Analysis
- user interaction
yes - max time kernel
1054s - max time network
1730s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
09/08/2026, 03:27
Errors
Reason
Machine shutdown
General
- Target https://github.com/RickStrahl/SetResolution
- Sample260809-dzsdyage72
Score
8/10
Malware Config
Signatures
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 18 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Power Settings 1 TTPs 1 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Probable phishing domain 1 TTPs 1 IoCs
- Drops file in Windows directory 8 IoCs
- Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 11 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 27 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 12 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
- Runs regedit.exe 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 7 IoCs
- Suspicious behavior: LoadsDriver 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs
- Suspicious use of AdjustPrivilegeToken 37 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 28 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/RickStrahl/SetResolution1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x300,0x7ffc154cc188,0x7ffc154cc194,0x7ffc154cc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,13878267536233648517,13873011693885983716,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,7155440562194146409,17129720947932634486,262144 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,2846909582504277171,10036585401218334612,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,2177568374795556707,17582102436881180539,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,3743597309749764733,11345149170304257578,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,9588334650136820510,9823159987796322888,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,3450004667712053283,13831576044237908079,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,12584505924661936757,12136961905811309879,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,12290041688161387983,11880534346860160107,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,9893679356855992130,4178815018696828042,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,9893679356855992130,4178815018696828042,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,14304464408417084450,14961007431487053942,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,10155506562662353838,18031071135147873643,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,9041324236792071316,13385697834931724388,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,9788281383821918562,8003983426863319574,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,17472326203654832846,15862877141669352577,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4808,i,13360173123683347427,8951967034991919748,262144 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4988,i,16592603144633866759,1728923956161331276,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,15963721121155822992,14121813620887262683,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,8976202362294579665,7280917635920687856,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5152,i,12134293071217048779,7490884457491228315,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,13738987261609613004,8219180773471651967,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,1090708861295065139,17029596391655699278,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,13374776288566505000,575570744865741949,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,14862863009322382637,4796422774229552408,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,15475939089732561508,8861163718970424638,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=1312 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,13800839865127725498,11754451654728453530,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6584,i,5691050074095267545,8228093389978228258,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,44016016726246010,17952835446292136135,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5632,i,18150442005589340377,10852723102064026514,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5380,i,3493431827969359676,8000769616604246242,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4192,i,16133770529770428752,17218609328806712639,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5196,i,6548351962970052502,12886734291686214122,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=1312,i,8988981554966877364,11561732945976124445,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=4820,i,196055589819354653,6045387596298802626,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7964,i,1549556484801542538,8391583382311592738,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=7968 