Analysis
- user interaction
yes - max time kernel
1799s - max time network
1799s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
19/04/2026, 07:56
General
- Target http://snapchat.com/web
- Sample260419-jsn1tsbs7w
Score
7/10
Malware Config
Signatures
- A potential corporate email address has been identified in the URL: [email protected]
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 46 IoCs
- Suspicious use of FindShellTrayWindow 41 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://snapchat.com/web1⤵
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff9db1ac188,0x7ff9db1ac194,0x7ff9db1ac1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,13957910637252360838,8917449192306747802,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,13373235455271416534,11526573467088087571,262144 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,16674848294139520867,18177495604726295299,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,18220806355293723946,8490258624608621762,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,6982301538088672783,10087499304744302325,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4960,i,9748339820401533222,14730247563888096816,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,14982794986605945825,8971589260217799323,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,10066517787236940860,18170667538326939625,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,15300153007380229118,674258555164123875,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,16504325036710536418,7955693689814369767,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,16504325036710536418,7955693689814369767,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=device.mojom.XRDeviceService --lang=en-US --service-sandbox-type=xr_compositing --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,18351359158381831971,11097104929600141693,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,2677027535798544752,7492395085954004392,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,3240446331261702223,3057771475299023333,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,1443108604335257790,2028760059247816123,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,15911532396636319797,927025343606711889,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,16683732645417539558,9983344647589882443,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6728,i,1592276912772903010,2866941279536912970,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3976,i,12795323810647172074,8886646191748509406,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=748,i,15835848308848354278,11714292370302933025,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7256,i,10027621772653419859,1818351907105566232,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7580,i,6680892969970895096,17109888897808446171,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7768,i,14109930345071253667,12891752697293779673,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7732,i,4811671041890450374,15836539050139756730,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5076,i,6679222270148005625,5567978315439760541,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4960,i,16917609941072362206,12286549311310248667,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7492,i,3433200220952176144,7778605587779917113,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7576,i,9195917646189981963,11113933988397576339,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6984,i,14064614488682399172,8958565909676011035,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,1204159262795609442,9286953560017124835,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7904,i,1039427039004770973,3562937991258263929,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7652,i,13756117270520778123,9249221411915406852,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8096,i,14044584301739225575,13371945601029775860,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5000,i,15970189002597490922,12778764972272610839,262144 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7676,i,16874854662025057184,6875481319887498286,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,16506683458816799643,5478205621066062871,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,4092180485449646858,60299784928772617,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,10030742500651337981,10263738155764674963,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,4960269426672643958,12574218647592808927,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,4445341122747870275,9807528845227110579,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,6087182208126769028,11180425093215279987,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7416,i,6092397258104680926,13768442445950324690,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8048,i,4996792872707110893,5286717712832207405,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7452,i,13537421204371470165,3890430512488511187,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7384,i,16995986898161158781,3485036096065549813,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8132,i,4452400464829946676,9154651514893249726,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7712,i,12201396408411067119,13390346146831403363,