                                                                                                                                                                                                                                                                                                                    Service Execution

                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                    T1569.002

                                                                                                                                                                                                                                                                                                                                                                                                    Windows Management Instrumentation

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1047

                                                                                                                                                                                                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                    Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1547.004

                                                                                                                                                                                                                                                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                    T1543

                                                                                                                                                                                                                                                                                                                                                                                                    Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                    T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                    Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1546

                                                                                                                                                                                                                                                                                                                                                                                                    Image File Execution Options Injection

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1546.012

                                                                                                                                                                                                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                                                                                                                                                                                                    Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                    Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1547.004

                                                                                                                                                                                                                                                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                    T1543

                                                                                                                                                                                                                                                                                                                                                                                                    Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                    T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                    Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1546

                                                                                                                                                                                                                                                                                                                                                                                                    Image File Execution Options Injection

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1546.012

                                                                                                                                                                                                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                                                                                                                                                                                                    Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                    Direct Volume Access

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1006

                                                                                                                                                                                                                                                                                                                                                                                                    Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                    T1562

                                                                                                                                                                                                                                                                                                                                                                                                    Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1562.001

                                                                                                                                                                                                                                                                                                                                                                                                    Indicator Removal

                                                                                                                                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                                                                                                                                    T1070

                                                                                                                                                                                                                                                                                                                                                                                                    Clear Persistence

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1070.009

                                                                                                                                                                                                                                                                                                                                                                                                    File Deletion

                                                                                                                                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                                                                                                                                    T1070.004

                                                                                                                                                                                                                                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                    T1112

                                                                                                                                                                                                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                                                                                                                                                                                                    Browser Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1217

                                                                                                                                                                                                                                                                                                                                                                                                    Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1120

                                                                                                                                                                                                                                                                                                                                                                                                    Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                    T1012

                                                                                                                                                                                                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                    6
                                                                                                                                                                                                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                    Impact

                                                                                                                                                                                                                                                                                                                                                                                                    Defacement

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1491

                                                                                                                                                                                                                                                                                                                                                                                                    Inhibit System Recovery

                                                                                                                                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                                                                                                                                    T1490

                                                                                                                                                                                                                                                                                                                                                                                                    Service Stop

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1489

                                                                                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      2.5MB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      024dd77c38676e6ce0a5a2201f6145de

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      5d020adf1adb0b0c0b370df63b2b09d89df0acfb

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      b4553ff5d7ae98614d4856de134f49e503f046a15fc49033af3232fbeab9ed4c

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      a94312eaea187830c28680164d80e3e9c2f58a7b24930dc224ac52a308406ccfd56524dffaf5c3a37e6b713d1d711f1b44d99d1fb60669c8b2351bb4c9d2fc85

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      280B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      33a153c007f7b1e4096744dcefe6329b

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      ef521c777af11475b16f30097e252fb510dd1ee6

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      4a180999d3b25bbe94ce7a1e36ab27a39d6ece41ec13080674f1660e8166b622

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      9eec6dea2bea024d35cb0c3d8ccb065ae1dc6b3890bf4f4e991fd3f829cc632f226ee20212004e44ea3fbc67264a8c6165c9032125fcdf4256c061c3732ee60f

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      280B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      65044109d1beb8ed8d59560642cbc519

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      0084485b0aa26069232fab51ee603682e8edfd17

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      a1e0b448218678b30356cbbe4092ea091435e7450822a9748361b6e8b198962d

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      96dcc68fe92f98c4329a8335cfffdb0849a52562431045ccc42076bda0abf3842491303fb669246bfd04e64113688d3f90000a09571dd76ff84b52e34e45f9b6

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\893c9435-fab4-46a5-9954-fabca474cc8a.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      36KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      bcf2a21adb4cea4d9e791187442ba1b8

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      11b2af1304d8c04db23e355031d1306875b75c42

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      b0856ac2a2a64466753a81f465007fc175a44939d901ae55facce5a0f6374444

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      e26fa03de310f2780fcbe31c013fe02a5a7f0ec370d1fe89b7f3c734cb612b300c5c18293d5432950ff6275701cb3891ba80dcc7194f9a36bfa9f4fef5809759

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      33B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      f27314dd366903bbc6141eae524b0fde

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      4714d4a11c53cf4258c3a0246b98e5f5a01fbc12

