Analysis
- user interaction
yes - max time kernel
609s - max time network
608s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
16/04/2026, 22:34
General
- Target http://instagram.com
- Sample260416-2hecraft4w
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Loads dropped DLL 1 IoCs
- Drops file in Program Files directory 37 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 47 IoCs
- Suspicious use of FindShellTrayWindow 58 IoCs
- Suspicious use of SendNotifyMessage 40 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://instagram.com1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffe8a51c188,0x7ffe8a51c194,0x7ffe8a51c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,11790514181880384752,1536204096082810041,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,8414511544112082924,8920622135376007795,262144 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,11574600094514372856,1761608254975294958,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,11687399392228257977,4578011725946043261,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,5780123519042847622,14896091755707161543,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,7772838117388477571,5371306598547484461,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,5308930557122515287,2310281111845948116,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,13335759367518398850,11514536360093844940,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,16489752128101879388,14476348912971582930,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,931816474722823568,17013363395908597007,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,14475695546817560978,16755958963093478660,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,1686695691185344937,11399372337272682075,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,1686695691185344937,11399372337272682075,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6052,i,13013963461733971679,11081631484832587706,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,11368776586494043081,7029644715854462995,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,13686718561034322187,11549967841315849382,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,16803967255687045968,15449799200131396622,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,2374576343437220401,1218323510740973114,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,16917536594257045889,1608483627780037105,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5960,i,9385542248729404394,10824566593220144358,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6184,i,9937579361534512157,14764359911017629720,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6156,i,14994699794600992371,12201712519815651970,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,5728910423397283554,6658000359314523948,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,2126404950090191180,10542216366641933779,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,11538209623127435822,7456549777068101737,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=4832,i,13072114925473344204,9544799726317932391,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4868,i,16766023754834743901,7742399024423553673,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=2844,i,8405612884024097611,8702466001463074573,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=2116,i,4804093242492967927,5797286548653759499,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4228,i,12711919029205668269,6329103114927749556,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1244,i,7382970349968784504,9269051784494024222,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,6569084905312199704,14303571904481277742,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,3921587674967048392,17788456266902907555,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6164,i,6882573881053230554,7341510050257346627,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7112,i,11186042805985656242,7065399886904029034,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=5996,i,8035139690865901344,12047704525339112756,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=6268,i,1517785415545934521,3711680529013281397,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7284,i,17722366594261512405,18406457433938023010,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=6120,i,330149894291780253,17079019408575826173,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7608,i,12162767996331336602,3359544189625916390,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7496,i,755825465853635391,13860327645857278989,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7212,i,1009850609541244734,5677436088638544495,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8132,i,4088427636220039715,11267857362393941405,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7472,i,10100661133880078179,3490077139302193371,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8212,i,16920065319288621002,17002426245947795419,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7492,i,9178410879785087981,2667395742616209853,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=8336 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=7468,i,12584284932581264838,6542667945984759152,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=8368 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7552,i,18080006010827689025,12798693993709064995,262144 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8060,i,3540413155312547221,8471815618347983593,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7768,i,13418237989892135708,1951879272570602621,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8776,i,11827068922748702030,8302366366203870113,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=8764 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=7328,i,11035647885353057143,10013131293145961767,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=8536 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8628,i,4291599885768137943,9774128017865648114,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8224,i,7445738312538921934,15420354579306840845,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=8312 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8320,i,3864875917144578879,6958274499872790161,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=8364 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,9731581928762383684,1364003953789916510,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=8336 