Analysis
- user interaction
yes - max time kernel
543s - max time network
546s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
29/06/2026, 16:04
General
- Target sample.html
- Size 271KB
- Sample260629-th8btsaz3n
- SHA256 7cbc746fb6f0ade281e7d540101c29a54d5135e0160921a442b1c3bc019b46db
Score
7/10
Malware Config
Signatures
- Disables service(s) 3 TTPs
- Loads dropped DLL 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Probable phishing domain 1 TTPs 1 IoCs
- Drops file in Windows directory 64 IoCs
- Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 21 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Modifies data under HKEY_USERS 9 IoCs
- Modifies registry class 9 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 6 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 21 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c4,0x7ffd3d05c188,0x7ffd3d05c194,0x7ffd3d05c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,4005693552304722088,15268808970897568292,262144 --field-trial-handle=2316,i,13910360952734962342,15423801449466707925,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,7102412993726156146,2365585988256297683,524288 --field-trial-handle=2316,i,13910360952734962342,15423801449466707925,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,13962056663497224596,3227017167904704987,524288 --field-trial-handle=2316,i,13910360952734962342,15423801449466707925,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3656,i,9493870313513460387,12656522949463063301,2097152 --field-trial-handle=2316,i,13910360952734962342,15423801449466707925,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3680,i,2226803491649089385,5229400497096851309,2097152 --field-trial-handle=2316,i,13910360952734962342,15423801449466707925,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffd3d05c188,0x7ffd3d05c194,0x7ffd3d05c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2088,i,3656678000485208096,11547306232488502702,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,1124280387611986323,9583916179961912202,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,3361673062674321391,3490363996706872289,262144 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,12962982241773203379,16649424778724120931,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,12962982241773203379,16649424778724120931,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,12425602129825708470,15942629113697205353,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,5453246227905714155,4560485824584932885,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,17465762219386090961,5172688368524643069,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,1732654952883009880,5433800863761007520,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,5815192082458361288,5075807526577850531,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,4189688616182855124,11555059788200123448,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,2187333900546040690,748023367080087088,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1260,i,15745390304464319630,87573258485451876,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1264,i,17111609665942612896,14181670913225198855,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,2949156548093746592,1886945370694794156,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,4198857097589041020,11961376516563463473,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=828,i,10257301080485004294,13166840503586856725,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1356,i,7076440594079947795,14143613177065278184,262144 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:102⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,2602636650543485965,12298206967560090656,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4720,i,3403222457510588001,16174250902374214616,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4720,i,18183768040467363216,11140639227757649119,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,6155025407378584238,12703649486101148658,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,13545755118250177086,15233605517177120233,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,8454057996336664890,15822755512337939407,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,14771172605775368772,14932731890887215150,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,4903254406718905529,218103814815490498,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,14296292512211842555,6590071473963663923,524288 --field-trial-handle=2568,i,5359266633339116673,17148816562178579274,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:142⤵
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\msconfig.exe"C:\Windows\system32\msconfig.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd358ac728,0x7ffd358ac734,0x7ffd358ac7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,989921131753344842,5548759772809974587,262144 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,6388914210609128545,2353660425152867079,524288 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,2318351948516698010,6145249204982440130,524288 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,2486280592954798612,2524377435824650668,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3356,i,11315509969371743624,8722728794779952671,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4684,i,9271066343439535813,10834251074396811605,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,17106938789850575743,1404501778395613908,524288 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5016,i,4370315065048672487,10076212800738249382,524288 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4852,i,9314887994828297461,771437196202392696,524288 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,18431855712072262209,14156975045070611332,524288 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5416,i,7101345974677742528,10185233042879077024,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5468,i,3863319848205870147,11067114641100933438,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5408,i,14617402488932702315,17252454516457558239,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5964,i,10152023626420854452,6197562634123041712,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,2461276803129345401,17464729440119888481,524288 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6332,i,15629764821912309995,16569543379601249747,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,9663402258099522082,336137422136522746,524288 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5600,i,16649045090098842379,3679357065916463103,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6140,i,1002342975974216241,12189463995135871900,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,2433646508319542661,7720401964707403317,524288 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5548,i,4371760316485344555,16980668168348536251,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5632,i,13246648178361245995,16834176640083543404,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5412,i,15669011909920801688,226807182205281176,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5744,i,10103196312998133944,14173489146671833812,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5424,i,10493018977202948177,15129501234375046391,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4696,i,8857778371563005665,6493370501548639001,524288 