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7704,i,7428211835594363374,10107450755356025940,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7864,i,15801479040601201858,4753965116564785076,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8236,i,5757488156660330786,14915274311927569631,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=8300 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7184,i,411327878382527989,6064298359850629861,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7520,i,6286321440509317604,1416904352712137771,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7768,i,8030110616662098971,17452555938062325892,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,11386014226445211090,4961677818965748687,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,10388486258953877063,8992272906442744573,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7140,i,14583196169074423941,8137584036783301273,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=8408 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=5652,i,9562805189151983974,2287715961482084902,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7764,i,18248112686524139157,3835422478111653451,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8552,i,13151080059711642210,18301924746766077069,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=8564 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8636,i,10649963337454708170,13842420863868413790,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=8496 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8076,i,3545329012230390645,11702722361878101059,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=8744 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=6552,i,7015331973762408237,1744207376426317847,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=8640 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8976,i,7444600103987890186,16152833795037535438,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=8004 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8592,i,13712168537204906690,13156205232242945105,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=8764 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,11076294098284191212,7586858028118641456,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=9080 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=6564,i,6202886934293526233,13138757797894799743,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8924,i,318417068786048512,7470010744545241072,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=8944 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=2576,i,17579388498436495791,11289242645382414723,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=8600 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=9212,i,2770463988273416885,13133820754915625961,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=5380,i,5174659590807670793,7587850871373006190,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,15622415969324905544,2239401584278589830,524288 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=7972,i,11816093502172323409,2746352661832414414,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=9052,i,17029076900979517874,12010049815794745011,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=9056 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=9268,i,3451870174576888623,9078594988751291108,2097152 --field-trial-handle=2236,i,99171644558453764,9516949014931233649,262144 --variations-seed-version --mojo-platform-channel-handle=9260 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap15715:102:7zEvent52281⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\SetResolution-master\SetResolution\signtool.exeC:\Users\Admin\Downloads\SetResolution-master\SetResolution\signtool.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\SetResolution-master\Binaries\SetResolution.exeC:\Users\Admin\Downloads\SetResolution-master\Binaries\SetResolution.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\SetResolution-master\Binaries\SetResolution.exeC:\Users\Admin\Downloads\SetResolution-master\Binaries\SetResolution.exe -w 768-h 10022⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\SetResolution-master\Binaries\SetResolution.exeC:\Users\Admin\Downloads\SetResolution-master\Binaries\SetResolution.exe -w 768-h 1002-m 12⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\SetResolution-master\Binaries\SetResolution.exeC:\Users\Admin\Downloads\SetResolution-master\Binaries\SetResolution.exe -width=768 -height=10022⤵
- Executes dropped EXE
