Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2023 12:43
Static task
static1
Behavioral task
behavioral1
Sample
e5de959183fcaaae232f085620f0d5f1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e5de959183fcaaae232f085620f0d5f1.exe
Resource
win10v2004-20220812-en
General
-
Target
e5de959183fcaaae232f085620f0d5f1.exe
-
Size
3.3MB
-
MD5
e5de959183fcaaae232f085620f0d5f1
-
SHA1
c15f44fea00604dee5b4d08c7ca4b8503e136645
-
SHA256
c834570ccd6b2682beabbfc8d40e992d52f386aa4542edb5f171250d6f1cb549
-
SHA512
1d0855acf81fd3c26c49938311f6b5e7f06d9f6660a576c23fff30a746fa64d80ae4b26095c81501258515f17165f64918f8d55ff97c7c6b73f098e85027e551
-
SSDEEP
49152:KAhI+dJiV7xK1zhUkVosXUj2jP2zQLWWtKnC:KAhf3g
Malware Config
Extracted
remcos
RemoteHost
rem.unionbindinqcompany.it:3361
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-F4O94O
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
e5de959183fcaaae232f085620f0d5f1.exepid process 2688 e5de959183fcaaae232f085620f0d5f1.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
e5de959183fcaaae232f085620f0d5f1.exee5de959183fcaaae232f085620f0d5f1.exedescription pid process target process PID 4656 set thread context of 2688 4656 e5de959183fcaaae232f085620f0d5f1.exe e5de959183fcaaae232f085620f0d5f1.exe PID 2688 set thread context of 404 2688 e5de959183fcaaae232f085620f0d5f1.exe svchost.exe PID 2688 set thread context of 1488 2688 e5de959183fcaaae232f085620f0d5f1.exe svchost.exe PID 2688 set thread context of 4904 2688 e5de959183fcaaae232f085620f0d5f1.exe svchost.exe PID 2688 set thread context of 1480 2688 e5de959183fcaaae232f085620f0d5f1.exe svchost.exe PID 2688 set thread context of 2840 2688 e5de959183fcaaae232f085620f0d5f1.exe svchost.exe PID 2688 set thread context of 2784 2688 e5de959183fcaaae232f085620f0d5f1.exe svchost.exe PID 2688 set thread context of 4744 2688 e5de959183fcaaae232f085620f0d5f1.exe svchost.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\e4118700-fc1c-496d-9cf6-1c8d5727acc0.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230130134357.pma setup.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
e5de959183fcaaae232f085620f0d5f1.exemsedge.exemsedge.exeidentity_helper.exepid process 4656 e5de959183fcaaae232f085620f0d5f1.exe 3444 msedge.exe 3444 msedge.exe 1600 msedge.exe 1600 msedge.exe 2312 identity_helper.exe 2312 identity_helper.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
e5de959183fcaaae232f085620f0d5f1.exepid process 2688 e5de959183fcaaae232f085620f0d5f1.exe 2688 e5de959183fcaaae232f085620f0d5f1.exe 2688 e5de959183fcaaae232f085620f0d5f1.exe 2688 e5de959183fcaaae232f085620f0d5f1.exe 2688 e5de959183fcaaae232f085620f0d5f1.exe 2688 e5de959183fcaaae232f085620f0d5f1.exe 2688 e5de959183fcaaae232f085620f0d5f1.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs
Processes:
msedge.exepid process 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e5de959183fcaaae232f085620f0d5f1.exedescription pid process Token: SeDebugPrivilege 4656 e5de959183fcaaae232f085620f0d5f1.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