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,8864849623778621599,2057427237808055290,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7440,i,481294627426068070,17746967553964784964,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7736,i,6983901280289725883,12137356571305355898,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,8357218916802458841,15604462442262447303,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=4820,i,15301446901485281014,13220203606865020410,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=7788,i,1364663430130420115,16492757395856984064,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=7512,i,13781776939323697815,2748383583174811445,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=7880,i,14449213276366320155,6290156931238307923,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=5028,i,11793377376080864815,5012540455057733888,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,16175256923719315025,9886843414677357830,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8352,i,12446270428891519553,9797976850821334191,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=8324 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8500,i,15231460479876142719,4697201737162219555,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=8524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8568,i,16245121296973572522,558518682432230056,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=7736,i,10235256778670596266,643928809469437888,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=7452,i,251521798250038831,4538023406641043757,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=8688 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=8832,i,13049689079637721153,10272408866087473127,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=9020,i,1825138091654122708,17424874916576120842,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=9052 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=9076,i,1731170760475612046,8257057835094067412,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=9032 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=9052,i,10829453092342600016,10558248139772900090,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=8608 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=9092,i,14344890193287359994,13558668385009399262,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=9088 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=7324,i,5518200742812518516,6683219635046938745,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=9192 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=8732,i,17436221626287255022,7559388564642770281,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=8312,i,1364324225172817161,638638695239979365,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=8280 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=8604,i,6296766145867887878,7777679268322548551,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=8592 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=9084,i,15223911603806874364,14505023056379833753,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=9236 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=9232,i,9887393655695200561,3897331703300658406,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=8864 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=8272,i,13811310116298032010,16346187026505089410,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=8616 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=8804,i,1442451477487276456,16754226080582735931,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=7440,i,8318930154341997439,5131551314795630896,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=8720 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=9112,i,1377796677621421248,16374304617863048200,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=8656 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=8728,i,18238118476014854808,18298918876786650759,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=9100 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=5700,i,7625822429399280061,14101614821450500515,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=8564 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=8716,i,16965859316302348344,8559334349920769481,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=8680 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9400,i,18370424277348073977,6235331804030695870,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=8624 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=9388,i,10767650835205633746,9777294286953673521,2097152 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9692,i,15843098919498406641,12250155861167614236,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=9668 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8740,i,6409461308312771886,17154247756417090839,524288 --field-trial-handle=2272,i,6898001693828373466,8055533137122107548,262144 --variations-seed-version --mojo-platform-channel-handle=8780 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\CredentialUIBroker.exe"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
manifest.json
manifest.json
edge_checkout_page_validator.js
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.json
manifest.json
keys.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