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\SetResolution-master\SetResolution\signtool.exe"C:\Users\Admin\Downloads\SetResolution-master\SetResolution\signtool.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\SetResolution-master\Binaries\SetResolution.exe"C:\Users\Admin\Downloads\SetResolution-master\Binaries\SetResolution.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\SetResolution-master\Binaries\sr.exe"C:\Users\Admin\Downloads\SetResolution-master\Binaries\sr.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\Downloads\SetResolution-master\Binaries\SetResolution.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\SetResolution-master\Binaries\SetResolution.xml2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3432 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\SetResolution-master\Binaries\SetResolution.xml1⤵
-
C:\Windows\System32\winver.exe"C:\Windows\System32\winver.exe"1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap17145:86:7zEvent8661⤵
- Drops autorun.inf file
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap7504:142:7zEvent312211⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\HRC.exe"C:\Users\Admin\Downloads\HRC.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\HRC.exe"C:\Users\Admin\Downloads\HRC.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\HRC.exe"C:\Users\Admin\Downloads\HRC.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\HRC.exe"C:\Users\Admin\Downloads\HRC.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\HRC.exe"C:\Users\Admin\Downloads\HRC.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\HRC.exe"C:\Users\Admin\Downloads\HRC.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\fb68991e-87d4-4208-a270-27fda3786860_HRC_-_HotKey_Resolution_Changer_v2_1.exe (1).zip.860\HRC.exe"C:\Users\Admin\AppData\Local\Temp\fb68991e-87d4-4208-a270-27fda3786860_HRC_-_HotKey_Resolution_Changer_v2_1.exe (1).zip.860\HRC.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "3396" "11820" "11740" "11824" "0" "0" "11828" "11832" "0" "0" "0" "0"1⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Downloads\HRC.exe"C:\Users\Admin\Downloads\HRC.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\HRC.exe"C:\Users\Admin\Downloads\HRC.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap12476:74:7zEvent325491⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\HRC.exe"C:\Users\Admin\Downloads\HRC.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Holzer.exe"C:\Users\Admin\Downloads\Holzer.exe"1⤵
- Disables RegEdit via registry modification
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\agentactivationruntimestarter.exe"C:\Windows\System32\agentactivationruntimestarter.exe"2⤵
-
-
C:\Windows\SysWOW64\appidtel.exe"C:\Windows\System32\appidtel.exe"2⤵
-
-
C:\Windows\SysWOW64\ARP.EXE"C:\Windows\System32\ARP.EXE"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\AtBroker.exe"C:\Windows\System32\AtBroker.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\System32\attrib.exe"2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\auditpol.exe"C:\Windows\System32\auditpol.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\System32\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\System32\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\System32\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\System32\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\BackgroundTransferHost.exe"C:\Windows\System32\BackgroundTransferHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\bitsadmin.exe"C:\Windows\System32\bitsadmin.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\bootcfg.exe"C:\Windows\System32\bootcfg.exe"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
C:\Windows\SysWOW64\bthudtask.exe"C:\Windows\System32\bthudtask.exe"2⤵
-
-
C:\Windows\SysWOW64\ByteCodeGenerator.exe"C:\Windows\System32\ByteCodeGenerator.exe"2⤵
-
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\System32\calc.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\win32calc.exe"C:\Windows\System32\win32calc.exe"3⤵
-
-
-
C:\Windows\SysWOW64\CameraSettingsUIHost.exe"C:\Windows\System32\CameraSettingsUIHost.exe"2⤵
-
-
C:\Windows\SysWOW64\CertEnrollCtrl.exe"C:\Windows\System32\CertEnrollCtrl.exe"2⤵
-
-
C:\Windows\SysWOW64\certreq.exe"C:\Windows\System32\certreq.exe"2⤵
-
-
C:\Windows\SysWOW64\certutil.exe"C:\Windows\System32\certutil.exe"2⤵
-
-
C:\Windows\SysWOW64\charmap.exe"C:\Windows\System32\charmap.exe"2⤵
-
-
C:\Windows\SysWOW64\CheckNetIsolation.exe"C:\Windows\System32\CheckNetIsolation.exe"2⤵
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\System32\chkdsk.exe"2⤵
-
-
C:\Windows\SysWOW64\chkntfs.exe"C:\Windows\System32\chkntfs.exe"2⤵
-
-
C:\Windows\SysWOW64\choice.exe"C:\Windows\System32\choice.exe"2⤵
-
-
C:\Windows\SysWOW64\cipher.exe"C:\Windows\System32\cipher.exe"2⤵
-
-
C:\Windows\SysWOW64\cleanmgr.exe"C:\Windows\System32\cleanmgr.exe"2⤵
-
-
C:\Windows\SysWOW64\cliconfg.exe"C:\Windows\System32\cliconfg.exe"2⤵
-
-
C:\Windows\SysWOW64\clip.exe"C:\Windows\System32\clip.exe"2⤵
-
-
C:\Windows\SysWOW64\CloudNotifications.exe"C:\Windows\System32\CloudNotifications.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