e5de959183fcaaae232f085620f0d5f1.exepid process 2688 e5de959183fcaaae232f085620f0d5f1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e5de959183fcaaae232f085620f0d5f1.execmd.exee5de959183fcaaae232f085620f0d5f1.exesvchost.exemsedge.exedescription pid process target process PID 4656 wrote to memory of 2436 4656 e5de959183fcaaae232f085620f0d5f1.exe cmd.exe PID 4656 wrote to memory of 2436 4656 e5de959183fcaaae232f085620f0d5f1.exe cmd.exe PID 4656 wrote to memory of 2436 4656 e5de959183fcaaae232f085620f0d5f1.exe cmd.exe PID 2436 wrote to memory of 1664 2436 cmd.exe schtasks.exe PID 2436 wrote to memory of 1664 2436 cmd.exe schtasks.exe PID 2436 wrote to memory of 1664 2436 cmd.exe schtasks.exe PID 4656 wrote to memory of 2688 4656 e5de959183fcaaae232f085620f0d5f1.exe e5de959183fcaaae232f085620f0d5f1.exe PID 4656 wrote to memory of 2688 4656 e5de959183fcaaae232f085620f0d5f1.exe e5de959183fcaaae232f085620f0d5f1.exe PID 4656 wrote to memory of 2688 4656 e5de959183fcaaae232f085620f0d5f1.exe e5de959183fcaaae232f085620f0d5f1.exe PID 4656 wrote to memory of 2688 4656 e5de959183fcaaae232f085620f0d5f1.exe e5de959183fcaaae232f085620f0d5f1.exe PID 4656 wrote to memory of 2688 4656 e5de959183fcaaae232f085620f0d5f1.exe e5de959183fcaaae232f085620f0d5f1.exe PID 4656 wrote to memory of 2688 4656 e5de959183fcaaae232f085620f0d5f1.exe e5de959183fcaaae232f085620f0d5f1.exe PID 4656 wrote to memory of 2688 4656 e5de959183fcaaae232f085620f0d5f1.exe e5de959183fcaaae232f085620f0d5f1.exe PID 4656 wrote to memory of 2688 4656 e5de959183fcaaae232f085620f0d5f1.exe e5de959183fcaaae232f085620f0d5f1.exe PID 4656 wrote to memory of 2688 4656 e5de959183fcaaae232f085620f0d5f1.exe e5de959183fcaaae232f085620f0d5f1.exe PID 4656 wrote to memory of 2688 4656 e5de959183fcaaae232f085620f0d5f1.exe e5de959183fcaaae232f085620f0d5f1.exe PID 4656 wrote to memory of 2688 4656 e5de959183fcaaae232f085620f0d5f1.exe e5de959183fcaaae232f085620f0d5f1.exe PID 4656 wrote to memory of 2688 4656 e5de959183fcaaae232f085620f0d5f1.exe e5de959183fcaaae232f085620f0d5f1.exe PID 2688 wrote to memory of 404 2688 e5de959183fcaaae232f085620f0d5f1.exe svchost.exe PID 2688 wrote to memory of 404 2688 e5de959183fcaaae232f085620f0d5f1.exe svchost.exe PID 2688 wrote to memory of 404 2688 e5de959183fcaaae232f085620f0d5f1.exe svchost.exe PID 2688 wrote to memory of 404 2688 e5de959183fcaaae232f085620f0d5f1.exe svchost.exe PID 404 wrote to memory of 1600 404 svchost.exe msedge.exe PID 404 wrote to memory of 1600 404 svchost.exe msedge.exe PID 1600 wrote to memory of 3452 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3452 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe PID 1600 wrote to memory of 3996 1600 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5de959183fcaaae232f085620f0d5f1.exe"C:\Users\Admin\AppData\Local\Temp\e5de959183fcaaae232f085620f0d5f1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \iATCd /tr "C:\Users\Admin\AppData\Local\Temp\e5de959183fcaaae232f085620f0d5f1.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \iATCd /tr "C:\Users\Admin\AppData\Local\Temp\e5de959183fcaaae232f085620f0d5f1.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\e5de959183fcaaae232f085620f0d5f1.exe"C:\Users\Admin\AppData\Local\Temp\e5de959183fcaaae232f085620f0d5f1.