Analysis
-
max time kernel
11s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
-
submitted
23/03/2025, 02:53
General
-
Target
8642cb9e190179e87f01d91201b35264b9d29ce6b3233d1bd9349bcdd94e5d28.vbs
-
Size
25KB
-
MD5
c598c6861e21d65a2f2788d17d0b2c91
-
SHA1
ef1a829a8a86a75a02c7602ae9ed1d67f9058775
-
SHA256
8642cb9e190179e87f01d91201b35264b9d29ce6b3233d1bd9349bcdd94e5d28
-
SHA512
c13b6db2bdd04010d97b02590fa6aa23b49f865144839672cab3331fe2d5510e7d16882b21691058e82f6fb8dede06deb9c2fa11974d3a8a6da4a259858536a1
-
SSDEEP
384:y8enkBVDIKxwbpBStxYUQHSH7l+ix/J/b6GvPpSy+tNywUTZEC:inkbccJb6UAUqC
Malware Config
Extracted
phorphiex
http://185.215.113.66/
http://45.93.20.18/
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9
AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z
LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT
MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
0xCa90599132C4D88907Bd8E046540284aa468a035
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3ESHude8zUHksQg1h6hHmzY79BS36L91Yn
CSLKveRL2zqkbV2TqiFVuW6twtpqgFajoUZLAJQTTQk2
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2
bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr
-
mutex
k9ubbn6sdfs
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Extracted
phorphiex
http://185.215.113.66
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
Phorphiex family
-
Phorphiex payload 1 IoCs
-
Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
-
UAC bypass 3 TTPs 2 IoCs
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
XMRig Miner payload 19 IoCs
-
Blocklisted process makes network request 4 IoCs
-
Blocks application from running via registry modification 14 IoCs
Adds application to list of disallowed applications.
-
Creates new service(s) 2 TTPs
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Disables RegEdit via registry modification 2 IoCs
-
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 5 IoCs
-
Stops running service(s) 4 TTPs
-
Checks computer location settings 2 TTPs 38 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Indicator Removal: Clear Persistence 1 TTPs 1 IoCs
remove IFEO.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 2 IoCs
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 39 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies registry class 3 IoCs
-
Opens file in notepad (likely ransom note) 7 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 19 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8642cb9e190179e87f01d91201b35264b9d29ce6b3233d1bd9349bcdd94e5d28.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\8642cb9e190179e87f01d91201b35264b9d29ce6b3233d1bd9349bcdd94e5d28.vbs" /elevated2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Blocklisted process makes network request
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Indicator Removal: Clear Persistence
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Program Files\Bitdefender\Bitdefender 2025\bdnserv.exe" -disable3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2025\avp.com" disable3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\READMEPLEASE.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\System32\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\SysWOW64\msvcr80.dll.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\calc.execalc4⤵
- Modifies registry class
-
-
C:\Windows\system32\cmd.execmd4⤵
-
-
C:\Windows\system32\calc.execalc4⤵
- Modifies registry class
-
-
C:\Windows\system32\cmd.execmd4⤵
-
-
C:\Windows\system32\calc.execalc4⤵
- Modifies registry class
-
-
C:\Windows\system32\cmd.execmd4⤵
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs8⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs9⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs10⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs11⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs12⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs13⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs14⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs15⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs16⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs17⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs18⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs19⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs20⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs21⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs22⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs23⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs24⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs25⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs26⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs27⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs28⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs29⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs30⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs31⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs32⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs33⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs34⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs35⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs36⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs37⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs38⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs39⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs40⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs41⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs42⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs43⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs44⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs45⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs46⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs47⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs48⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs49⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs50⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs51⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs52⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs53⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs54⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs55⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs56⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs57⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs58⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs59⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs60⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs61⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs62⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs63⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs64⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs65⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs66⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs67⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs68⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs69⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs70⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs71⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs72⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs73⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs74⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs75⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs76⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs77⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs78⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs79⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs80⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs81⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs82⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs83⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs84⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs85⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs86⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs87⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs88⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs89⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs90⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs91⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs92⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs93⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs94⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs95⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs96⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs97⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs98⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs99⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs100⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs101⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs102⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs103⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs104⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs105⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs106⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs107⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs108⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs109⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs110⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs111⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs112⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs113⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs114⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs115⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs116⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs117⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs118⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0030⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k30⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0028⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k28⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0027⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k27⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0025⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k25⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0024⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k24⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0023⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k23⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0022⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k22⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0021⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k21⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0020⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k20⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0019⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k19⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0018⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k18⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0017⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k17⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0016⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k16⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0015⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k15⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0014⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0013⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV114⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k13⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0012⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k12⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x360,0x7ffb636bf208,0x7ffb636bf214,0x7ffb636bf22013⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=52261162778816 --process=256 /prefetch:7 --thread=1626014⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1888,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:313⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2260,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:213⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2336,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:813⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3432,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3452,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4188,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4508,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4664,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5388,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5452,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5720,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5752,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5912,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6004,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6204,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6304,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6500,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6736,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6712,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=7024,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=7156,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=7304,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=7196,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=7484,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=7464,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=7896,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=8028,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=8036 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=8160,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=8168 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=8308,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=8316 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8772,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=8800 /prefetch:813⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8468,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=8820 /prefetch:813⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8748,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=9172 /prefetch:813⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=9612,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=9640 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=5432,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=9784 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=9940,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=9808 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --field-trial-handle=5200,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=10120 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=10260,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=10272 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --field-trial-handle=5416,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=10428 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=10512,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=10536 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=3540,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=10700,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=10656 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=10956,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=10976 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=11076,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=11124 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --field-trial-handle=4672,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=9456 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --field-trial-handle=11400,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=11424 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=11544,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=9444 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --field-trial-handle=11528,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=11744 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --field-trial-handle=11760,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=11872 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --field-trial-handle=6716,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=9500 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --field-trial-handle=12124,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=9504 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --field-trial-handle=12280,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=12312 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --field-trial-handle=6600,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=12464 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --field-trial-handle=12628,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=12636 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --field-trial-handle=12796,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=12816 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --field-trial-handle=12768,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=12460 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --field-trial-handle=5900,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --field-trial-handle=5736,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --field-trial-handle=3576,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3680,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=8188 /prefetch:813⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5592,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:813⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --field-trial-handle=5240,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6640,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=9464 /prefetch:813⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6652,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:813⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7500,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:813⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4060,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=11104 /prefetch:213⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1944,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=10560 /prefetch:813⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1944,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=10560 /prefetch:813⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10588,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=8720 /prefetch:813⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=11216,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:213⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=11784,i,3455579187687175240,978863306624998557,262144 --variations-seed-version --mojo-platform-channel-handle=11900 /prefetch:813⤵
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs12⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs13⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs14⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs15⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs16⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs17⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs18⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs19⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs20⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs21⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs22⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs23⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs24⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs25⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs26⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs27⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs28⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs29⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs30⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs31⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs32⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs33⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs34⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs35⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs36⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs37⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs38⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs39⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs40⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs41⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs42⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs43⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs44⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs45⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs46⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs47⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs48⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs49⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs50⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs51⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs52⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs53⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs54⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs55⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs56⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs57⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs58⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs59⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs60⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs61⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs62⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs63⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs64⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs65⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs66⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs67⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs68⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs69⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs70⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs71⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs72⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs73⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs74⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs75⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs76⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs77⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs78⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs79⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs80⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs81⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs82⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs83⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs84⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs85⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs86⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs87⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs88⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs89⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0011⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k11⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:0010⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k10⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:009⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k9⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:008⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k8⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:007⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:006⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k6⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:005⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c time 00:004⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k4⤵