-
-
C:\Windows\SysWOW64\cmdkey.exe"C:\Windows\System32\cmdkey.exe"2⤵
-
-
C:\Windows\SysWOW64\cmdl32.exe"C:\Windows\System32\cmdl32.exe"2⤵
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\System32\cmmon32.exe"2⤵
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\System32\cmstp.exe"2⤵
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\System32\colorcpl.exe"2⤵
-
-
C:\Windows\SysWOW64\comp.exe"C:\Windows\System32\comp.exe"2⤵
-
-
C:\Windows\SysWOW64\compact.exe"C:\Windows\System32\compact.exe"2⤵
-
-
C:\Windows\SysWOW64\ComputerDefaults.exe"C:\Windows\System32\ComputerDefaults.exe"2⤵
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe"2⤵
-
-
C:\Windows\SysWOW64\convert.exe"C:\Windows\System32\convert.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\CredentialUIBroker.exe"C:\Windows\System32\CredentialUIBroker.exe"2⤵
-
-
C:\Windows\SysWOW64\credwiz.exe"C:\Windows\System32\credwiz.exe"2⤵
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\System32\cscript.exe"2⤵
-
-
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\System32\ctfmon.exe"2⤵
-
-
C:\Windows\SysWOW64\cttune.exe"C:\Windows\System32\cttune.exe"2⤵
-
-
C:\Windows\SysWOW64\cttunesvr.exe"C:\Windows\System32\cttunesvr.exe"2⤵
-
-
C:\Windows\SysWOW64\curl.exe"C:\Windows\System32\curl.exe"2⤵
-
-
C:\Windows\SysWOW64\dccw.exe"C:\Windows\System32\dccw.exe"2⤵
-
-
C:\Windows\SysWOW64\dcomcnfg.exe"C:\Windows\System32\dcomcnfg.exe"2⤵
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe C:\Windows\system32\comexp.msc3⤵
-
-
-
C:\Windows\SysWOW64\ddodiag.exe"C:\Windows\System32\ddodiag.exe"2⤵
-
-
C:\Windows\SysWOW64\DevicePairingWizard.exe"C:\Windows\System32\DevicePairingWizard.exe"2⤵
-
-
C:\Windows\SysWOW64\dfrgui.exe"C:\Windows\System32\dfrgui.exe"2⤵
-
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\System32\dialer.exe"2⤵
-
-
C:\Windows\SysWOW64\diskpart.exe"C:\Windows\System32\diskpart.exe"2⤵
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\System32\diskperf.exe"2⤵
-
-
C:\Windows\SysWOW64\Dism.exe"C:\Windows\System32\Dism.exe"2⤵
-
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"2⤵
-
-
C:\Windows\SysWOW64\dllhst3g.exe"C:\Windows\System32\dllhst3g.exe"2⤵
-
-
C:\Windows\SysWOW64\doskey.exe"C:\Windows\System32\doskey.exe"2⤵
-
-
C:\Windows\SysWOW64\dpapimig.exe"C:\Windows\System32\dpapimig.exe"2⤵
-
-
C:\Windows\SysWOW64\DpiScaling.exe"C:\Windows\System32\DpiScaling.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" ms-settings:display3⤵
-
-
-
C:\Windows\SysWOW64\driverquery.exe"C:\Windows\System32\driverquery.exe"2⤵
-
-
C:\Windows\SysWOW64\dtdump.exe"C:\Windows\System32\dtdump.exe"2⤵
-
-
C:\Windows\SysWOW64\dvdplay.exe"C:\Windows\System32\dvdplay.exe"2⤵
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe/device:dvd3⤵
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon4⤵
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT5⤵
-
-
-
-
-
C:\Windows\SysWOW64\DWWIN.EXE"C:\Windows\System32\DWWIN.EXE"2⤵
-
-
C:\Windows\SysWOW64\dxdiag.exe"C:\Windows\System32\dxdiag.exe"2⤵
-
-
C:\Windows\SysWOW64\EaseOfAccessDialog.exe"C:\Windows\System32\EaseOfAccessDialog.exe"2⤵
-
-
C:\Windows\SysWOW64\edpnotify.exe"C:\Windows\System32\edpnotify.exe"2⤵
-
-
C:\Windows\SysWOW64\efsui.exe"C:\Windows\System32\efsui.exe"2⤵
-
-
C:\Windows\SysWOW64\EhStorAuthn.exe"C:\Windows\System32\EhStorAuthn.exe"2⤵
-
-
C:\Windows\SysWOW64\esentutl.exe"C:\Windows\System32\esentutl.exe"2⤵
-
-
C:\Windows\SysWOW64\eudcedit.exe"C:\Windows\System32\eudcedit.exe"2⤵
-
-
C:\Windows\SysWOW64\eventcreate.exe"C:\Windows\System32\eventcreate.exe"2⤵
-
-
C:\Windows\SysWOW64\eventvwr.exe"C:\Windows\System32\eventvwr.exe"2⤵
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"3⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\eventvwr.msc" "C:\Windows\system32\eventvwr.msc"4⤵
-
-
-
-
C:\Windows\SysWOW64\expand.exe"C:\Windows\System32\expand.exe"2⤵
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"2⤵
-
-
C:\Windows\SysWOW64\extrac32.exe"C:\Windows\System32\extrac32.exe"2⤵
-
-
C:\Windows\SysWOW64\fc.exe"C:\Windows\System32\fc.exe"2⤵
-
-
C:\Windows\SysWOW64\find.exe"C:\Windows\System32\find.exe"2⤵
-
-
C:\Windows\SysWOW64\findstr.exe"C:\Windows\System32\findstr.exe"2⤵
-
-
C:\Windows\SysWOW64\finger.exe"C:\Windows\System32\finger.exe"2⤵
-
-
C:\Windows\SysWOW64\fixmapi.exe"C:\Windows\System32\fixmapi.exe"2⤵
-
-
C:\Windows\SysWOW64\fltMC.exe"C:\Windows\System32\fltMC.exe"2⤵
-
-
C:\Windows\SysWOW64\Fondue.exe"C:\Windows\System32\Fondue.exe"2⤵
-
-
C:\Windows\SysWOW64\fontdrvhost.exe"C:\Windows\System32\fontdrvhost.exe"2⤵
-
-
C:\Windows\SysWOW64\fontview.exe"C:\Windows\System32\fontview.exe"2⤵
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "ConfirmDebug.DVR"3⤵
-
-
-
C:\Windows\SysWOW64\fsquirt.exe"C:\Windows\System32\fsquirt.exe"2⤵
-
-
C:\Windows\SysWOW64\fsutil.exe"C:\Windows\System32\fsutil.exe"2⤵
-
-
C:\Windows\SysWOW64\ftp.exe"C:\Windows\System32\ftp.exe"2⤵