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe1c9846f8,0x7ffe1c984708,0x7ffe1c9847185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4888 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5648 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings5⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff67c7c5460,0x7ff67c7c5470,0x7ff67c7c54806⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6992 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=208 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7488 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7336 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2180 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1896 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8088 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7904 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7612 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10725665881870371691,10712982517863594252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c9846f8,0x7ffe1c984708,0x7ffe1c9847185⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1c9846f8,0x7ffe1c984708,0x7ffe1c9847185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1c9846f8,0x7ffe1c984708,0x7ffe1c9847185⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1c9846f8,0x7ffe1c984708,0x7ffe1c9847185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1c9846f8,0x7ffe1c984708,0x7ffe1c9847185⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1c9846f8,0x7ffe1c984708,0x7ffe1c9847185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1c9846f8,0x7ffe1c984708,0x7ffe1c9847185⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xbc,0x108,0x7ffe1c9846f8,0x7ffe1c984708,0x7ffe1c9847185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1c9846f8,0x7ffe1c984708,0x7ffe1c9847185⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xb4,0x114,0x7ffe1c9846f8,0x7ffe1c984708,0x7ffe1c9847185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1c9846f8,0x7ffe1c984708,0x7ffe1c9847185⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d46ac3d95ec929266535e7263b2d696a
SHA12c5130116c7a9f2ab5fa5b46a845dd1c637cc0dc
SHA256759dcb44adb9e6623d48b354451ada4d1069c0de091f86b7b7183cd9b5043dbd
SHA512776f36684418238f92cdadf435a614deeda4e65d5fa357d0322be3ab8663aea31f6b4bb1e549e54f0c5aea3c81617adff7f32943831839129b498576641ad828
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d46ac3d95ec929266535e7263b2d696a
SHA12c5130116c7a9f2ab5fa5b46a845dd1c637cc0dc
SHA256759dcb44adb9e6623d48b354451ada4d1069c0de091f86b7b7183cd9b5043dbd
SHA512776f36684418238f92cdadf435a614deeda4e65d5fa357d0322be3ab8663aea31f6b4bb1e549e54f0c5aea3c81617adff7f32943831839129b498576641ad828
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d46ac3d95ec929266535e7263b2d696a
SHA12c5130116c7a9f2ab5fa5b46a845dd1c637cc0dc
SHA256759dcb44adb9e6623d48b354451ada4d1069c0de091f86b7b7183cd9b5043dbd
SHA512776f36684418238f92cdadf435a614deeda4e65d5fa357d0322be3ab8663aea31f6b4bb1e549e54f0c5aea3c81617adff7f32943831839129b498576641ad828
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d46ac3d95ec929266535e7263b2d696a
SHA12c5130116c7a9f2ab5fa5b46a845dd1c637cc0dc
SHA256759dcb44adb9e6623d48b354451ada4d1069c0de091f86b7b7183cd9b5043dbd
SHA512776f36684418238f92cdadf435a614deeda4e65d5fa357d0322be3ab8663aea31f6b4bb1e549e54f0c5aea3c81617adff7f32943831839129b498576641ad828