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      22KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      778ca3ed38e51e5d4967cd21efbdd007

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      06e62821512a5b73931e237e35501f7722f0dbf4

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      b7e1bfadb8d9c061f17a7234df012df7842ab1aa8fb6f9579fa3f0a3b4a75bc0

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      5f6f02099ca8079305fb7e7f43ae4344d522271fe30379c0854d6a81b7d8adf408a50a4b799b5f52e6ed162ba6ce7fe97e24a2b9719df780e75683d3aa103d09

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      51KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      32aaa2c79e0b335130cfb804de2d071e

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      fc4a04bcbdd9938aec1d53df488999d7cb8829fa

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      f6fb6cfd2637df7e21c4505ebdb9bc988ba9b2c9408c78bbc90d8856a916217f

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      c4ec33f7f1a9da6bf825aa3dc71bba3757b0e24ca0836987a22f2377f90a578c4445873e12989ccee6fe051dc455e255253edca96e1405fcde3c9ff7fba30af0

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      247KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      40e9811a8168875f77a707d6da71e710

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      2569cd0466c78adbb50a84afe72ae01ad02c973b

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      6706201df31ba0673e0127f2af04b452bf025fe2a97574ea187031e98b3970f6

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      4106c497171570a999f69ce807c9dc75fa5ca5d2fff67a4f82fc4c6531c4591e39330bd761c03249967056507249605991c7793e519c8d39a1bd2fd5d68ffca2

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2ad5c322829fad1b_0
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      349B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      f4b41af354af11de2dd0c0e8d11c9e74

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      0aa35b3726835acb4c1cd50eb01b3a2208b8e04d

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      fcbea3179cf4a18e6d09d2e4f58ba058ae8d086938f949a164b205795776f640

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      3dd5ae6fc3133468e753bf1602c0da8b6739db6ab68b925f88f68b865a8907c18bc2d4de1411df025f492ab9d66b1ad787d52f0e1ca541f5f5489b5511e0acd7

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4cfe28a2148df9cc_0
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      07e56f429b3dab0a9de4bee0bd0c3479

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      5a29a991534c18b8e941e607c4111c9b56c204bc

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      9f0bdcaa250edb2345dbd65ab5171c2b86ee45ba9c4ef365f09c9041ff2664e4

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      f89ec53b55e89a76fd2b3b6fa07690972a89344af4cc2842facdbd6e2c2d6b68d3576591668dc1f1716da9c4a7451427638dbd1aef3cb5854da41cac860fc4db

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\79850856dbbdf689_0
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      25KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      75a507c71687a86b7693634bf0673d36

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      7d297880737cde3c5c15406cd606d0a308b8fcb4

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      1b757be9cbbec1742c3e76d2ae99c14420f27fcdf3d379d2d7824173daf61b12

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      5af491a191d78b1b387bab2095dc19c6c7bb94ebd167fd64fb70529098c9cc1e5080dea0c21bace8460c7076a2f7a5fed6f261128d8c50031133af2aa3aae245

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\98c6163a41fd21f2_0
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      45KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      390d1e17f0ee01c53febadfaa80b7c63

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      beadedff50b8958d1c8d8c02c8dad0a58d5dffa4

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      aec395ce29b251bda73d49df7512d6831af01901ea0a8c2501a5229304fc74ea

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      3f5244fa2554eaec2e4cb2ede54524c3b5b5725f4f829d47975f8cbaa8354f9bf60a0b7adb9b8422cbe1585b98c08f2708e1e5d4ef2291973f9e15f58ec3d129

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9c560754eea04eac_0
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      322B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      76dc16eaf5ad185d997e50d76fd0f74a

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      d601e521023af64b6239f0d8ae28f174b9be9fd2

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      32ad8d4bf12f9d8dafd9f40d4619cc5da731fc1fa7c50c759c0f1e3cd43c7915

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      f1230fb85ae7488e657bb2f2a736b3020457aed44f42916d941c325234d3c3f4ed756018e74591968b01ae022839acc463b20fba0ee5c607d7816890cf81b837

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9c560754eea04eac_0
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      318B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      bcaceae2faa7ab27c26b42e29af843ea

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      02adb278f8814b33e5bb4c4979aee8f5e03f01c0

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      01e746fc96ec64d2b4adb7996c06e3631797847b607ddb1c25ac39b748ccd329