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,17469714261762059418,6799885217583537181,524288 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5716,i,13175412872854589755,34224803834922875,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,918810543884792660,1811028860271159898,524288 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,2294912794051053308,1883727393802349041,524288 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3696,i,12763076297569962932,17780809542357674608,524288 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=3524,i,4446275231036204171,1969371945641938139,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=3480,i,7500941808512137432,10493085887045212544,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6136,i,4787761522712707101,11565086971398451937,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6080,i,2832088173782933641,7522677929067017505,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6700,i,1020036900726536618,16854508639412799912,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=4772,i,2777252240884399574,5106136890419360084,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5412,i,11954862226919648056,4609279919465013352,262144 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:102⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6612,i,14403732748768578018,2034566988006809217,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6584,i,4173787279450916641,16305516932183392389,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6860,i,4022415250753545601,472275814213093336,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=3680,i,17049124571137101704,11789464117972577872,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=6972,i,15978970625680386177,9730974622648958969,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=2620,i,13863567815838395239,3293050585882773416,524288 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=3728,i,18304212251690921327,14242532342297386140,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=6576,i,6907120623738385767,13592641174422319940,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=3144,i,10042888452157904058,6538728256054574900,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,13147776647343802679,258364760146577731,524288 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=7156,i,2323211576342304849,17306502508850710565,2097152 --field-trial-handle=1840,i,7150972621706222284,13629736978152043270,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Risxn's Process Lowering Pack V4\Risxn's Process Panel V4.bat" "1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Checkpoint-Computer -Description 'Risxn Process Lowering V4' -RestorePointType 'MODIFY_SETTINGS'"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\mode.commode 120,302⤵
-
-
C:\Windows\system32\chcp.comchcp 650012⤵
-
-
C:\Windows\system32\sc.exesc config BTAGService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config bthserv start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\chcp.comchcp 650012⤵
-
-
C:\Windows\system32\sc.exesc config PrintNotify start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config Spooler start= disabled2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Printing\EduPrintProv" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Printing\PrinterCleanupTask" /Disable2⤵
-
-
C:\Windows\system32\chcp.comchcp 650012⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc" /v "Start" /t REG_DWORD /d "4" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\System\CurrentControlSet\Services\BcastDVRUserService" /v "Start" /t REG_DWORD /d "4" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\System\CurrentControlSet\Services\xbgm" /v "Start" /t REG_DWORD /d "4" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "AppCaptureEnabled" /t REG_DWORD /d "0" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "AudioCaptureEnabled" /t REG_DWORD /d "0" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "CursorCaptureEnabled" /t REG_DWORD /d "0" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "MicrophoneCaptureEnabled" /t REG_DWORD /d "0" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\System\GameConfigStore" /v "GameDVR_FSEBehavior" /t REG_DWORD /d "2" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\System\GameConfigStore" /v "GameDVR_HonorUserFSEBehaviorMode" /t REG_DWORD /d "2" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\System\GameConfigStore" /v "GameDVR_Enabled" /t REG_DWORD /d "0" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows\GameDVR" /v "AllowgameDVR" /t REG_DWORD /d "0" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\GameBar" /v "AutoGameModeEnabled" /t REG_DWORD /d "0" /f2⤵
-
-
C:\Windows\system32\sc.exesc config wlidsvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config DiagTrack start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config DusmSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config RetailDemo start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config Fax start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config lfsvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WpcMonSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config SessionEnv start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config MicrosoftEdgeElevationService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config edgeupdate start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config edgeupdatem start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config autotimesvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config CscService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config TermService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config SensrSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config shpamsvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config diagnosticshub.standardcollector.service start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config PhoneSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config TapiSrv start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config UevAgentService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WalletService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config TokenBroker start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WebClient start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config MixedRealityOpenXRSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config stisvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WbioSrvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config Wecsvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config XboxGipSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config XblAuthManager start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config XboxNetApiSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config XblGameSave start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config SEMgrSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config Backupper Service start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config BthAvctpSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config BDESVC start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config cbdhsvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config CDPSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config DevQueryBroker start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config dmwappushservice start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config TrkWks start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config dLauncherLoopback start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config EFS start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config fdPHost start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config FDResPub start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config IKEEXT start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WPDBusEnum start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config PcaSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config RasMan start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config RetailDemo start=disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config SstpSvc start=disabled2⤵
-
-
C:\Windows\system32\sc.exesc config SSDPSRV start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config SysMain start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config OneSyncSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config FontCache start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config W32Time start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config tzautoupdate start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config DsSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config diagsvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config DialogBlockingService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config PimIndexMaintenanceSvc_5f1ad start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config MessagingService_5f1ad start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config AppVClient start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config MsKeyboardFilter start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config ssh-agent start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config SstpSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config OneSyncSvc_5f1ad start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config wercplsupport start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config WerSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WpnUserService_5f1ad start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config DsmSvc start= disabled2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /DELETE /TN "AMDInstallLauncher" /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /DELETE /TN "AMDLinkUpdate" /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /DELETE /TN "AMDRyzenMasterSDKTask" /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /DELETE /TN "Driver Easy Scheduled Scan" /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /DELETE /TN "ModifyLinkUpdate" /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /DELETE /TN "SoftMakerUpdater" /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /DELETE /TN "StartCN" /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /DELETE /TN "StartDVR" /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Application Experience\PcaPatchDbTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Application Experience\ProgramDataUpdater" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Application Experience\StartupAppTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Autochk\Proxy" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Defrag\ScheduledDefrag" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Device Information\Device User" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Diagnosis\RecommendedTroubleshootingScanner" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Diagnosis\Scheduled" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\DiskCleanup\SilentCleanup" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\DiskFootprint\Diagnostics" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\DiskFootprint\StorageSense" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\DUSM\dusmtask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\EnterpriseMgmt\MDMMaintenenceTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClient" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\FileHistory\File History (maintenance mode)" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Flighting\FeatureConfig\UsageDataFlushing" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Flighting\FeatureConfig\UsageDataReporting" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Flighting\OneSettings\RefreshCache" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Input\LocalUserSyncDataAvailable" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Input\MouseSyncDataAvailable" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Input\PenSyncDataAvailable" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Input\TouchpadSyncDataAvailable" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\International\Synchronize Language Settings" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\LanguageComponentsInstaller\Installation" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\LanguageComponentsInstaller\ReconcileLanguageResources" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\LanguageComponentsInstaller\Uninstallation" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\License Manager\TempSignedLicenseExchange" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\License Manager\TempSignedLicenseExchange" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Management\Provisioning\Cellular" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Management\Provisioning\Logon" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Maintenance\WinSAT" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Maps\MapsToastTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Maps\MapsUpdateTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\MUI\LPRemove" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\NetTrace\GatherNetworkInfo" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\PI\Sqm-Tasks" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\PushToInstall\Registration" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Ras\MobilityManager" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\RetailDemo\CleanupOfflineContent" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Servicing\StartComponentCleanup" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\SettingSync\NetworkStateChangeTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Setup\SetupCleanupTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Setup\SnapshotCleanupTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\SpacePort\SpaceAgentTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\SpacePort\SpaceManagerTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Speech\SpeechModelDownloadTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Storage Tiers Management\Storage Tiers Management