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d46ac3d95ec929266535e7263b2d696a
SHA12c5130116c7a9f2ab5fa5b46a845dd1c637cc0dc
SHA256759dcb44adb9e6623d48b354451ada4d1069c0de091f86b7b7183cd9b5043dbd
SHA512776f36684418238f92cdadf435a614deeda4e65d5fa357d0322be3ab8663aea31f6b4bb1e549e54f0c5aea3c81617adff7f32943831839129b498576641ad828
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d46ac3d95ec929266535e7263b2d696a
SHA12c5130116c7a9f2ab5fa5b46a845dd1c637cc0dc
SHA256759dcb44adb9e6623d48b354451ada4d1069c0de091f86b7b7183cd9b5043dbd
SHA512776f36684418238f92cdadf435a614deeda4e65d5fa357d0322be3ab8663aea31f6b4bb1e549e54f0c5aea3c81617adff7f32943831839129b498576641ad828
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d46ac3d95ec929266535e7263b2d696a
SHA12c5130116c7a9f2ab5fa5b46a845dd1c637cc0dc
SHA256759dcb44adb9e6623d48b354451ada4d1069c0de091f86b7b7183cd9b5043dbd
SHA512776f36684418238f92cdadf435a614deeda4e65d5fa357d0322be3ab8663aea31f6b4bb1e549e54f0c5aea3c81617adff7f32943831839129b498576641ad828
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d46ac3d95ec929266535e7263b2d696a
SHA12c5130116c7a9f2ab5fa5b46a845dd1c637cc0dc
SHA256759dcb44adb9e6623d48b354451ada4d1069c0de091f86b7b7183cd9b5043dbd
SHA512776f36684418238f92cdadf435a614deeda4e65d5fa357d0322be3ab8663aea31f6b4bb1e549e54f0c5aea3c81617adff7f32943831839129b498576641ad828
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d46ac3d95ec929266535e7263b2d696a
SHA12c5130116c7a9f2ab5fa5b46a845dd1c637cc0dc
SHA256759dcb44adb9e6623d48b354451ada4d1069c0de091f86b7b7183cd9b5043dbd
SHA512776f36684418238f92cdadf435a614deeda4e65d5fa357d0322be3ab8663aea31f6b4bb1e549e54f0c5aea3c81617adff7f32943831839129b498576641ad828
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d46ac3d95ec929266535e7263b2d696a
SHA12c5130116c7a9f2ab5fa5b46a845dd1c637cc0dc
SHA256759dcb44adb9e6623d48b354451ada4d1069c0de091f86b7b7183cd9b5043dbd
SHA512776f36684418238f92cdadf435a614deeda4e65d5fa357d0322be3ab8663aea31f6b4bb1e549e54f0c5aea3c81617adff7f32943831839129b498576641ad828
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d46ac3d95ec929266535e7263b2d696a
SHA12c5130116c7a9f2ab5fa5b46a845dd1c637cc0dc
SHA256759dcb44adb9e6623d48b354451ada4d1069c0de091f86b7b7183cd9b5043dbd
SHA512776f36684418238f92cdadf435a614deeda4e65d5fa357d0322be3ab8663aea31f6b4bb1e549e54f0c5aea3c81617adff7f32943831839129b498576641ad828
-
C:\Users\Admin\AppData\Local\Temp\e5de959183fcaaae232f085620f0d5f1.exeFilesize
3.3MB
MD5e5de959183fcaaae232f085620f0d5f1
SHA1c15f44fea00604dee5b4d08c7ca4b8503e136645
SHA256c834570ccd6b2682beabbfc8d40e992d52f386aa4542edb5f171250d6f1cb549
SHA5121d0855acf81fd3c26c49938311f6b5e7f06d9f6660a576c23fff30a746fa64d80ae4b26095c81501258515f17165f64918f8d55ff97c7c6b73f098e85027e551
-
\??\pipe\LOCAL\crashpad_1600_ISGVORUESPUVDBQKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/404-141-0x0000000000000000-mapping.dmp
-
memory/444-204-0x0000000000000000-mapping.dmp
-
memory/660-229-0x0000000000000000-mapping.dmp
-
memory/764-213-0x0000000000000000-mapping.dmp
-
memory/776-154-0x0000000000000000-mapping.dmp
-
memory/840-156-0x0000000000000000-mapping.dmp
-
memory/1232-178-0x0000000000000000-mapping.dmp
-
memory/1332-184-0x0000000000000000-mapping.dmp