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      67521b62f2ce7f85f34fb186a4c40b308164103983dbf165e453771d3bcd6ff8d486a267fcc646ea969c246a09fa5f540bf2cb2aa6d5dbc91b5bf28b1040af52

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aabd52f3cb5d0709_0
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      276B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      ef390350367a938138b89ff8cbc0a286

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      88d36651fd8760c0a28a8debc6de2fb591b006ca

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      64fb4aea7b7a9b003b8966259764973c55db1a4555b6cfe3627cfab058c4d017

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      fcac204be427cd5aef35a1ee0469a9e5dc7492cd892897bc48b5a236836cec682a0928fcefc383174a1f3544104ab53bbce91a60fcd3a25bea5b272b8f433727

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c11a953a47601d78_0
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      253d6eed365a611320b541cfb9317c75

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      4a7ea41add1604d890b6d3291f25e834bb469e28

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      4f1e62781b16c0f441d0119565b18bd89ef6ee36a24278a001c810557b98fd4c

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      cd4e4d1c48e8938d9383a897c5938ca8e4cc4653d3d22f53c90b57f9ffe52ab75460a382cc30e6a9086e80f46735574e293fb0dcf2199297eec4bbb475d449e9

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fa15b0db451511d3_0
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      13KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      c3097ef85b1020e9f54c8287c7e73d40

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      8e682285f689ed7e3a627954141d674112973e03

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      631a66fe0485f0bc9c0252b355162fe5c7f8ab0c3b6aed113ae1fd962a87dc25

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      7e2cba7c48f6c0615b4a0c8e57f15a97b8fbd1bc8ab112791e4e4056c5f0e2112f278da52aff14c639eb98b6edf63f1b719a60838a56eabc08b6f894c10cedd9

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      fccdb90d1300334dc67ac9cb2a6dc98a

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      c6e20fcbc6d1c3dc8e5651c2215cb710b1db8a77

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      3f25e26f1327d6288baaeb66803c00fc4110ac7fa8c14b958cd88ff2cc2d6292

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      b6c37b530da1f71e9f91e890e942d163d9f4005ef7cb8f970dc89466cc22c3302fd9858996dc853a7fcb203aa5e3ae67001186ef384872876be92d5b999064eb

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5f0ede.TMP
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      3KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      03149f477beff5eef19fd2325e9eb9d1

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      89256332ff0094ddc895aa96627fab0a72e1c3d1

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      a202df816008cb88116f98dec6140a873781df163132441f0a8c658734338198

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      13efe19c80aede167f124f102fefc181ec29e3f8b6e8d2e399efec712afffaa9dedf79230544ea6ab7dddf5f38797a17c6d7cfeb1e50a1e3b236f516996c9a4e

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      2B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      99914b932bd37a50b983c5e7c90ae93b

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      503KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      95ad76e4e5040354bfe0a3cd06fe87e3

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      48cb1248dded3651dde75ad01cb12daa00273b72

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      cd9375606f81f8becde3130cf7c3858f7e1563e64fa6e5684f0089770fb053b2

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      98113ba75ce471b0f462b15b395d1e9a3c72b92a85c4522ba415aff11d69a437c1213f39cfd68ce0e4a6201c14c4a2b4d336d02f31408656a947f86493b92d99

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      224KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      7d3d6e8700e5f00f57f04ac3fe8ac452

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      647c14384e6d583a030d900f63c561a0d8769867

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      a0aae631aa739442addfe0d70b00baac2202eed9c2c6f842f08ee3de240461f1

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      591280d426f7c6e15aa49a13f4dc52ffbf531f9c77eac3f27846e0f599bc15bdda17e675fd7987b516d472d422a79f46d5164d3b2ab1a4be724256558f95e01c

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      16B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      46295cac801e5d4857d09837238a6394

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      353B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      aa3b519de7409f0d1bda59aaabe87385

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      0b774a616ec99160b59f57bacedd38454baea0bd

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      a33d4ece299fffb5c06247e73568966c8ee7608e2268e119035c489ee3c8c862

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      85f994e900bbff40add9ac40c3145634fafb53c52c1208ffa1abf373cdb9b4eca2a6dcbb73481f4fe831896e71f1b7e3810f85af7386d19d1f862af3db72cc01