Initialization" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Sysmain\ResPriStaticDbSync" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Sysmain\WsSwapAssessmentTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Task Manager\Interactive" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Time Synchronization\ForceSynchronizeTime" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Time Synchronization\SynchronizeTime" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Time Zone\SynchronizeTimeZone" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\TPM\Tpm-HASCertRetr" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\TPM\Tpm-Maintenance" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\UPnP\UPnPHostConfig" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\User Profile Service\HiveUploadTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\WDI\ResolutionHost" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\WOF\WIM-Hash-Management" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\WOF\WIM-Hash-Validation" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Work Folders\Work Folders Logon Synchronization" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Work Folders\Work Folders Maintenance Work" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Workplace Join\Automatic-Device-Join" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\WwanSvc\NotificationTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\WwanSvc\OobeDiscovery" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\XblGameSave\XblGameSaveTask" /Disable2⤵
-
-
C:\Windows\system32\chcp.comchcp 650012⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc" /v "Start" /t REG_DWORD /d "4" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\System\CurrentControlSet\Services\BcastDVRUserService" /v "Start" /t REG_DWORD /d "4" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\System\CurrentControlSet\Services\xbgm" /v "Start" /t REG_DWORD /d "4" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "AppCaptureEnabled" /t REG_DWORD /d "0" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "AudioCaptureEnabled" /t REG_DWORD /d "0" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "CursorCaptureEnabled" /t REG_DWORD /d "0" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "MicrophoneCaptureEnabled" /t REG_DWORD /d "0" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\System\GameConfigStore" /v "GameDVR_FSEBehavior" /t REG_DWORD /d "2" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\System\GameConfigStore" /v "GameDVR_HonorUserFSEBehaviorMode" /t REG_DWORD /d "2" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\System\GameConfigStore" /v "GameDVR_Enabled" /t REG_DWORD /d "0" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows\GameDVR" /v "AllowgameDVR" /t REG_DWORD /d "0" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\GameBar" /v "AutoGameModeEnabled" /t REG_DWORD /d "0" /f2⤵
-
-
C:\Windows\system32\sc.exesc config wlidsvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config DiagTrack start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config DusmSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config RetailDemo start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config Fax start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config lfsvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config WpcMonSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config SessionEnv start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config MicrosoftEdgeElevationService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config edgeupdate start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config edgeupdatem start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config autotimesvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config CscService start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config TermService start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config SensrSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config shpamsvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config diagnosticshub.standardcollector.service start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config PhoneSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config TapiSrv start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config UevAgentService start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config WalletService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config TokenBroker start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config WebClient start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config MixedRealityOpenXRSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config stisvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config WbioSrvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config Wecsvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config XboxGipSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config XblAuthManager start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config XboxNetApiSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config XblGameSave start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config SEMgrSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config Backupper Service start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config BthAvctpSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config BDESVC start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config cbdhsvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config CDPSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config DevQueryBroker start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config dmwappushservice start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config TrkWks start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config dLauncherLoopback start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config EFS start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config fdPHost start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config FDResPub start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config IKEEXT start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WPDBusEnum start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config PcaSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config RasMan start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config RetailDemo start=disabled2⤵
-
-