-
memory/1364-223-0x0000000000000000-mapping.dmp
-
memory/1432-238-0x0000000000000000-mapping.dmp
-
memory/1444-206-0x0000000000000000-mapping.dmp
-
memory/1480-191-0x0000000000000000-mapping.dmp
-
memory/1480-201-0x0000000000000000-mapping.dmp
-
memory/1484-228-0x0000000000000000-mapping.dmp
-
memory/1488-172-0x0000000000000000-mapping.dmp
-
memory/1496-214-0x0000000000000000-mapping.dmp
-
memory/1496-207-0x0000000000000000-mapping.dmp
-
memory/1600-143-0x0000000000000000-mapping.dmp
-
memory/1660-198-0x0000000000000000-mapping.dmp
-
memory/1664-165-0x0000000000000000-mapping.dmp
-
memory/1664-135-0x0000000000000000-mapping.dmp
-
memory/1680-174-0x0000000000000000-mapping.dmp
-
memory/1684-177-0x0000000000000000-mapping.dmp
-
memory/1828-192-0x0000000000000000-mapping.dmp
-
memory/1892-221-0x0000000000000000-mapping.dmp
-
memory/1964-211-0x0000000000000000-mapping.dmp
-
memory/1964-183-0x0000000000000000-mapping.dmp
-
memory/2312-170-0x0000000000000000-mapping.dmp
-
memory/2408-181-0x0000000000000000-mapping.dmp
-
memory/2436-134-0x0000000000000000-mapping.dmp
-
memory/2688-159-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2688-137-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2688-140-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2688-142-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2688-139-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2688-136-0x0000000000000000-mapping.dmp
-
memory/2780-150-0x0000000000000000-mapping.dmp
-
memory/2784-231-0x0000000000000000-mapping.dmp
-
memory/2840-216-0x0000000000000000-mapping.dmp
-
memory/2892-163-0x0000000000000000-mapping.dmp
-
memory/3064-166-0x0000000000000000-mapping.dmp
-
memory/3444-147-0x0000000000000000-mapping.dmp
-
memory/3452-144-0x0000000000000000-mapping.dmp
-
memory/3468-200-0x0000000000000000-mapping.dmp
-
memory/3536-219-0x0000000000000000-mapping.dmp
-
memory/3548-185-0x0000000000000000-mapping.dmp
-
memory/3580-199-0x0000000000000000-mapping.dmp
-
memory/3620-226-0x0000000000000000-mapping.dmp
-
memory/3908-234-0x0000000000000000-mapping.dmp
-
memory/3968-167-0x0000000000000000-mapping.dmp
-
memory/3996-146-0x0000000000000000-mapping.dmp
-
memory/4180-243-0x0000000000000000-mapping.dmp
-
memory/4296-152-0x0000000000000000-mapping.dmp
-
memory/4452-161-0x0000000000000000-mapping.dmp
-
memory/4544-230-0x0000000000000000-mapping.dmp
-
memory/4656-133-0x0000000005570000-0x0000000005B14000-memory.dmpFilesize
5.6MB
-
memory/4656-132-0x0000000000270000-0x00000000005C6000-memory.dmpFilesize
3.3MB
-
memory/4672-208-0x0000000000000000-mapping.dmp
-
memory/4688-196-0x0000000000000000-mapping.dmp
-
memory/4700-241-0x0000000000000000-mapping.dmp
-
memory/4728-215-0x0000000000000000-mapping.dmp
-
memory/4768-222-0x0000000000000000-mapping.dmp
-
memory/4768-193-0x0000000000000000-mapping.dmp
-
memory/4880-169-0x0000000000000000-mapping.dmp
-
memory/4904-187-0x0000000000000000-mapping.dmp
-
memory/5000-168-0x0000000000000000-mapping.dmp
-
memory/5012-176-0x0000000000000000-mapping.dmp
-
memory/5032-237-0x0000000000000000-mapping.dmp
-
memory/5036-158-0x0000000000000000-mapping.dmp
-
memory/5044-236-0x0000000000000000-mapping.dmp
-
memory/5108-189-0x0000000000000000-mapping.dmp