manifest.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
settings.dat
settings.dat
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000077
f_000078
f_000079
f_00007b
f_00007c
f_00007d
f_00007f
f_000091
f_000092
f_00009e
f_00013a
f_00013b
f_00013c
f_00013d
f_00013e
f_00013f
f_000140
f_000141
f_000146
f_000147
f_000148
f_000149
f_00014b
f_00014d
f_00014e
f_000151
f_000153
f_000154
f_000156
f_000157
f_000158
f_00015c
f_00015d
f_00015f
f_000163
f_000170
f_000172
f_00017b
f_00017d
f_00017e
f_00017f
f_000180
f_000181
f_000182
f_000183
f_000184
f_000185
f_000186
f_000187
f_000188
f_000189
f_00018a
f_00018b
f_00018c
f_00018d
f_00018e
f_00018f
f_000190
f_000191
f_000192
f_000194
f_000195
f_000196
f_000198
f_000199
f_00019a
f_00019b
f_00019c
f_00019d
f_00019e
f_00019f
f_0001a0
f_0001ae
f_0001c4
f_0001c8
f_0001c9
f_0001ca
f_000272
f_000273
f_000274
f_000296
f_000299
f_00029b
f_0002e3
f_0002e5
f_0002e6
f_0002e7
f_0002e9
f_0002eb
f_0002ec
f_0002ee
f_0002ef
f_0002f1
f_0002f2
f_0002f4
f_0002f5
f_0002f6
f_0002f7
f_000353
f_000354
f_000355
f_000356
f_000357
f_000358
f_000359
f_00035a
f_00035b
f_00035c
f_00035d
f_00035e
f_000374
f_000376
f_00038a
f_00038b
f_00038c
f_00038d
f_00038e
f_00038f
f_000390
f_000391
f_000392
f_000393
f_000394
f_000395
f_000396
f_000397
f_00039a
f_00039b
f_00039c
f_00039d
f_00039e
f_0003ba
f_0003c4
f_0003d0
f_0003d2
f_0003d3
f_0003d4
f_0003dc
f_0003e6
f_0003e7
f_0003e8
f_0003e9
f_0003ea
f_0003eb
f_0003f4
f_0003fd
f_0003ff
f_000404
f_00040a
f_00040c
f_00041a
f_000421
f_000422
f_000423
f_000428
f_00042b
f_000430
3557db85b307c5ea_0
bdee697f0face6fa_0
c10c9d311911a438_0
df53bad28ea1e322_0
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58dee2.TMP
b9359c20cde1767b_0
e46696256b369ba9_0
e46696256b369ba9_0
f72a284b245de9de_0
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
SiteList-Enterprise.json
00000000
HubApps
000003.log
000005.ldb
LOG
LOG.old
MANIFEST-000001
MANIFEST-000001
000003.log
000008.ldb
000009.log
000010.ldb
000011.ldb
000012.ldb
000034.ldb
000037.ldb
000041.ldb
000042.ldb
000048.ldb
000065.log
000067.ldb
000068.ldb
000069.ldb
LOG
LOG
LOG.old
MANIFEST-000001
000003.log
LOG
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
TransportSecurity
TransportSecurity~RFe6a75c0.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index~RFe67ffee.TMP
4f2277ea2139c475_0
the-real-index
the-real-index
the-real-index
the-real-index
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5951c0.TMP
040325f9f646be58_0
040325f9f646be58_1
1161788a11ac8066_0
1161788a11ac8066_1
12ac83497277c0ea_0
12ac83497277c0ea_1
19f77edc6c333b83_0
19f77edc6c333b83_1
1a9cc9dd3fef15e7_0
1a9cc9dd3fef15e7_1
1b7b681ad0a4697b_0
1b7b681ad0a4697b_1
1f2b2ec918288a7e_0
1f2b2ec918288a7e_1
1fc437d7e4bebf21_0
1fc437d7e4bebf21_1
22ff7460c662cc2b_0
22ff7460c662cc2b_1
2f53d748c631762c_0
2f53d748c631762c_1
2f80e4753a5de945_0
2f80e4753a5de945_1
40f0b162b06fe2d1_0
40f0b162b06fe2d1_1
43d0c42346261371_0
43d0c42346261371_1
4d2707a2bd8aa9ef_0
4d2707a2bd8aa9ef_1
588da9daa177b1f7_0
588da9daa177b1f7_1
5ece5005aab9b08e_0
5ece5005aab9b08e_1
64458e8e93817f43_0
64458e8e93817f43_1
6abf69e2891709f1_0
6abf69e2891709f1_1
833f49ebb209ef16_0
833f49ebb209ef16_1
8816c8352d4a22bf_0
8816c8352d4a22bf_1
aa788de8f8818aff_0
aa788de8f8818aff_1
ab38e04fb62950d5_0
ab38e04fb62950d5_1
b4f5694c3c716d0a_0
b4f5694c3c716d0a_1
baeda5df7ac553a6_0
baeda5df7ac553a6_1
bf22c6bcd2b7140b_0
bf22c6bcd2b7140b_1
c2200c73d3eadbab_0
c2200c73d3eadbab_1
c7bdfefd3de461dc_0
c7bdfefd3de461dc_1
c907e45a86aaa107_0
c907e45a86aaa107_1
d045e17bfbb95051_0
d045e17bfbb95051_1
da873e6670f3e88d_0
da873e6670f3e88d_1
e1d82b4b93bd6f7e_0
e1d82b4b93bd6f7e_1
e791698e452c6763_0
e791698e452c6763_1
f134e3248b8234b8_0
f134e3248b8234b8_1
fa994cbfdf595d28_0
fa994cbfdf595d28_1
fec2bedb486a72e5_0
fec2bedb486a72e5_1
temp-index
the-real-index~RFe596b33.TMP
index.txt
index.txt
index.txt
index.txt
119f13689cf0558c_0
3ec1fd17056743a2_0
42443b0e8e2e0ea4_0
cf571f0ed56d51fd_0
da27159b3fda690d_0
ef1a9619abb484b1_0
f57d14751f963e33_0
the-real-index
the-real-index~RFe58c455.TMP
index.txt
index.txt
index.txt~RFe581c9b.TMP
the-real-index
the-real-index
73cb100cf1fe8262_0
73cb100cf1fe8262_0
73cb100cf1fe8262_0
index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe591c96.TMP
the-real-index
the-real-index~RFe5a44da.TMP
096a49aba3685359_0
cf790136f730d9c9_0
the-real-index
the-real-index
the-real-index
the-real-index~RFe591c96.TMP
92e25b1d3fef33d3_0
the-real-index
the-real-index~RFe5ab392.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt.tmp
index.txt~RFe590d16.TMP
temp-index
the-real-index~RFe686196.TMP
the-real-index
the-real-index~RFe681133.TMP
index.txt
index.txt
index.txt~RFe67c11f.TMP
67a473248953641b_0
67a473248953641b_1
b6c28cea6ed9dfc1_0
b6c28cea6ed9dfc1_1
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5868a8.TMP
CURRENT
sync_diagnostic.log
MANIFEST-000001
0
data.txt
wallet-checkout-eligible-sites.json
wallet-notification-config.json
wallet-stable.json
wallet-tokenization-config.json
wallet_donation_driver.js
Local State
Local State
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5885c5.TMP
Filtering Rules
LICENSE
typosquatting_list.pb
ranked_dicts
e3c02c2e-6737-42a6-a223-d5ab88d14dbe.tmp
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
thumbcache_idx.db
default.dic
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
SnapVid.Net_H2Gyw7jAJEP7zv1i_360p.mp4.crdownload