C:\Windows\system32\sc.exesc config SstpSvc start=disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config SSDPSRV start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config SysMain start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config OneSyncSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config FontCache start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config W32Time start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config tzautoupdate start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config DsSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config diagsvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config DialogBlockingService start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config PimIndexMaintenanceSvc_5f1ad start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config MessagingService_5f1ad start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config AppVClient start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config MsKeyboardFilter start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config ssh-agent start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config SstpSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config OneSyncSvc_5f1ad start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config wercplsupport start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WerSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config WpnUserService_5f1ad start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config DsmSvc start= disabled2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /DELETE /TN "AMDInstallLauncher" /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /DELETE /TN "AMDLinkUpdate" /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /DELETE /TN "AMDRyzenMasterSDKTask" /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /DELETE /TN "Driver Easy Scheduled Scan" /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /DELETE /TN "ModifyLinkUpdate" /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /DELETE /TN "SoftMakerUpdater" /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /DELETE /TN "StartCN" /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /DELETE /TN "StartDVR" /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Application Experience\PcaPatchDbTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Application Experience\ProgramDataUpdater" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Application Experience\StartupAppTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Autochk\Proxy" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Defrag\ScheduledDefrag" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Device Information\Device User" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Diagnosis\RecommendedTroubleshootingScanner" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Diagnosis\Scheduled" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\DiskCleanup\SilentCleanup" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\DiskFootprint\Diagnostics" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\DiskFootprint\StorageSense" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\DUSM\dusmtask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\EnterpriseMgmt\MDMMaintenenceTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClient" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\FileHistory\File History (maintenance mode)" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Flighting\FeatureConfig\UsageDataFlushing" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Flighting\FeatureConfig\UsageDataReporting" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Flighting\OneSettings\RefreshCache" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Input\LocalUserSyncDataAvailable" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Input\MouseSyncDataAvailable" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Input\PenSyncDataAvailable" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Input\TouchpadSyncDataAvailable" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\International\Synchronize Language Settings" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\LanguageComponentsInstaller\Installation" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\LanguageComponentsInstaller\ReconcileLanguageResources" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\LanguageComponentsInstaller\Uninstallation" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\License Manager\TempSignedLicenseExchange" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\License Manager\TempSignedLicenseExchange" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Management\Provisioning\Cellular" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Management\Provisioning\Logon" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Maintenance\WinSAT" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Maps\MapsToastTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Maps\MapsUpdateTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\MUI\LPRemove" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\NetTrace\GatherNetworkInfo" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\PI\Sqm-Tasks" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\PushToInstall\Registration" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Ras\MobilityManager" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\RetailDemo\CleanupOfflineContent" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Servicing\StartComponentCleanup" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\SettingSync\NetworkStateChangeTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Setup\SetupCleanupTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Setup\SnapshotCleanupTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\SpacePort\SpaceAgentTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\SpacePort\SpaceManagerTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Speech\SpeechModelDownloadTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Storage Tiers Management\Storage Tiers Management Initialization" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Sysmain\ResPriStaticDbSync" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Sysmain\WsSwapAssessmentTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Task Manager\Interactive" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Time Synchronization\ForceSynchronizeTime" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Time Synchronization\SynchronizeTime" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Time Zone\SynchronizeTimeZone" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\TPM\Tpm-HASCertRetr" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\TPM\Tpm-Maintenance" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\UPnP\UPnPHostConfig" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\User Profile Service\HiveUploadTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\WDI\ResolutionHost" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\WOF\WIM-Hash-Management" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\WOF\WIM-Hash-Validation" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Work Folders\Work Folders Logon Synchronization" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Work Folders\Work Folders Maintenance Work" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Workplace Join\Automatic-Device-Join" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\WwanSvc\NotificationTask" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\WwanSvc\OobeDiscovery" /Disable2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\XblGameSave\XblGameSaveTask" /Disable2⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\System32\SystemPropertiesProtection.exe"C:\Windows\System32\SystemPropertiesProtection.exe"1⤵
-
C:\Windows\System32\msconfig.exe"C:\Windows\System32\msconfig.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\Risxn's Process Lowering Pack V4\3. autoruns.exe"C:\Users\Admin\Desktop\Risxn's Process Lowering Pack V4\3. autoruns.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
1Service Execution
1Replay Monitor
Loading Replay Monitor...