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      23B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      3fd11ff447c1ee23538dc4d9724427a3

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      1335e6f71cc4e3cf7025233523b4760f8893e9c9

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      c57f1dfcf2962977693d6b54264aa00c

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      bb716174469b7e4be7a647109c2c5ea261e6fb25

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      38b1cb54176c180f945bea2028db2aec0ac39f00b951cc2a972c90572cda9518

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      4e7d8f2dff8f2e84c6815c72e0681ea8e64774e8fa932a69770aafd887c0d3c1a384e966ba6a8e2ccea45e85a09ef3cd275452b63855f68b4cf74d55db289a6c

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      2B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      d751713988987e9331980363e24189ce

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      40B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      20d4b8fa017a12a108c87f540836e250

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      1ac617fac131262b6d3ce1f52f5907e31d5f6f00

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      413KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      0fcbf00915925da8d9dc424a122f31bb

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      73ec5a317757e3765d4be3559f9c10c7cf121c03

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      54f1ed169a305dee57817ffdd8070eb8658d5a77888fac9b9351d2e870f70c67

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      5a868a6e0d49f47181531e34169cba4f34bd8bde346ef085fac3e84f29346c17af22c89dbc120ebc768fb4bcd4d997694e452531fef14d198718dd8571ad008c

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      16KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      e41ff458e656f0c8180ebc057db44e41

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      4e076e5e51da73b6b6b65908ae565751e72dde78

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      5fdbbaa5f1d465de3d773e930c6395a2a4dd5f5f6baf903fd604b5f4034cb64b

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      151cc28ab86d81292834d21c4474201171b17ca78cb8922669b85c755c27e27b4adb84a71773b048503116a6e383ce4adb01a9e61371c5590433d5a75cee6f4c

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ad6c1ca5-41b4-4af5-b51f-cbee07f50124\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      423de9989e3a9a7b809cc8fa23c404b6

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      0c856bc31dab6066de3962fcc6c9e56399982eb5

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      2381d1c58ebd5c47e1baa9f194749def523e54fb26dd34b9f630d22b22607e6c

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      1a9d968e775f95049bf0b171fd7e2df7af02d829fe5ed4d99b337d38edb663e306f49155fb2a3f2b6c04a624130f8110563fa1b24c591854f693212c4631f0fa

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ad6c1ca5-41b4-4af5-b51f-cbee07f50124\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      4589ada09698c4188e3edcbc413ddcd8

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      f6bf7f1d33f9eb5b8e3312ce266104d14d91bccc

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      c97e87994823233c00ff4c39c0a799028fd903b0da33777bcb73edbd77ab5e0d

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      ee3d332646cb4f90a0416ac9a0b3fb3117c5326b3065b50b5494e6ae7ddc671e822d623237cc930c33a9e26d5f8ecb7eb2e41dc570663bd8d91d20ea6593a890

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ad6c1ca5-41b4-4af5-b51f-cbee07f50124\index-dir\the-real-index~RFe5ea7f6.TMP
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      48B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      604c3b8321a2b558178bcd46d7fe5888

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      982bd5c918634777084ce856767b1877771ed79a

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      b028bc85bba6755a08bb5b10bf1ec20ed726a12c716771d91e5562a03f9dfb80

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      7e9abaf83d79259a1a60146fce55a7d48124b245fe84c4d0cc3dc6be9161ed1a229558cca3c05e8511d7710437da4e5e186dc4ec0e48686ba1ffaab3d2f1a43b

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      176B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      ccc28e9681a6930d77441576e10e0080

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      0ba5d1fc3e5f117654ff3401fa8768ec483c34b5

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      7e68ad550b839c4e26a2ac39488d67ebb2c1199c3ca064d60d3adcca6ba5d27c

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      28347d520c78344e07e5cf25cf66366d994a287336e5dd9020c739f2bcb60a4953dd8101839622b84692a3ac53ecdf09bd04667909ee1f1d7f94fe4744e32003

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      178B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      1f9b0adb76eb389f3f60c9937729d54d

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      4207e81512de26270a1768f40df74f55b8126da6

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      a3d7675298f5b690a45d46967b0c406f511052b5dd29b4787fabb8ae8d18afde

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      5c699da75d317539ea30df4d958d317c5097102645436a65168b545d820238aa88f4391cefde731389ca6cc13a879b4a4c8ef8ce91119e15dfb9cc83b41eddbb