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\advapi32_ext.vbs3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM powershell.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM taskmgr.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM cmd.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM regedit.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM control.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM gp.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM msconfig.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM MsMpEng.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM avp.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM AvastSvc.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM avgsvc.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM avc.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM NortonSecurity.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM Protegent.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM pavsrvx.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM mbam.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM avguard.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM mcshield.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM powershell.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM taskmgr.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM cmd.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM regedit.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM control.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM gp.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM msconfig.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM MsMpEng.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM avp.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM AvastSvc.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM avgsvc.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM avc.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM NortonSecurity.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM Protegent.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM pavsrvx.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM mbam.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM avguard.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM mcshield.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM powershell.exe /F4⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM taskmgr.exe /F4⤵
- Kills process with taskkill
-
-
-
C:\Windows\pei.exe"C:\Windows\pei.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\870929817.exeC:\Users\Admin\AppData\Local\Temp\870929817.exe4⤵
-
C:\Windows\sysldrvcs.exeC:\Windows\sysldrvcs.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\2707930869.exeC:\Users\Admin\AppData\Local\Temp\2707930869.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\2978015654.exeC:\Users\Admin\AppData\Local\Temp\2978015654.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\255398142.exeC:\Users\Admin\AppData\Local\Temp\255398142.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2924432225.exeC:\Users\Admin\AppData\Local\Temp\2924432225.exe7⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "MgrDrvSvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "MgrDrvSvc" binpath= "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe" start= "auto"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "MgrDrvSvc"8⤵
- Launches sc.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2538922900.exeC:\Users\Admin\AppData\Local\Temp\2538922900.exe6⤵
-
-
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM explorer.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\AddMount.temp.lcryx3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\AddPublish.dib.lcryx3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\ConvertMeasure.exe.lcryx3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\ExportRequest.rle.lcryx3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\ExportWatch.tif.lcryx3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\FindSearch.xht.lcryx3⤵
- Opens file in notepad (likely ransom note)
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 516 -p 10980 -ip 109801⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x470 0x2cc1⤵
-
C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exeC:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe1⤵
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"3⤵
-
C:\Windows\system32\dwm.exedwm.exe4⤵
-
-
-
C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"3⤵
-
C:\Windows\system32\dwm.exedwm.exe4⤵
-
-
-
C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"3⤵
-
C:\Windows\system32\dwm.exedwm.exe4⤵
-
-
-
C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"3⤵
-
C:\Windows\system32\dwm.exedwm.exe4⤵
-
-
-
-
C:\Windows\system32\dwm.exedwm.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
2Disable or Modify Tools
1Indicator Removal
4Clear Persistence
1File Deletion
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5024dd77c38676e6ce0a5a2201f6145de
SHA15d020adf1adb0b0c0b370df63b2b09d89df0acfb
SHA256b4553ff5d7ae98614d4856de134f49e503f046a15fc49033af3232fbeab9ed4c
SHA512a94312eaea187830c28680164d80e3e9c2f58a7b24930dc224ac52a308406ccfd56524dffaf5c3a37e6b713d1d711f1b44d99d1fb60669c8b2351bb4c9d2fc85
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
280B
MD57b0736a36bad51260e5db322736df2e9
SHA130af14ed09d3f769230d67f51e0adb955833673e
SHA2560d2adfd06d505b9020c292d30597083d808bfd90ddc0fe173def5db96832a087