-
-
C:\Windows\SysWOW64\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe"2⤵
-
-
C:\Windows\SysWOW64\GamePanel.exe"C:\Windows\System32\GamePanel.exe"2⤵
-
-
C:\Windows\SysWOW64\getmac.exe"C:\Windows\System32\getmac.exe"2⤵
-
-
C:\Windows\SysWOW64\gpresult.exe"C:\Windows\System32\gpresult.exe"2⤵
-
-
C:\Windows\SysWOW64\gpscript.exe"C:\Windows\System32\gpscript.exe"2⤵
-
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\System32\gpupdate.exe"2⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\System32\grpconv.exe"2⤵
-
-
C:\Windows\SysWOW64\hdwwiz.exe"C:\Windows\System32\hdwwiz.exe"2⤵
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\System32\help.exe"2⤵
-
-
C:\Windows\SysWOW64\hh.exe"C:\Windows\System32\hh.exe"2⤵
-
-
C:\Windows\SysWOW64\HOSTNAME.EXE"C:\Windows\System32\HOSTNAME.EXE"2⤵
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe"2⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icsunattend.exe"C:\Windows\System32\icsunattend.exe"2⤵
-
-
C:\Windows\SysWOW64\ieUnatt.exe"C:\Windows\System32\ieUnatt.exe"2⤵
-
-
C:\Windows\SysWOW64\iexpress.exe"C:\Windows\System32\iexpress.exe"2⤵
-
-
C:\Windows\SysWOW64\InfDefaultInstall.exe"C:\Windows\System32\InfDefaultInstall.exe"2⤵
-
-
C:\Windows\SysWOW64\InputSwitchToastHandler.exe"C:\Windows\System32\InputSwitchToastHandler.exe"2⤵
-
-
C:\Windows\SysWOW64\instnm.exe"C:\Windows\System32\instnm.exe"2⤵
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\System32\ipconfig.exe"2⤵
- Gathers network information
-
-
C:\Windows\SysWOW64\iscsicli.exe"C:\Windows\System32\iscsicli.exe"2⤵
-
-
C:\Windows\SysWOW64\iscsicpl.exe"C:\Windows\System32\iscsicpl.exe"2⤵
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL iscsicpl.dll,,03⤵
-
-
-
C:\Windows\SysWOW64\isoburn.exe"C:\Windows\System32\isoburn.exe"2⤵
-
-
C:\Windows\SysWOW64\ktmutil.exe"C:\Windows\System32\ktmutil.exe"2⤵
-
-
C:\Windows\SysWOW64\label.exe"C:\Windows\System32\label.exe"2⤵
-
-
C:\Windows\SysWOW64\LaunchTM.exe"C:\Windows\System32\LaunchTM.exe"2⤵
-
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"3⤵
-
-
-
C:\Windows\SysWOW64\LaunchWinApp.exe"C:\Windows\System32\LaunchWinApp.exe"2⤵
-
-
C:\Windows\SysWOW64\lodctr.exe"C:\Windows\System32\lodctr.exe"2⤵
-
-
C:\Windows\SysWOW64\logagent.exe"C:\Windows\System32\logagent.exe"2⤵
-
-
C:\Windows\SysWOW64\logman.exe"C:\Windows\System32\logman.exe"2⤵
-
-
C:\Windows\SysWOW64\Magnify.exe"C:\Windows\System32\Magnify.exe"2⤵
-
-
C:\Windows\SysWOW64\makecab.exe"C:\Windows\System32\makecab.exe"2⤵
-
-
C:\Windows\SysWOW64\mavinject.exe"C:\Windows\System32\mavinject.exe"2⤵
-
-
C:\Windows\SysWOW64\mcbuilder.exe"C:\Windows\System32\mcbuilder.exe"2⤵
-
-
C:\Windows\SysWOW64\mfpmp.exe"C:\Windows\System32\mfpmp.exe"2⤵
-
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\System32\mmc.exe"2⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe"3⤵
-
-
-
C:\Windows\SysWOW64\mmgaserver.exe"C:\Windows\System32\mmgaserver.exe"2⤵
-
-
C:\Windows\SysWOW64\mobsync.exe"C:\Windows\System32\mobsync.exe"2⤵
-
-
C:\Windows\SysWOW64\mountvol.exe"C:\Windows\System32\mountvol.exe"2⤵
-
-
C:\Windows\SysWOW64\MRINFO.EXE"C:\Windows\System32\MRINFO.EXE"2⤵
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\System32\msdt.exe"2⤵
-
-
C:\Windows\SysWOW64\msfeedssync.exe"C:\Windows\System32\msfeedssync.exe"2⤵
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe"2⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe"2⤵
-
-
C:\Windows\SysWOW64\msinfo32.exe"C:\Windows\System32\msinfo32.exe"2⤵
-
-
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\System32\mspaint.exe"2⤵
-
-
C:\Windows\SysWOW64\msra.exe"C:\Windows\System32\msra.exe"2⤵
-
C:\Windows\system32\msra.exe"C:\Windows\system32\msra.exe"3⤵
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\System32\mstsc.exe"2⤵
-
C:\Windows\system32\mstsc.exe"C:\Windows\System32\mstsc.exe"3⤵
-
-
-
C:\Windows\SysWOW64\mtstocom.exe"C:\Windows\System32\mtstocom.exe"2⤵
-
-
C:\Windows\SysWOW64\MuiUnattend.exe"C:\Windows\System32\MuiUnattend.exe"2⤵
-
-
C:\Windows\SysWOW64\ndadmin.exe"C:\Windows\System32\ndadmin.exe"2⤵
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe"2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net13⤵
-
-
-
C:\Windows\SysWOW64\net1.exe"C:\Windows\System32\net1.exe"2⤵
-
-
C:\Windows\SysWOW64\netbtugc.exe"C:\Windows\System32\netbtugc.exe"2⤵
-
-
C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe"C:\Windows\System32\NetCfgNotifyObjectHost.exe"2⤵
-
-
C:\Windows\SysWOW64\netiougc.exe"C:\Windows\System32\netiougc.exe"2⤵
-
-
C:\Windows\SysWOW64\Netplwiz.exe"C:\Windows\System32\Netplwiz.exe"2⤵
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe"2⤵
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\System32\NETSTAT.EXE"2⤵
- Gathers network information
-
-
C:\Windows\SysWOW64\newdev.exe"C:\Windows\System32\newdev.exe"2⤵
-
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe"2⤵