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      114B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      7ae72dac3bdb6c7315ab0f220b26bf11

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      835aecaca78b3c92440405297bd633782fa916e6

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      5bf30c25b59e3e95889feb11f55bc02bd001a3361c7e6f4c5bf4467835fea980

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      75e7f541d187a2ed67a6cb9fdf28314282a5e9f631922050a148f3c1ca5bad01eb15f3ea95d26e943108f8a3ae61f73280048dba7f5b2aabb355573000cc9b12

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      114B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      a2bcc2c9ed04f3ba7273a26bb8f7de9a

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      a8e1efee0725384c195cfa7e1ffc1885beef2e69

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      248e2d341117ab72b3d189645d903f649db73abbebfbbeb7f69b31745f862c91

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      a9bb3c5329e3694d931c5b1e1d7a69b72d6f77727eec68abeb3b79a203cf42be9c25041e2cf1f5ed7ea98c11016d3ff4963f05add9bd0d09323b999ec2c9abf5

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      114B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      f9f2edbd34c27541dd1cdc99f69869c0

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      ac71e261dd1132f45acbccebc2406719a9218e9c

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      6d056db4148564b8048234e65a93c4e3e5508fe0cd8a70c2366156784cda2ac9

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      e4a2f65571b41e49aa21f0bf453824810a7dcbfa4b407dd93b0e8a2b7c5d3ffffd9358b767484e308f282c415e52f0453a8ce8f4d95835c689565b71232365e2

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      112B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      08e4815c46e842e03ece63839869e376

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      1e644a85e5aef4df9616c1e565044ca00d10a447

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      1fcc1a06cab0d8e17c6fff8bb22cbbc5a7c72e247f902825f29e7dae8aef0768

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      0dab7b9eb9dcde9d2e8515df718fa740ba6b5c6fe89b6634e60e47b591a1a13f1cdec707451cf0364dd8d30ad40a226d0892156cae0f1bcdf219e384a5d541b7

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5e26fe.TMP
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      119B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      fb1377cf1183e0f0c47d537526d40330

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      25f1a9049d2b1c3058e549a4d15e3e80f1aca969

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      55901fbea0523420844220e5395d222ddbababf115a33f839a326f985c238073

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      9caa3a0c51b72ba51f62abf60de66a622a2dc75bfd5dec68d9fe51ba6344b0afac92d8bdf952250134b1f0a7d411c07cdb19f38e361093b5b97ef09612733330

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      96B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      d73ca51ffcd8a3a509dca94d2a86e254

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      060c7f555d998d9ea4677e6ef9583abb5f0c9876

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      fa1cebf6570fdc9e5fc7d19489dd5815c54048aaf17a43c0671355501211e188

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      87edb04018774f46cfc904e154b01075262cb5b22b5d4c0be102363daf3d7480d2b827b9e104504564933a9f145e7f77027054e5fb922c4bbba638528cddada1

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5e7647.TMP
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      72B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      74ca884078ecdaecb8ece78d090087ce

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      170fb1de9c4e68d2874854540d8ddd1fc5b33ac2

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      7cf5d29a705bbb5d9f83e1091da350c8f158696504463e1ae8bdef52cf5c429d

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      54a412b6fb09c49b4c8278e0a3d884cdc40bc06c57f7576ca355f933b690c4f1c235e0b05c1525fed8d0c7351aaaa7e254109b46cb80ba7a9ab42f3b9ea19259

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      22KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      1f86ee7fa25348afb3425604dce553e4

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      af53bdab785427433eb66051f1273702327b49a1

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      903f880a1974b599854da38bac6c19886221152c0f3595de1f2bdd7696998e49

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      fc43c1f484d69fd37589f36743532688a096da67a76c41679343d69406e9cb057c0926dd938141fc24f9de1c7829508b58eea6c925f8b03cc6f02233fc0c3dc4

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      12KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      18261eb12378081f939fb9415ca0c9e1

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      20d4ff782e17fe45e71c3f9fc60a94655f72ec7c

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      12bbeec9a0af9e3ed945b28b9b8ef89b2f897768d1ba3ffd6f3fbb42fa5bc556