SHA512caabdc6a8601b93f3c082e6506b3c9efe2242b90e92e86306dc0bd4857d33343ba395325fabb21f5db562d3e3932f52f77de547f379072d0154efd5f1b1cdeb3
-
Filesize
280B
MD54d6bcf3bc7ced058556e8d8ac21cee5e
SHA1581f3a3d89f3fabfcf92664d96a486350138fd6c
SHA2560112b23421ba0221cdb54a42a0bd794bdce9cac720905d7d4153544cbe5694a0
SHA512a6c75d6a0f3027b042aca14e109264f5b3754731eaf7fe596b9fb50b2b061b602d0a46bd0d181b13b694e8c50baac63774f1ed1208421ce05481b785655beb7e
-
Filesize
33B
MD5f27314dd366903bbc6141eae524b0fde
SHA14714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA25668c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
SHA51207a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
-
Filesize
51KB
MD532aaa2c79e0b335130cfb804de2d071e
SHA1fc4a04bcbdd9938aec1d53df488999d7cb8829fa
SHA256f6fb6cfd2637df7e21c4505ebdb9bc988ba9b2c9408c78bbc90d8856a916217f
SHA512c4ec33f7f1a9da6bf825aa3dc71bba3757b0e24ca0836987a22f2377f90a578c4445873e12989ccee6fe051dc455e255253edca96e1405fcde3c9ff7fba30af0
-
Filesize
247KB
MD540e9811a8168875f77a707d6da71e710
SHA12569cd0466c78adbb50a84afe72ae01ad02c973b
SHA2566706201df31ba0673e0127f2af04b452bf025fe2a97574ea187031e98b3970f6
SHA5124106c497171570a999f69ce807c9dc75fa5ca5d2fff67a4f82fc4c6531c4591e39330bd761c03249967056507249605991c7793e519c8d39a1bd2fd5d68ffca2
-
Filesize
27KB
MD5a7790dd7aa3e838bdf2ece99f2f109c2
SHA142d672f8f81142dcece7dc412c87a524109d4f80
SHA256aff832b0effa85b2a36d7cc841e223a96970a2645d1b4a7d52f95d941fc9ffd2
SHA51285b0f98f183701edb036e4110aa259fa7454a05e6e58b7841e9733c8511cf294d40858c3b956e83f38ad07542b4d0190a74cdc95e67957c28964dc793a4999a5
-
Filesize
309B
MD5426f6f0e1184c0d042819ad539a37c4a
SHA1d3890e5291fe29e5d6faef9af46db5da7d6a968a
SHA256e49ec481550d7c807ff30eafa7c8ce7605a7e2a292605a6e5af0d01cc6007376
SHA512cdf352ae52a3b87c7ffd6088fcfd9e3aa45161711528f7d18b0cc2ff3e1ae889eca257beb79d354a4b4b8b408f0bf655c6b1c342a1cf9064f82ea4203c439bb7
-
Filesize
349B
MD562fce56a947d01c6b7e6762fd975fb57
SHA1ed5b147ca2874676b7023593153287e163447266
SHA256233d32fc527411708384d1deaffb2daf0c06d743d995addfe2a35e45d1af8fe5
SHA512f3f561b8414a6b37ef7d8228fc08e6558e3f4f3f9bc02a98e4c6ec3b5fdd382052ca0ae7d8b93e9d870d29fa5be1c2ac3fff530a951fbb788a98d4e7d60c8120
-
Filesize
310B
MD5a7d9891ecf006ee67cef1e594b027407
SHA1dbaa7ff5d5ea8d931b53b9f159601f5ad8318153
SHA25697fedcaa760131d860eb860ccc62f6f5e28c66c269ebdbbe23bb117b39cd38a9
SHA512898008869749c3599754b0fb26797a2dbab1224e07987279e7c104736c3da7e81fed6b77e6be0c429168cd448114c829b17e62ef420025f5d538b39d18b3f244
-
Filesize
322B
MD5f39bcaaf8e96a0fb2d5306c7cb8a1d5a
SHA1bc1cb6fb8d7845c85c0ba2a277b7e165db0dab2f
SHA25658622b5bd1de50a422271ec1afe11e6f8f26b93a6b83499fec3733885e81c3df
SHA512a0ce8d4e091acbabaaf31a2b378f4a84dc80bc392f7b53416b57a1fb45801caf442555bc995c5de13a33078bdbc8f75eb4a617c475d9a75c4eb97beee8e2aa54
-
Filesize
45KB
MD572de452b593526cac31c8aacb4cb1821
SHA1381510ce99eeb862263fbea92eba3355b40c0051
SHA256dbc5b405efdb6eb325349810c307c570a5118359e6ed99b4afcb54973240878a
SHA512c3e2bfcdd0b4c21ed42b3db0b92bb729e0658e9784dc3e1dd1e52d0b7d499f02a6614b66c9b7cb999a5ec3c688e6e26e1bf306a11645125aac4b5c419fa6881f
-
Filesize
11KB
MD59eb061742c5b2dceac20311b5b50206d
SHA1dcd43cbc9647d30beb12090892e20a17314f21df
SHA256b7e60ea8a5a4bdbd3286f9101fc18425e391a6c6fe95fca31395bc97ace5c903
SHA5124a0a5cc905f63226fcc788aaca40bb12d4653b4b2b3040b367db966411fe5f9d43afa0616195083ef7112460ed5490f4193b2d1fbc368f344a73c20e653d6ffd
-
Filesize
15KB
MD5323435d1c72bb94c0800da6152195221
SHA17c53ef1190e01d1b1f565aec1453ab9f8db898a9
SHA256e5fe64a390b43c326a5af2e3c066f0bfb85272473fb391ff909de7702f477ec8
SHA512ec1d7345d3d11e140296cdf170dd4ade6a24bafe4c02c8da033249f5e7ba4a7bf73c93f33667366b073ad36b0f97dc28f37b9fb0ee976ddd2643206ad9eb35a3
-
Filesize
3KB
MD5bf104fbe4876e5cf0b04fbfba3d45231
SHA11ea0610e37809b96d6a5659c30f43b272a6f22a4
SHA256dfd247193456275148dfab8681c8792db601153acc640e1ecc7122ef60df57c0
SHA5127703cd6131f358802a100172e40b20483d140f7325f2409aeeb4f1ec8e3c44c70b1ce422ca2a47dbcc209d100b9f542d7c7ebb57a2f217576169e191f45e2a62
-
Filesize
3KB
MD5ae7c9dc780036aaf4a2022fdc7c94539
SHA12bbdf1b5c3ca699ff3558e766e0beb74f7160943
SHA2569c9efb109f39172b9ea41368ca51fbc8e6dba9297580b28255dde8214f1d4a41
SHA512bfb85390b585dae338c2c796a86a3c3e0422155923a08e9d34c4276b9cb3c120d4e14b0bc1fff4ad0ef2436c1b68ba9893ffc17df37b85e8b24d05b5530f8a06
-
Filesize
264KB
MD50f130909f6c964bbaff8e90747f482c1
SHA1beffe137e5cc1f2a44494e1a3e9481a5682bc890
SHA256e6257647e4e7d9d359fdb9d947b466135f8afb1eecf7e33b673fc43238a7e331
SHA51260fee87fa95b3829732f2fe8b20a71eea5c3907504261910221eed29bf44de66e105e42c4160b0c969d26cabba0312e4f9dadf11e66c947f079b07ea43645ea0
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
16KB
MD593d3254531b4e1c1ebabc9e710f604b8
SHA1aabb34de3c827293a79981468ebda33ed33402ad
SHA256a58201dc84090be45cc793e741c2b4c8df4040d8309a5fd904f889118295cb44
SHA51293adcb569c2e63e8945d616fa2864ff4899fb9fd361963da4c092f5689327f5e62df47a0b9aa6eca693aab19aef4c3d580700577505941b722fd09ef957b3750
-
Filesize
18KB
MD580b2771c110acaaeb19f7c92bed6931f
SHA195f4c2e207e65b4cd8aa89de097730ae5a6c819b
SHA256e56c5b5ff6a8f88337f162ebd2d07dd422244c31e097fda517df9b7fcf582a53
SHA51246709076fcb7d676594cd1b87944344068cbcca0b6df45fbe922dfb13c6e5faec989602ab7c60e5e3460f7b28023565f96ed4201b2ef3a568bd1f528321ea336
-
Filesize
18KB
MD5b1529157caeb61ce6d3f18f6bfa3216f
SHA117095fdc4d81cddad6daf40c8d29d79174e66519
SHA256b843c490c7b628ad47375ddb5bc52d0a9efccf404037d1ac4c1ab7f44d6fa9d5
SHA5121990dc2e44c06eaa09489c402811743ddd763e241ae570865624d919607117a4fa032071e719cfc7de1887fab2d01d932003b3409b8f67726c2bd0041307c502
-
Filesize
36KB
MD5c0a25b4f6f89614ed196ed6e832f0d2a
SHA1e1e5e6db69950c821ba0db3a0239f3405efb5d05
SHA2566d62673c61e14928d138e6fd292c47ab2a70d085ed41e6eb1d9f1a61c4912fb4
SHA51249e2a4d8e3e29d020ca7b4e50c860b21c2ea426f400ffdf7e070a3afc4de915b6dc94837c80b8e5ad62d0f498a64734f6004fb93070bc066d6881adf5c7e8989
-
Filesize
2KB
MD5aed0b590f69af51a39fec1f06710964c
SHA187945b7da45a10b538cee984241a39690c78d34e
SHA256ddb6c7dc1dce768e81d58cc5f1bf78edbc85d4c792b1134ff6fdd6f07252c8dd