Downloads
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
f_000006
f_000007
f_000008
f_000009
f_00000a
f_00000b
f_00000c
f_00000d
f_00000e
f_00000f
f_000010
f_000011
f_000013
f_000014
f_000015
f_000016
f_000017
f_000018
f_000019
f_00001a
f_00001c
f_00001d
f_00001e
f_00001f
f_000020
f_000026
f_000028
f_000029
f_00003c
f_000040
f_000041
f_000047
f_000048
f_000049
f_00004a
f_00004b
f_00004c
f_000058
f_000059
f_00005b
f_00005d
f_00005e
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
messages.json
craw_background.js
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
todelete_18774c68289e3e58_0_1
d2a9894db3bf613a_0
index
the-real-index
the-real-index
index.txt
index.txt
index.txt
index.txt~RFe5c3688.TMP
the-real-index
the-real-index
data_0
data_2
data_3
Network Persistent State
Network Persistent State~RFe5fa0ec.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
data_0
data_1
data_2
data_3
data_1
SiteList-Enterprise.json
LOG
000003.log
LOG
LOG
000003.log
LOG
History
LOG
5f8b5b00-9498-42dc-b2fe-d286b328554e.tmp
Network Persistent State
Network Persistent State
Reporting and NEL
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Secure Preferences
LOG
LOG
LOG
sync_diagnostic.log
CURRENT
MANIFEST-000001
Web Data
default_cloud_config.json
000003.log
LOG
000003.log
LOG
data_1
Last Version
Local State
Local State
Local State
Local State
Local State
data_1
Variations
fddcb2a5-9dfa-487f-af8f-4b3475a3c3de.tmp
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
first_party_sets.db
first_party_sets.db-journal
settings.json
settings.json
settings.json
2b36db96-e7e8-4adb-9fd2-f04e13a8ccfe.tmp
__PSScriptPolicyTest_b43ujxzb.qqz.ps1
messages.json
content_new.js
default.exc
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
miniwallet.bundle.js.LICENSE.txt
notification.bundle.js.LICENSE.txt
strings.json
hyph-bn.hyb
hyph-mr.hyb
hyph-nn.hyb
edge_checkout_page_validator.js
memory/944-118-0x00000225ACF60000-0x00000225ACF61000-memory.dmp
memory/944-122-0x00000225ACF60000-0x00000225ACF61000-memory.dmp
memory/944-124-0x00000225ACF60000-0x00000225ACF61000-memory.dmp
memory/944-127-0x00000225ACF60000-0x00000225ACF61000-memory.dmp
memory/944-125-0x00000225ACF60000-0x00000225ACF61000-memory.dmp
memory/944-116-0x00000225ACF60000-0x00000225ACF61000-memory.dmp
memory/944-123-0x00000225ACF60000-0x00000225ACF61000-memory.dmp
memory/944-126-0x00000225ACF60000-0x00000225ACF61000-memory.dmp
memory/2532-277-0x000001CC19F80000-0x000001CC19F81000-memory.dmp
memory/2532-276-0x000001CC19F80000-0x000001CC19F81000-memory.dmp
memory/2532-280-0x000001CC19F80000-0x000001CC19F81000-memory.dmp
memory/2532-278-0x000001CC19F80000-0x000001CC19F81000-memory.dmp
memory/2532-279-0x000001CC19F80000-0x000001CC19F81000-memory.dmp
memory/2532-269-0x000001CC19F80000-0x000001CC19F81000-memory.dmp
memory/2532-271-0x000001CC19F80000-0x000001CC19F81000-memory.dmp
memory/3196-5968-0x0000023EA91E0000-0x0000023EA9202000-memory.dmp
memory/5852-742-0x000001EC79490000-0x000001EC79491000-memory.dmp
memory/5852-745-0x000001EC79490000-0x000001EC79491000-memory.dmp
memory/5852-749-0x000001EC79490000-0x000001EC79491000-memory.dmp
memory/5852-740-0x000001EC79490000-0x000001EC79491000-memory.dmp
memory/5852-747-0x000001EC79490000-0x000001EC79491000-memory.dmp
memory/5852-748-0x000001EC79490000-0x000001EC79491000-memory.dmp
memory/5852-746-0x000001EC79490000-0x000001EC79491000-memory.dmp