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      fef634b4ce77c2f36ce1bdd63e8ac28e76cd089f0bff33f4425c757ddf37fe9fab30dea7b5bb51c91eb27012cf78800e03643e13d51a25bf624ce58ab3488a80

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      9e0d3804c6be2a19c97b8b78db89782e

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      a43b82acb263faefc5b36311c736c3e585867348

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      bc3167fd9085296491cfab6edee5d05288569f3e25ffc21e23dfc50849bd93ad

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      f1474ff7acb9c18d7ab5e785af8a6970f50e54e71a4f31e008fbd9d5624f8fa2a8860b8794e797a0919d70c81285ace166aba9fe8ebdb0c3aeb972e7bda8e53d

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      41KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      a005ff2c8f2728bf5a651232bb0ab6b2

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      e3fa8b7d8ade3631b3a30c13bb05b27aa544eef6

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      2b886b6309471ecc2573f987d96f4c25a048e8d786c14741ef83852cea8e1e71

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      b7e5796dbc0bc5062b2620b094e01a612a22effd11c519f9564b0d2a92979f9c6949b87605792cb345a018067ebb5746f23e18dfe604e014a5e4fea74066b50b

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      41KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      8264ca9ecaf593c6812ea91d0539cc8d

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      69e5767732cc658ac9e65d39e54f559778e439bc

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      86694ef64dba1d1fc68967e126b99f0a8a5631fdad09d6cbae45848516392d57

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      46a1368fc12a423d1dc49bfdf8b6771d22093d6677225906962039149e4f4d74dd65de4003b9f67c7d68e68904e32e984bde9151fef102de56068ac6b0c68b76

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      41KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      447269220ebf48ef2fd2e6a4455f1a3a

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      85a8980f38b5a0baa692ab344ee26c88a5ca64da

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      3c0fb161c4f76ba57a298689b74f3a7552fef645db0f70f498015fd0c65a389f

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      4e1d33921206a8a41c4286692097e487f8de345493bb56c9a49a2247b7835b0941c893e2a2ae60ef04173d6bd022cdf4c81f407611001f2751cb478538609901

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      6eb9c2861b11900e095c61673f8d54f8

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      84e17dc793bc8ddb168d94938affe1a37bf6cbed

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      983afe7fd4ef4ced5bfb96720f6cfcb1586ab9e541d11311278e478b704742b2

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      b44f7a4609d93226605c731a81e3ffd28da2ae7a8382d049c6f006c51a4a699930456c8bca934ea216f6a6058a36981d73ad757c29d48e905c3d3b811d0559d9

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1821129085.exe
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      101KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      8a30adfbb8c9ed8170177ce8c5738fbf

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      2d029ddd39fe81a08982dd4309a74045aa91004f

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      72b19310a8c3cdfc23be1041eb773e6e41a08ec608e53b027b32e05a275b1da9

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      8885308b53b8d1baab14a98ec257acac9c700f2cebe48cbb79a25e3d7133f0016ba082ec9f8397c9b1677375dd5a1d3894d813aba5947f267b44b012fa6a027f

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2838429677.exe
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      13KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      181921fd5d4f7e043b446392233698ee

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      0f710714ea4c01446dcb2ea4f29256fd53633f5c

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      aed4ab578ba8613117a2132bee215cdc3b360a1d9f993ad937ed3eecd7e9f3e6

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      a04699fa408ceb79f89cf61f2bea6ab85b6d93b52989f7d5ba6bdb22964fe8bc2a19aa3e1a02b063b11f8a63f3d3582ba0a621b97d911c27e2010fe9df5c6172

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\638814105.exe
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      53KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      60686a27b79838583920c9a0954104c9

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      0c253b3c72cd5b01a9403230ff3ec9d3cdd8b71c

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      270149da5feb9487799083b5e76d41d3aa69afaf8f731e72e7d64c3a7c070c7e

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      c0a9308b5a3baca0906c9663ca3e3eaf64fc131aaa5358557874b30e4b743ffe898da6fbace032c3481693bf9081f938127fd07c8d550d9eb74958b20e24ab04

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4q4mcgzq.g3s.ps1
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      60B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\READMEPLEASE.txt
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      265B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      e88249b855fa0eed74d36842922b66ca

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      90c4bee3131270f88d3a9a40465a76d4108283dc

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      c10d2b501bcf4f50ddcc134b3bca17076610cf15da53cf73959c43824f0e09dc