SHA512cc58d384109ac75c6392b458f88e2c3f1d6206e69450a612e5cdd99206272d97e286d490a9b343fdbcb256e2b1a464ec876f6199e2a127e0db8f49ad7a9a4800
-
Filesize
48B
MD57697f585f33c0588f19f4de8c1407da3
SHA15cc7941b19a8b8175e70afc00ab4a4fea6b82763
SHA256da7b563c34712554f4583f08eb99722b48caeb43cc0b8e89ec5303a2fa11bb18
SHA512f13a8bb1014e756d0ca04f8fc780db538f172e1a7d93438b2b3e1b877fae6c5d835b34fdaaef6ba088f4a2e44746e1ba1f94cfcabcd116a296843e3481a9abac
-
Filesize
193B
MD56ac68235c31a3c7eb28134327ec73028
SHA1e61e9c6999b091f2701deea654afe9baa0c84459
SHA256342544771c019efe18a8e0097c722cda12bad4ff7738f174190e171cc2749da6
SHA51210ecb3e4eac5a977fb39e05104f85a18a2dde4aea1c66c933b00c9c8deb6491c5d816be70a3483c8cfc563a37579ebc95627d66fbbad3371f8038be5d747706e
-
Filesize
176B
MD544e9bc331da0f09ecdf2b60755e8466d
SHA1c052b2155067773124d277666d1184538e9a688e
SHA256de05c46a0f2d973064444f5f185f6a6f294660033a5e1f44d9d991e1f69b20db
SHA51286f4b31e4c6317a45bd5ad4e9a16a1035749dd85b5fdda32f5b90374e7fb184a0648bf81231b50adf660aee3f448deae00ddc658b7bcb80d6931d8833105f6e0
-
Filesize
112B
MD5da8ccdf651511787071a80776bbb7c9b
SHA1508c1e5ae67de35ad2b4ecf40d165ed04e813295
SHA256ff99bd922a6543751062a4f043b120bd2f1a47c9afa0d511b627edddb9885b37
SHA512906f2d9346ae1f788960ee618d8ca30f377b4a70147354586f5a910ab131c292bfd63fef790e3a379d3c6148b338f371cc6fc7218c43228d37ac868ea3184c66
-
Filesize
198B
MD5e77f7c58fc9a169ebc9f3bd6a800c40e
SHA153cf0268a92720baaf951a12eb500ee391b433a8
SHA2563e79c9114e11c09e18586ce2d240948b8cbb7403042af9e28e1a3c4c12720369
SHA512cdcfd742484801506749e6c0ae0c24ed217a8d6bd3bc5bb911b4977a4159f99d7473e1241151aa5400d62ea8be7ced7f354e7a9ff0ba4856b524b2ab13d425f5
-
Filesize
119B
MD5d53b6a559cb23824cd8c6617309129f2
SHA1bbd6779ee37b831e55d245f514cd9f7044b2055e
SHA256b6ab62ca637a32e5fb1d4beb3e2e539d1dc19d97197a2b49b67b9868f68a4c82
SHA5125815dacfb8d7a5bf3c78b199e9b054cc05c2d34135c83e5ad77eff9b4156277614126cac88ee821bf993e6fcce97897e3d82798ba257493a905f464a3a58e541
-
Filesize
72B
MD59b695cf4f2fd53a465503a1d3e0c11d4
SHA11d597a5046d5e851958fa232ce3de8f5de493b03
SHA2560ddaf86874b82fc6844ce2fa1cc81537625ef892207b425bac97ef9f47ad6dc3
SHA51233ec347af524ba072f18c97add493cca7443fd7ea9df1a17f6a1c702c9fd69e9a557955ff6706391270e279c55790123f482ed1013662ca0cda16aac118d90c7
-
Filesize
48B
MD5f223477896b4ca3696ee3fbdd0f8e658
SHA1da76f771ab301781bfe388e6e8b301dddb0fd4c8
SHA2561434081083d13d4dfb85a12364ac24f283df5edc50ede30e5fc4e1c8466a3f94
SHA5126e1537b320faa645fd2ebb820b988deb9084a165df6c6c90c23557e3ce187c50ebffd69ba8532edd148b8895c27e92e68c403a5df4af7ff81942ad942fbc6ce9
-
Filesize
22KB
MD57b8f4c119e107b4e81825b8d890d7b46
SHA1904f7f6455a2cd63fb2f4895cdb56ad3290b1fe6
SHA256126bf4b16ba3b9a21b14e2e4524f67b55dd88b91e15db31533ae8aef7954ba2b
SHA512621664b27ef0366acda3f651db706ce20ef2955ba3fea2ea4fd4dca1975059ed19e5c52925f429b4cd097be78cf4d23bdfe9967dddfb210a37456af651b4c03e
-
Filesize
431B
MD5c70f8f298f894d49cbd3961e727d48c3
SHA1f7ae91207e2459b547e514c8036a257a11ff8eed
SHA256ec05a8458a15d171a9027c6bfc69f3baf24adb78473f5d644674528e6bfb5dd7
SHA51231665c407efcf9c9ff56e0d6fed61b55de2da15fd60af178a7ed41f0af34e2461ab0333d9235d1e087f589bd36a2687e5eb10ef3554d141081fd5b58e7466d94
-
Filesize
17KB
MD5a51993dbdd69b7722fee89ea0dad2a62
SHA1e01f0e0b8bae07d464cac3e25c5a7cd447e611df
SHA256da44091ff65e4314a5975001e3043f9940070406da9214370b1b34129fd48ebc
SHA51218ed716004d2e91f31020ada65ca7d519c36bfb6c3fc849d970df7d130834583e7866988d6f86f098d24c7d1a70d46979285e9a586952c47bc822c7a007d8aa1
-
Filesize
16KB
MD57be1fc8b911462b5fe38a30407e140f8
SHA14f530a02b4326732500256ed9d92669c92ad091b
SHA2562b0b0f156f848407c9035f4e723d1ad8019f65ae5c2acf1da1e3391d57f4cffa
SHA5126807b97459a2c530577a536dc34716118e64b57292c954337fbd19fe32aa28761465a9a908fd7dead028fcf9f253a422671000f01186ee2c16f43e9f366f0950
-
Filesize
18KB
MD567573153bb60dffcc06abeb69b819253
SHA10b369787488c3cd7be5eb7ca6eed6ce27acf8130
SHA2563c6c58e766b3c9e7465d54414222686966ed36d9c8d694b4b66b90ac0ba5d44a
SHA512b6ed3fde65d6077771d5f8165416a8aec10f29b5827b4760fbcb9c970a6ee1eebb1ccda34b09482d5cd3cc586e21b096ec78d738564282ae5ad50abcaf4d2011
-
Filesize
18KB
MD5c3ee04ad31b5ab891b5cd25875459948
SHA1a927035e1ee221d7eec394d72e120f8eb5767b70
SHA256b60e6fd24f06f513fc1fb972a9cd9ac83e919a0f9db6ce03bbd8c36509013b3b
SHA512ca2fca647b7d23c4dd87afcf7e3f0b7c5b9318217a04031d9617952d6c6ac64015239655d5a25d0bd2e4ea29f7cd9845d0a02f27e72f8781585f084e530fe7c2
-
Filesize
24KB
MD5a08b789f32d34c67378219a80e9f1c17
SHA12309d639c19a6d4885200252dcd7717a73d3e05b
SHA25691c98e27319199f208d2efeffc528956627711c1dfdf70fc429e33abb7e3f3c8
SHA512a21bc51c4bc0311899c9a82abd36387971ec2d1e5ab22c6f85cc791958cfb234b2856905e0a7fb20beaba6f0a4bde947c9899fb65f297a906203aac70041da7f
-
Filesize
16KB
MD5c0d3a64f2c423b4781abc7b6683a8513
SHA109d1762a3a780e36df3d805eee874fe98caf3260
SHA25651e850225922059478e9bacce46b537e2f58b290390a43da97b258fb51e2f484
SHA512ef5e734c2e73979e3f6ef1cea9646e4b8e9f30e48d198d472489322c66eb6d6f1df4455bd10d331dd9ce7326008490cf49f7373752e2b9376492556d7feec7a1
-
Filesize
16KB
MD52bb61d56bb643d000104941a4be422d5
SHA116e23e89534ad1cb7be24c4550a180ac70b3a21f
SHA2562db298210387eb970486b0a39d3e66a64aa9bc47e594f1105fe0d4ebf4433f80
SHA51293f416d4f4240ef6a4bd6f9ddc5f45b9454c45031c33c45565eae8678cae0aa32f49e0eda0d7830e62b199c0112da981addc60207c4e26040c1ae2049271fdce
-
Filesize
25KB
MD5e34b6616483190faa033d4f241c86a81
SHA11c9a2e3dd9228ff8bad266cf4dab3ce675cb4c2b
SHA256d6edbdd4d0a17d8ab6f395b717f6f55521b67137d2d12ccec09469753d044267
SHA5124b32d1a7f2ee5170f8589800e7d468b56ce4dba6e19be774f112856569bd0a039d1f2effd6dda93d041682bffd47e8531833bb6585b1de59bc739b165b8c4ea8
-
Filesize
18KB
MD5de35e833142ad87165fa2fbc5f1ec4e4
SHA14bb3170e2ab8c39d60c553797f7bba3eefe5eccb
SHA256a8d557ff047ba5ba8f89db9a4b709cd4428cb6b472735cb50fa7c2bc9a205096
SHA512eec2f2fcbaf6688eaf6eb67bce473987a75d981086491a27dea488ab32624684971917981eb515010bcf629ed9ee3410cf413aa8c4f00b101342648def44cd9b
-
Filesize
25KB
MD52592c1af3ee064cf9f11950bd08a22f7
SHA1c20ed5e6042a642dff23b8bab0bf6cfca007fbee
SHA256722106adbbd961cf2e433d5a321567f150a3dd3b86d5c6ed549d961ca270aec5