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4136,i,13988718394995621302,6960786070850530373,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8376,i,17859396304755807102,11464522408855969946,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=8520 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7900,i,14200966748501769620,3957164779915186152,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=7372,i,3960034122751228115,18077831806215959151,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,11742903948143980159,5174230366835994399,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=3244,i,4904170655772143087,7599875314209094355,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=5064,i,4727296997381473437,10247154520975047834,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=4704,i,6977331084880431593,871120993103616678,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=5148,i,5991325889984005288,16126422745461226846,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=7228,i,6403198523704627164,17976208702502469005,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,7923102273348416980,3369583573414246594,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7480,i,766971385810226753,12410593970842701503,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,18204022842380316116,13772235992827888779,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=3960,i,2579462664854718998,18189267472083143321,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=8136 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=3876,i,3414029727947852284,7730672583686717049,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=4256,i,8226297710634716117,7708364711624275638,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=3644,i,15639063865216430479,11304368645518617787,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=8356 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,3828071382205066705,10947655688426377983,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,12321756498179536279,4126775771585926620,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=8588,i,10661339599742477505,4391598774961438355,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=5308,i,16230765349948783959,16751573616832575872,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=7412,i,1571873915980115426,4764704750788407107,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=8580 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=7460,i,12192085653918840165,6934114260437721175,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=5708,i,10676125741627016210,3945331298876394974,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=6000,i,16259932290851499402,3220675806767487753,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=3968,i,3546308150945284073,8440002022113521761,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8012,i,4167688578656833191,18164701964880460948,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3908,i,1413088016335543771,6744524210238213976,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=7248,i,10497939738206720862,7132352449254240648,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,16269894106793901455,16695383184075137476,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=6728,i,13693661425502013368,8850678167673761329,2097152 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=8044 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8820,i,3145859733424232708,14928354136916208687,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,4642744976414944585,11994374022469226720,524288 --field-trial-handle=2276,i,2370292674771186137,4353399908625593327,262144 --variations-seed-version --mojo-platform-channel-handle=8868 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
blocklist
protocols.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
crl-set
settings.dat
settings.dat
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
f_0000aa
f_0000ae
f_0000b0
f_0000b4
f_0000b8
f_0000b9
f_0000bb
f_0000bc
f_0000bd
f_0000bf
f_0000c0
f_0000c1
f_0000c3
f_0000c4
f_0000c8
f_0000ca
f_0000cb
f_0000cc
f_0000cd
f_0000da
f_0000df
f_0000e3
f_0000e4
f_0000e5
f_0000e6
f_0000eb
f_0000f1
f_0000f4
f_0000f5
f_0000f6
f_0000f7
f_0000f8
f_0000f9
f_0000fb
f_0000fd
f_0000fe
f_0000ff
f_000100
f_000101
f_000102
f_000103
f_000106
f_000107
f_000108
f_00010c
f_00010d
f_000110
f_00011d
f_00011e
f_000125
f_00012d
f_00012f
f_000130
f_000131
f_000134
f_000135
f_000136
f_000139
f_00014d
f_00019e
f_0001a1
f_0001a2
f_0001a3
f_0001a4
f_0001a5
f_0001a7
f_0001a8
f_0001a9
f_0001aa
f_0001ab
f_0001ac
f_0001b0
f_0001b7
f_0001ba
f_0001bc
f_0001bd
f_0001be
f_0001d8
f_0001e4
f_0001e5
f_0001e6
f_0001e7
f_0001e8
f_0001e9
f_0001ea
f_0001ec
f_0001ed
f_0001ee
f_0001f1
f_000265
f_000269
f_00026a
f_00026b
05d72221409e9756_0
09371fe7ba469ebd_0
0c67b1c8a331cf50_0
0f4f4c751d14502a_0
2db326f87ec4a748_0
37a6efea87e5fdb2_0
4b7e8a6e3f942d9c_0
502aaacc14272387_0
52d149443ba71505_0
667e9efb5e0d626e_0
7171c1a4f52dec71_0
83ae8200d2013055_0
850b9b74ac1370d6_0
8aa060daf903eab5_0
95db4a59d1e7919f_0
965c1a2ce9b805e6_0
985ed6175ee28d56_0
babe0c77f0d43705_0
c4a137cbec6e057f_0
c937d189d0a3e32d_0
ce17048e0f0ce252_0
d442866428a38e6a_0
d6f4d68ee419aaca_0
e64230b0cac37eb5_0
e66d92ee25404b18_0
e8dd0517833a1bab_0
ea7ca1f0505027ba_0
eac0e7fc45d9e447_0
temp-index
temp-index
temp-index
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5944c0.TMP
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
HubApps
000003.log
LOG
LOG.old
MANIFEST-000001
0dd23b51-7088-4d01-ae8a-2457d49adf88.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Sdch Dictionaries
Sdch Dictionaries~RFe59d102.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58d56c.TMP
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58d55c.TMP
index.txt
index.txt
index.txt~RFe5886de.TMP
the-real-index
the-real-index
the-real-index
the-real-index~RFe59e277.TMP
the-real-index
the-real-index~RFe5a0a42.TMP
4f2277ea2139c475_0
the-real-index
the-real-index
the-real-index
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
the-real-index~RFe59e277.TMP
index.txt
index.txt
index.txt
index.txt
fa813c9ad67834ac_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58d7fc.TMP
sync_diagnostic.log
CURRENT
MANIFEST-000001
domain_actions.dll
b79b69bf-dd6c-4d09-a125-1adcda352cd5.tmp
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5898b1.TMP
keys.json
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
d134f41f-c92c-4ab6-af67-59f3c5b4b266.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
abeeb56f-5e34-4413-b1a1-485411507f93.tmp
b05fcf29-25eb-4645-906f-eaa759b61268.tmp
3cd9e1d7-52bc-443f-8670-f350dac90feb.tmp
content_new.js
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
memory/5064-596-0x00000259A7020000-0x00000259A70CD000-memory.dmp