-
-
C:\Windows\SysWOW64\nslookup.exe"C:\Windows\System32\nslookup.exe"2⤵
-
-
C:\Windows\SysWOW64\ntprint.exe"C:\Windows\System32\ntprint.exe"2⤵
-
-
C:\Windows\SysWOW64\odbcad32.exe"C:\Windows\System32\odbcad32.exe"2⤵
-
-
C:\Windows\SysWOW64\odbcconf.exe"C:\Windows\System32\odbcconf.exe"2⤵
-
-
C:\Windows\SysWOW64\openfiles.exe"C:\Windows\System32\openfiles.exe"2⤵
-
-
C:\Windows\SysWOW64\OpenWith.exe"C:\Windows\System32\OpenWith.exe"2⤵
-
-
C:\Windows\SysWOW64\OposHost.exe"C:\Windows\System32\OposHost.exe"2⤵
-
-
C:\Windows\SysWOW64\PackagedCWALauncher.exe"C:\Windows\System32\PackagedCWALauncher.exe"2⤵
-
-
C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe"C:\Windows\System32\PasswordOnWakeSettingFlyout.exe"2⤵
-
-
C:\Windows\SysWOW64\PATHPING.EXE"C:\Windows\System32\PATHPING.EXE"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\pcaui.exe"C:\Windows\System32\pcaui.exe"2⤵
-
-
C:\Windows\SysWOW64\perfhost.exe"C:\Windows\System32\perfhost.exe"2⤵
-
-
C:\Windows\SysWOW64\perfmon.exe"C:\Windows\System32\perfmon.exe"2⤵
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\perfmon.msc" /323⤵
-
-
-
C:\Windows\SysWOW64\PickerHost.exe"C:\Windows\System32\PickerHost.exe"2⤵
-
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\System32\PING.EXE"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PkgMgr.exe"C:\Windows\System32\PkgMgr.exe"2⤵
-
-
C:\Windows\SysWOW64\poqexec.exe"C:\Windows\System32\poqexec.exe"2⤵
-
-
C:\Windows\SysWOW64\powercfg.exe"C:\Windows\System32\powercfg.exe"2⤵
- Power Settings
-
-
C:\Windows\SysWOW64\PresentationHost.exe"C:\Windows\System32\PresentationHost.exe"2⤵
-
-
C:\Windows\SysWOW64\prevhost.exe"C:\Windows\System32\prevhost.exe"2⤵
-
-
C:\Windows\SysWOW64\print.exe"C:\Windows\System32\print.exe"2⤵
-
-
C:\Windows\SysWOW64\printui.exe"C:\Windows\System32\printui.exe"2⤵
-
-
C:\Windows\SysWOW64\proquota.exe"C:\Windows\System32\proquota.exe"2⤵
-
-
C:\Windows\SysWOW64\provlaunch.exe"C:\Windows\System32\provlaunch.exe"2⤵
-
-
C:\Windows\SysWOW64\psr.exe"C:\Windows\System32\psr.exe"2⤵
-
C:\Windows\system32\psr.exe"C:\Windows\system32\psr.exe"3⤵
-
-
-
C:\Windows\SysWOW64\quickassist.exe"C:\Windows\System32\quickassist.exe"2⤵
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=quickassist.exe --webview-exe-version=10.0.19041.3758 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\QuickAssist\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=10028.7412.129303884288390836793⤵
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\QuickAssist\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\QuickAssist\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x1bc,0x7ffbcbeeb078,0x7ffbcbeeb084,0x7ffbcbeeb0904⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\QuickAssist\EBWebView" --webview-exe-name=quickassist.exe --webview-exe-version=10.0.19041.3758 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1796,i,5554373004811964708,10318175339914769885,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\QuickAssist\EBWebView" --webview-exe-name=quickassist.exe --webview-exe-version=10.0.19041.3758 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1340,i,5554373004811964708,10318175339914769885,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:34⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\QuickAssist\EBWebView" --webview-exe-name=quickassist.exe --webview-exe-version=10.0.19041.3758 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2164,i,5554373004811964708,10318175339914769885,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\QuickAssist\EBWebView" --webview-exe-name=quickassist.exe --webview-exe-version=10.0.19041.3758 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3492,i,5554373004811964708,10318175339914769885,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\QuickAssist\EBWebView" --webview-exe-name=quickassist.exe --webview-exe-version=10.0.19041.3758 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4088,i,5554373004811964708,10318175339914769885,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\QuickAssist\EBWebView" --webview-exe-name=quickassist.exe --webview-exe-version=10.0.19041.3758 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3520,i,5554373004811964708,10318175339914769885,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\QuickAssist\EBWebView" --webview-exe-name=quickassist.exe --webview-exe-version=10.0.19041.3758 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3860,i,5554373004811964708,10318175339914769885,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14⤵
-
-
-
-
C:\Windows\SysWOW64\rasautou.exe"C:\Windows\System32\rasautou.exe"2⤵
-
-
C:\Windows\SysWOW64\rasdial.exe"C:\Windows\System32\rasdial.exe"2⤵
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\System32\raserver.exe"2⤵
-
-
C:\Windows\SysWOW64\rasphone.exe"C:\Windows\System32\rasphone.exe"2⤵
-
-
C:\Windows\SysWOW64\RdpSa.exe"C:\Windows\System32\RdpSa.exe"2⤵