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      97c84807ef34b9eb96304d29b072f636faf8538f236414bf8ca0ac979635f6236dc36998fdbc5237898dd3c2864a08c6bf687805c1dbf4398499f2ce9647a1d3

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\gcrybground.png
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      57KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      44c37bf04e611bc7b7ea83f1d67b9223

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      8e59758f8142a3399a096a5f3a6db1f087643f2c

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      61c4d906945afad5f18e0fc042a359a57ea54c0c8439b91bfb1b7b9515fcf70a

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      1f68c87bccf20b63d58e00534095eb686a05311335abaf64c74b583751afa2e198224d7a33bc76cac66c3d2528da958d9b362251a9840a66b5ee5c5888e43911

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\msvcr80.dll.bat
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      137B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      d3c8cdc769514ce85192750f1902c2ac

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      bebba274b8268a749dc3010700bfd762b57386f0

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      e69ca202d729a3a721f87fcbc4510479c59cd2423294a269204466474943725a

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      66b63f8af41575ac1b486735efac9155e1dfe37d83e74944ee77b8a5ec3632c3bc0a0aefa1c2fe04ccff439ee09b32ea2176bf815f84c4cc2dc90a4e953e31f0

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\systemconfig.exe.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      f7f9da3c5b7b83cceaf4caaefaacf294

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      a1e8fdec05acbbee9db2f800c71c5d71fd9593d8

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      fa5361028ad789b0423c8528a333748e628efc214f74a89840ed678abd068f79

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      53ec381354624b46ae12024216e95d6303e697023d9b8e4f69c03a4dc096f6dcdad5253a5b2bdbb813b66150f132ebe9845f722f53e1f82d6bbd7e51a11dae7a

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\advapi32_ext.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      12fab7544912da13a25635c1c2c40044

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      35ffec9f570c66a5ad2e4c733ffec8c00c546bb4

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      82cdaf326f78c9ef5f6b5fd7c1307ca53efb80ea76775097cba45bfad276fa8d

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      8820a71932941ea55114e974702eb4459f1019f43471e8abd9b84728c57454b539147f355e825cf99977c3a0369f7531cc2362caf1ca78609fd5f057f2b6e018

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\pei.exe
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      10KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      4c52cf849be8954638925c242e0cc976

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      949ba0061ea9dbe3b9059bb2a7b20caa74861280

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      fa6fcf2e154c0b18b12ab86267ccd38d79cc9c27e7e261a7e9201a0a9dd9d0bb

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      c11572dcd274bdcb5e94cf38ec36aa65e4d5605df250ee8887cd5098b044e3e2e71be3b3292118b967e27bc752b5cf5d9c8da5ac2834b7c156302c307abe123b

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\drivers\etc\hosts
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      2e307117fa5dd587ce5327e77b72547d

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      3971c0da252fab4946cb581d8e4224ef4a470c03

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      aebd2d40c1457ae5508ec489138266baf1d11ebd71d87d65c52d14b488f05904

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      70393958cfd4ed35874f326b4c23300e663a7b29f91db7c39cd57ff79107f7800243386c853a7525d05159087114b6ee6cc5ada3895a5584a1b6b98ac0ee1482

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1408-5-0x0000021AAC920000-0x0000021AAC942000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4676-1147-0x00007FF880990000-0x00007FF880A3C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      688KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5420-1148-0x00007FF885840000-0x00007FF8858DD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      628KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5824-1383-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5824-1378-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5824-1379-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5824-1380-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5824-1382-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5824-1381-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/7796-1348-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/7796-1349-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/7796-1347-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/7796-1351-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/7796-1353-0x000002321D570000-0x000002321D590000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      128KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/7796-1346-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/7796-1359-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/7796-1352-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/7796-1354-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/7796-1350-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/10648-1449-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/10648-1451-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/10648-1452-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/10648-1450-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/10648-1453-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/10648-1454-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/10648-1455-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/14332-1338-0x0000000140000000-0x000000014000D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/14332-1345-0x0000000140000000-0x000000014000D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/14332-1339-0x0000000140000000-0x000000014000D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/14332-1340-0x0000000140000000-0x000000014000D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/14332-1341-0x0000000140000000-0x000000014000D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/14332-1342-0x0000000140000000-0x000000014000D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download