SHA5121f7229616c2fb1d87e7b608d515c8e3f77f599fc1a0428d0b256413957c1bb5bff921d72cf79ffa1c0ab39b6c8f8e01dbd140240dfab5f2cb0ae2389acfd5f0e
-
Filesize
20KB
MD511e9e912dfb77a66838c5d4219372c43
SHA133b437c4aafa14421e0932b5c80296178eba032a
SHA2562da62693eee9d057ee0c0dd5d6261cca313de7ffbf10021fa48aee4a9826591a
SHA512336cef674bda1f6aca0a7307750168b452b207941aa89a3629023415ad7a6add55040dab6ff251cee12c4385a8bf624bec27c1d2f8bfec6a2f180bb5617d3a8b
-
Filesize
18KB
MD58b53e07dd15fe91eb1d3cd517b0b9210
SHA1385a0964c5006596e14c754fa02a48b0d4cbc905
SHA2563ac221580b97a2f7108d733586114c47fa556cea2f0ddcc1318235358c0ff035
SHA51269a9adbe6b670ec9de120936d54a40ac09b48b839b3a1dbc3b683912c50950a663b9bf672d8eb084801e10dd4114fdd6c2d8a0321e594b355eb7310d4aef73ce
-
Filesize
49KB
MD540f2f61e9db2f62e96a4b07c2041ef56
SHA10dc784fdfe82e536161ba35d8d36105cf48c8f22
SHA25619ef17de71ebfe22d7683716f20e999b2287a319269c3cb9ce35aa617897d38f
SHA512d9f6edbb656e5f13f6d80d154edb5e478b2849f600becee0e684c6eb1c7bceed528bed54278803951d9a4f9e122767321480d640b66032e23df7d0682486c870
-
Filesize
40KB
MD5b25ad570b4d338133d3bba776a0a5e91
SHA12a82ac354ea92e20be0a8341ceb6736ae5dce42d
SHA256959504e4acb1e0996b0d13ab9351b17dbc1b732ba6d83afaadc9ec9aebf7461f
SHA5125c10288aee5a3cf2e9c864ff75e1b6abc5b338333d4a4611a892e6c84886627f3ce2bd6d67c1bde6820858f5b61598fe76e2877886eccdd5d5340fb52179f7bc
-
Filesize
40KB
MD587507d53249ab27c6261a8665d1505a8
SHA12ef38a6470897a26b2ca9a575a86fd6c1006d77d
SHA256539f8e5c1a0d0c2826d94ee1b22b4a8c2a6d04edb17fd7e4f0a4d2803966ba2c
SHA5126872a9fa52dfe2f1874244feacdfa6b50948463e283e3c4678beabf1eedd252014bddb904f07f1ec0ef91d8a6b4428cb31e16f1bc4fbda5ba8653db4c6c5ec85
-
Filesize
40KB
MD57955ba1c4c3c0b65b68ae96f6d6dc1ed
SHA1e45673af6233e7d22332eb16c3dc9f33917cc311
SHA2563d422a7f1d9c0f0ac1136fd4a86be1f76c1b91e04a9e4929a45aa894e9dd414d
SHA51293a7aca7df6d4e737b94d7d922007fc9ad006cf62dedac36d59840711d9393900cf73e7448c6393cebb737c2b28c351a653ed023cb2b642aad940ccf24cea83e
-
Filesize
40KB
MD5281afdac49f843d3fb0ce84092859b7a
SHA199912eaf201a37ec5d1069f68b9e06fae2fc07fd
SHA2562eee6d9795616b05ff7800dbc7715df642a230d98a4f3741ccbb94c4d69e02c2
SHA512b622a7751a7a9e5107ff09d22dbfd7a2269831dae39718ec0f114aac29c17e3d1f4b383fe895ea12b62c05e81c7184c37af32e86728c2ed5bf6d6bef70d1da3f
-
Filesize
2KB
MD5311ef3c00a95dcc55371b387e9704432
SHA13ef41c84f32420adcca27491bed4af6426a4fb77
SHA25616f19471fcf0dd6c7db20530bdb746a80aa6bbfac75835d5e56edb781105edb5
SHA5126bae9071fd333c9c0d2e6701c63edfa0d91737b25ecdc5c0fdc2f8caba5af4eaf7cb792924b7a7c2b1fb68ab6eb898ab028bf4d6d85c158646e8e92e8cb148e8
-
Filesize
13KB
MD5181921fd5d4f7e043b446392233698ee
SHA10f710714ea4c01446dcb2ea4f29256fd53633f5c
SHA256aed4ab578ba8613117a2132bee215cdc3b360a1d9f993ad937ed3eecd7e9f3e6
SHA512a04699fa408ceb79f89cf61f2bea6ab85b6d93b52989f7d5ba6bdb22964fe8bc2a19aa3e1a02b063b11f8a63f3d3582ba0a621b97d911c27e2010fe9df5c6172
-
Filesize
53KB
MD560686a27b79838583920c9a0954104c9
SHA10c253b3c72cd5b01a9403230ff3ec9d3cdd8b71c
SHA256270149da5feb9487799083b5e76d41d3aa69afaf8f731e72e7d64c3a7c070c7e
SHA512c0a9308b5a3baca0906c9663ca3e3eaf64fc131aaa5358557874b30e4b743ffe898da6fbace032c3481693bf9081f938127fd07c8d550d9eb74958b20e24ab04
-
Filesize
101KB
MD58a30adfbb8c9ed8170177ce8c5738fbf
SHA12d029ddd39fe81a08982dd4309a74045aa91004f
SHA25672b19310a8c3cdfc23be1041eb773e6e41a08ec608e53b027b32e05a275b1da9
SHA5128885308b53b8d1baab14a98ec257acac9c700f2cebe48cbb79a25e3d7133f0016ba082ec9f8397c9b1677375dd5a1d3894d813aba5947f267b44b012fa6a027f
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
265B
MD5e88249b855fa0eed74d36842922b66ca
SHA190c4bee3131270f88d3a9a40465a76d4108283dc
SHA256c10d2b501bcf4f50ddcc134b3bca17076610cf15da53cf73959c43824f0e09dc
SHA51297c84807ef34b9eb96304d29b072f636faf8538f236414bf8ca0ac979635f6236dc36998fdbc5237898dd3c2864a08c6bf687805c1dbf4398499f2ce9647a1d3
-
Filesize
57KB
MD56dc81abf7f130e6665c05c4f3c1d609e
SHA14a08bf2c3f04940ccfcb82c89321a325182696f7
SHA256978792b9e9213df6367ada740619ccceec1b2b0cc785dab8bd08f526b29c3018
SHA512a18ea1cb9ef79fd1069facb0363cfe1c48a8001dffb449574524c005815303a4db09f1dfc11a4292b658a88cb208aa52cc15ef9d4a239aebc190e03a5a385f2c
-
Filesize
137B
MD5d3c8cdc769514ce85192750f1902c2ac
SHA1bebba274b8268a749dc3010700bfd762b57386f0
SHA256e69ca202d729a3a721f87fcbc4510479c59cd2423294a269204466474943725a
SHA51266b63f8af41575ac1b486735efac9155e1dfe37d83e74944ee77b8a5ec3632c3bc0a0aefa1c2fe04ccff439ee09b32ea2176bf815f84c4cc2dc90a4e953e31f0
-
Filesize
1KB
MD5f7f9da3c5b7b83cceaf4caaefaacf294
SHA1a1e8fdec05acbbee9db2f800c71c5d71fd9593d8
SHA256fa5361028ad789b0423c8528a333748e628efc214f74a89840ed678abd068f79
SHA51253ec381354624b46ae12024216e95d6303e697023d9b8e4f69c03a4dc096f6dcdad5253a5b2bdbb813b66150f132ebe9845f722f53e1f82d6bbd7e51a11dae7a
-
Filesize
14KB
MD50c0195c48b6b8582fa6f6373032118da
SHA1d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA25611bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
SHA512ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
-
Filesize
1KB
MD512fab7544912da13a25635c1c2c40044
SHA135ffec9f570c66a5ad2e4c733ffec8c00c546bb4
SHA25682cdaf326f78c9ef5f6b5fd7c1307ca53efb80ea76775097cba45bfad276fa8d
SHA5128820a71932941ea55114e974702eb4459f1019f43471e8abd9b84728c57454b539147f355e825cf99977c3a0369f7531cc2362caf1ca78609fd5f057f2b6e018
-
Filesize
10KB
MD54c52cf849be8954638925c242e0cc976
SHA1949ba0061ea9dbe3b9059bb2a7b20caa74861280
SHA256fa6fcf2e154c0b18b12ab86267ccd38d79cc9c27e7e261a7e9201a0a9dd9d0bb
SHA512c11572dcd274bdcb5e94cf38ec36aa65e4d5605df250ee8887cd5098b044e3e2e71be3b3292118b967e27bc752b5cf5d9c8da5ac2834b7c156302c307abe123b
-
Filesize
1KB
MD52e307117fa5dd587ce5327e77b72547d
SHA13971c0da252fab4946cb581d8e4224ef4a470c03
SHA256aebd2d40c1457ae5508ec489138266baf1d11ebd71d87d65c52d14b488f05904
SHA51270393958cfd4ed35874f326b4c23300e663a7b29f91db7c39cd57ff79107f7800243386c853a7525d05159087114b6ee6cc5ada3895a5584a1b6b98ac0ee1482
-
Filesize
136KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
128KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