-
-
C:\Windows\SysWOW64\RdpSaProxy.exe"C:\Windows\System32\RdpSaProxy.exe"2⤵
-
C:\Windows\SysWOW64\RdpSa.exe"C:\Windows\system32\RdpSa.exe"3⤵
-
-
-
C:\Windows\SysWOW64\RdpSaUacHelper.exe"C:\Windows\System32\RdpSaUacHelper.exe"2⤵
-
-
C:\Windows\SysWOW64\rdrleakdiag.exe"C:\Windows\System32\rdrleakdiag.exe"2⤵
-
-
C:\Windows\SysWOW64\ReAgentc.exe"C:\Windows\System32\ReAgentc.exe"2⤵
-
-
C:\Windows\SysWOW64\recover.exe"C:\Windows\System32\recover.exe"2⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe"2⤵
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe"2⤵
- Runs regedit.exe
-
-
C:\Windows\SysWOW64\regedt32.exe"C:\Windows\System32\regedt32.exe"2⤵
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\regedit.exe"3⤵
- Runs regedit.exe
-
-
-
C:\Windows\SysWOW64\regini.exe"C:\Windows\System32\regini.exe"2⤵
-
-
C:\Windows\SysWOW64\Register-CimProvider.exe"C:\Windows\System32\Register-CimProvider.exe"2⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe"2⤵
-
-
C:\Windows\SysWOW64\rekeywiz.exe"C:\Windows\System32\rekeywiz.exe"2⤵
-
-
C:\Windows\SysWOW64\relog.exe"C:\Windows\System32\relog.exe"2⤵
-
-
C:\Windows\SysWOW64\replace.exe"C:\Windows\System32\replace.exe"2⤵
-
-
C:\Windows\SysWOW64\resmon.exe"C:\Windows\System32\resmon.exe"2⤵
-
C:\Windows\SysWOW64\perfmon.exe"C:\Windows\System32\perfmon.exe" /res3⤵
-
C:\Windows\system32\perfmon.exe"C:\Windows\Sysnative\perfmon.exe" /res4⤵
-
-
-
-
C:\Windows\SysWOW64\RMActivate.exe"C:\Windows\System32\RMActivate.exe"2⤵
-
-
C:\Windows\SysWOW64\RMActivate_isv.exe"C:\Windows\System32\RMActivate_isv.exe"2⤵
-
-
C:\Windows\SysWOW64\RMActivate_ssp.exe"C:\Windows\System32\RMActivate_ssp.exe"2⤵
-
-
C:\Windows\SysWOW64\RMActivate_ssp_isv.exe"C:\Windows\System32\RMActivate_ssp_isv.exe"2⤵
-
-
C:\Windows\SysWOW64\RmClient.exe"C:\Windows\System32\RmClient.exe"2⤵
-
-
C:\Windows\SysWOW64\Robocopy.exe"C:\Windows\System32\Robocopy.exe"2⤵
-
-
C:\Windows\SysWOW64\ROUTE.EXE"C:\Windows\System32\ROUTE.EXE"2⤵
-
-
C:\Windows\SysWOW64\RpcPing.exe"C:\Windows\System32\RpcPing.exe"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\rrinstaller.exe"C:\Windows\System32\rrinstaller.exe"2⤵
-
-
C:\Windows\SysWOW64\runas.exe"C:\Windows\System32\runas.exe"2⤵
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe"2⤵
-
-
C:\Windows\SysWOW64\RunLegacyCPLElevated.exe"C:\Windows\System32\RunLegacyCPLElevated.exe"2⤵
-
-
C:\Windows\SysWOW64\runonce.exe"C:\Windows\System32\runonce.exe"2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe"2⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe"2⤵
-
-
C:\Windows\SysWOW64\sdbinst.exe"C:\Windows\System32\sdbinst.exe"2⤵
-
-
C:\Windows\SysWOW64\sdchange.exe"C:\Windows\System32\sdchange.exe"2⤵
-
-
C:\Windows\SysWOW64\sdiagnhost.exe"C:\Windows\System32\sdiagnhost.exe"2⤵
-
-
C:\Windows\SysWOW64\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe"2⤵
-
-
C:\Windows\SysWOW64\SearchIndexer.exe"C:\Windows\System32\SearchIndexer.exe"2⤵
-
-
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"2⤵
-
-
C:\Windows\SysWOW64\SecEdit.exe"C:\Windows\System32\SecEdit.exe"2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4d8 0x4dc1⤵
-
C:\Windows\System32\Upfc.exeC:\Windows\System32\Upfc.exe /launchtype periodic /cv BT4lVRSXDE2M5R2a3eAmfw.01⤵
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" start wuauserv1⤵
- Launches sc.exe
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask1⤵
-
C:\Windows\system32\usoclient.exe"C:\Windows\system32\usoclient.exe" StartScan1⤵
-
C:\Windows\system32\MusNotification.exe"C:\Windows\system32\MusNotification.exe"1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\MusNotificationUx.exe%systemroot%\system32\MusNotificationUx.exe ClearActiveNotifications2⤵
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 132⤵
-
-
C:\Windows\System32\Upfc.exeC:\Windows\System32\Upfc.exe /launchtype periodic /cv AYSjVwR47kKO1AO9crcEEw.01⤵
-
C:\Windows\system32\usoclient.exe"C:\Windows\system32\usoclient.exe" StartScan1⤵
-
C:\Windows\system32\MusNotification.exe"C:\Windows\system32\MusNotification.exe"1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\MusNotificationUx.exe%systemroot%\system32\MusNotificationUx.exe ClearActiveNotifications2⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask1⤵
-
C:\Windows\System32\Upfc.exeC:\Windows\System32\Upfc.exe /launchtype periodic /cv j0Ajm/kUTkaPldl2yszePQ.01⤵
-
C:\Windows\system32\usoclient.exe"C:\Windows\system32\usoclient.exe" StartScan1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\usoclient.exe"C:\Windows\system32\usoclient.exe" StartScan1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\MusNotification.exe"C:\Windows\system32\MusNotification.exe"1⤵
-
C:\Windows\system32\usoclient.exe"C:\Windows\system32\usoclient.exe" StartScan1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
C:\Windows\system32\usoclient.exe"C:\Windows\system32\usoclient.exe" StartScan1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
-
C:\Windows\system32\dashost.exedashost.exe {66a9be1f-7852-4d2c-ae2509fc370426ae}2⤵
-
-
C:\Windows\system32\dashost.exedashost.exe {73757559-1960-4ee4-b50139b4625bc581}2⤵
-
-
C:\Windows\system32\dashost.exedashost.exe {a3713870-27a7-4f30-973ad93a80f24758}2⤵
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k McpManagementServiceGroup1⤵
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\usoclient.exe"C:\Windows\system32\usoclient.exe" StartScan1⤵
-
C:\Windows\System32\Upfc.exeC:\Windows\System32\Upfc.exe /launchtype periodic /cv +T45bOW6HkmxdiTjGR/icA.01⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
C:\Windows\system32\usoclient.exe"C:\Windows\system32\usoclient.exe" StartScan1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
1Accessibility Features
1Power Settings
1Pre-OS Boot
1Bootkit
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Pre-OS Boot
1Bootkit
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Query Registry
5Remote System Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
SetResolution.exe.log
settings.dat
settings.dat
LOG.old
LOG.old
LOG.old
f_0000a6
f_0000a8
f_0000a9
f_0000aa
f_0000ab
f_0000ac
f_0000ad
f_0000af
f_0000b0
f_0000b1
f_0000b9
f_0000ba
f_0000bb
f_0000bc
f_0000bd
f_0000be
f_0000e3
f_0000e8
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe588fb8.TMP
SiteList-Enterprise.json
Edge Profile.ico
LOG.old
CURRENT
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries~RFe613db4.TMP
TransportSecurity
TransportSecurity~RFe6a8f43.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
temp-index
the-real-index~RFe5cd411.TMP
index.txt
sync_diagnostic.log
OperationConfig
OperationConfig~RFe5925af.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe6146ad.TMP
63c5006f-0d18-4c37-8c6c-f86f2fe1ac98.tmp
f36efa90-accc-4d9c-88da-0bad918b20cd.tmp
CurrentDatabase_400.wmdb
FileCoAuth-2026-8-9.327.4972.1.odl
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
WMSDKNS.XML
settings.dat
Preferences
Preferences~RFe6a863b.TMP
MANIFEST-000001
data_0
data_1
data_2
data_3
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
HRC.ini
HRC.ini
HRC.ini
HRC.ini
HRC.ini
HRC.ini
HRC.ini
HRC.ini
HRC.ini
HRC.ini
HRC.ini
Holzer.zip
SetResolution.exe
SetResolution.xml
SetResolution.sln
signtool.exe
qres-src1097.zip.crdownload
dism.log
diagerr.xml
memory/644-625-0x000001D546610000-0x000001D546620000-memory.dmp
memory/920-635-0x00007FFBE5B30000-0x00007FFBE5B40000-memory.dmp
memory/920-637-0x00007FFBE5B30000-0x00007FFBE5B40000-memory.dmp
memory/920-640-0x00007FFBE5B30000-0x00007FFBE5B40000-memory.dmp
memory/920-636-0x00007FFBE5B30000-0x00007FFBE5B40000-memory.dmp
memory/920-639-0x00007FFBE5B30000-0x00007FFBE5B40000-memory.dmp
memory/920-633-0x00007FFBE5B30000-0x00007FFBE5B40000-memory.dmp
memory/920-641-0x00007FFBE5B30000-0x00007FFBE5B40000-memory.dmp
memory/920-642-0x00007FFBE5B30000-0x00007FFBE5B40000-memory.dmp
memory/920-634-0x00007FFBE5B30000-0x00007FFBE5B40000-memory.dmp
memory/3096-3361-0x00007FFC24520000-0x00007FFC24521000-memory.dmp
memory/6160-3251-0x0000000037780000-0x0000000037790000-memory.dmp
memory/6328-3362-0x00007FFC246C0000-0x00007FFC246C1000-memory.dmp
memory/6328-3363-0x00007FFC23C60000-0x00007FFC23C61000-memory.dmp
memory/7568-3471-0x00000000005F0000-0x0000000000600000-memory.dmp
memory/7568-3495-0x00000000005F0000-0x0000000000600000-memory.dmp
memory/7568-3470-0x00000000005F0000-0x0000000000600000-memory.dmp
memory/7568-3469-0x00000000005F0000-0x0000000000600000-memory.dmp
memory/7568-3491-0x00000000005F0000-0x0000000000600000-memory.dmp
memory/8584-3337-0x00007FFC24520000-0x00007FFC24521000-memory.dmp
memory/8724-3105-0x0000000001300000-0x0000000001310000-memory.dmp
memory/9092-3464-0x00000000002A0000-0x00000000002B0000-memory.dmp
memory/9092-3466-0x00000000002A0000-0x00000000002B0000-memory.dmp
memory/9092-3463-0x00000000002A0000-0x00000000002B0000-memory.dmp
memory/9092-3477-0x00000000002A0000-0x00000000002B0000-memory.dmp
memory/9092-3480-0x00000000002A0000-0x00000000002B0000-memory.dmp
memory/10928-3474-0x0000000000590000-0x00000000005A0000-memory.dmp
memory/10928-3468-0x0000000000590000-0x00000000005A0000-memory.dmp
memory/10928-3475-0x0000000000590000-0x00000000005A0000-memory.dmp
memory/10928-3446-0x0000000000590000-0x00000000005A0000-memory.dmp
memory/10928-3444-0x0000000000590000-0x00000000005A0000-memory.dmp
memory/10928-3445-0x0000000000590000-0x00000000005A0000-memory.dmp
memory/11248-3492-0x0000000001100000-0x0000000001110000-memory.dmp
memory/11248-3498-0x0000000001100000-0x0000000001110000-memory.dmp
memory/11248-3499-0x0000000001100000-0x0000000001110000-memory.dmp
memory/11248-3452-0x0000000001100000-0x0000000001110000-memory.dmp
memory/11248-3453-0x0000000001100000-0x0000000001110000-memory.dmp
memory/11248-3451-0x0000000001100000-0x0000000001110000-memory.dmp