Analysis
- user interaction
yes - max time kernel
1742s - max time network
1743s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
24/04/2026, 01:01
General
- Target http://teams.live.com
- Sample260424-bc8rasay4l
Score
7/10
Malware Config
Signatures
- A potential corporate email address has been identified in the URL: [email protected]
- Loads dropped DLL 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 32 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Detected potential entity reuse from brand MICROSOFT. 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 11 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://teams.live.com1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a0,0x7ffd2ce4c188,0x7ffd2ce4c194,0x7ffd2ce4c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,5042381023788581970,11374763201748817127,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:32⤵
- Detected potential entity reuse from brand MICROSOFT.
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,13389182462171967466,3986172499792763195,262144 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,5634428887694002710,12882955660416809473,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,9758123708925850927,14888161537101994401,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,3484186410733710774,12568961874186161412,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,12354090759764336935,16656563880563895733,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,10323162162808052348,9064221741846919935,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,6939574859279998571,9888110732371263,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5076,i,6509527913251133185,8134191325993506976,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,114054500926768078,12135058667967057830,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,15101500856570683658,17690086831362385176,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,14281017571681977230,5505257414964410825,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,5450648624753362547,5194029577449246498,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,5450648624753362547,5194029577449246498,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,9591687234923336064,11227172293990712655,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6672,i,8291373892023611412,14239098455100787874,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,12366046577819077394,4617458901000542880,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7128,i,7614508291939776111,12916861251554853854,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,3584633855753188452,2975255949062642816,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,15539546181878898086,14286766104525659242,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,16954927370241866080,8757909657003788571,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3756,i,2643392268360747303,1560679326299166168,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3728,i,4621012800567840256,11442586825821576564,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4388,i,431937284256127707,13555655330852088400,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3548,i,17034395575756709208,367525182743582491,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6796,i,6226761988691344073,3158525307080232304,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6172,i,18218916055769457525,10392621306817628123,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7376,i,16690782006400615593,639862767649000076,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7232,i,18074600903641195716,7842969541501023022,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7380,i,15232439464684205029,9005403044148396264,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6736,i,798950915724149319,12550945993146454279,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=3672,i,5194013736090701124,7668495309712830807,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=5292,i,2316559947824564820,14372063157591838340,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=3644,i,3699590256900762713,10479642251952489803,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,2618800132632476200,11517836450701523113,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7356,i,3970347473471256622,17692755469062132855,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=5396,i,17739485280030559343,12101038564353621412,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7508,i,3853948839707123438,17521486589467050020,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7548,i,6276898915325053652,10289191391902298565,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7832,i,5872499153745703299,3466825132131220701,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7936,i,2603888385050726836,15210521277380858768,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=7948 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,9349888841092084227,8177715262009495607,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8688,i,7415329432916927380,16945114780999210497,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=768 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7456,i,9621932474627165567,15046875368905755632,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=8816 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,9413965506349588018,14555768261392597803,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=8540 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8536,i,7447583906325795640,9014949043148236511,262144 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=8520 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,1948936744114855081,17691224237184116451,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=8500 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=6012,i,7627134468980856574,16301611802754987594,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8844,i,4358122772629221124,16878633986877882640,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8724,i,5054468656631232510,17531293631217799723,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=9060 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7800,i,568214746732460952,10739731203645940428,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=8900 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,16118517942598827240,16779119896069396195,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=8724 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8880,i,9912429350923820871,4423210510044656592,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7420,i,7738696028283813191,4996748364235516972,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8980,i,12875638170286353260,1713335809630523187,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=8816 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,5990019868570105548,12847597763153281730,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,13878425678336373680,13220233593988576206,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,10904373613098231333,10162360305079689131,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=5676,i,13112247819922586089,11262887953995606871,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=8176 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9528,i,6609220302160371010,1547907879997640603,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8400,i,13412822430947417677,9431258571804807547,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=9492 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,661218880332006458,5749323131026672271,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=8448 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,8456418746121804840,13172611478805310468,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7428,i,13674611409766368270,5170271578086302753,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=8688 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9248,i,17534118084160462433,2752311479571024781,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=9648 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9244,i,4730299298580836884,8571934087912866909,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8104,i,17350015359396173484,13758835497299331604,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9556,i,7882991512516063273,13982330115303982405,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=8596 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9480,i,11479939646134475471,17843134073971029651,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,5940026756074349518,4987264844965652944,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=8148 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4024,i,10557349090877624591,9852131707172492453,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8484,i,12455633629431600296,3689282037147915745,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8784,i,9041400305685675496,5712258169142086170,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9572,i,11739365138435137032,645722831320828910,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=9800 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=9572,i,4614102802256911861,9750959630099896743,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=9960 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=9780,i,12493236107059245270,11329713490455609613,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=8008 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9904,i,1696166042648385431,8954887907734167956,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9808,i,3955079248392266789,12234898191721276967,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=3596,i,5283885906166682612,11950426762818828111,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=9432,i,11567402948908535711,4297698086788893067,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=9500 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=9628,i,14666871631787772749,4176603633775743528,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=7148,i,17694055765614508210,3808825038057886753,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9360,i,3810064033161787041,12301788610974656076,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=8588 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=4388,i,1126794448834294405,11400830600665970140,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,8462867036674046819,6561512770282369971,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=10128 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=3488,i,17773665678453584037,12133150482254022800,2097152 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=9644 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10112,i,1378801856218316967,17085453049775703801,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10012,i,4607574392478113931,11883302003424794052,524288 --field-trial-handle=2392,i,16487519164533586183,8132046991211933501,262144 --variations-seed-version --mojo-platform-channel-handle=10024 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\CredentialUIBroker.exe"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
manifest.json
manifest.json
edge_checkout_page_validator.js
manifest.json
manifest.json
manifest.json
Staging
manifest.json
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.json
manifest.json
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
blocklist
protocols.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
crl-set
settings.dat
settings.dat
settings.dat
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
f_00007e
f_00007f
f_000080
f_000081
f_000082
f_000083
f_000084
f_000085
f_000086
f_000087
f_000088
f_000089
f_00008a
f_00008b
f_00008c
f_00008d
f_00008e
f_00008f
f_000090
f_000091
f_000092
f_000093
f_000094
f_000095
f_000097
f_000099
f_00009b
f_00009c
f_00009d
f_00009e
f_00009f
f_0000a0
f_0000a1
f_0000a2
f_0000b8
f_0000ba
f_0000bc
f_0000bd
f_0000be
f_0000c5
f_0000c6
f_0000c7
f_0000c8
f_0000cd
f_0000ce
f_0000cf
f_0000d0
f_0000d1
f_0000d3
f_0000d5
f_0000d6
f_0000da
f_0000db
f_0000dd
f_0000df
f_0000e1
f_0000e2
f_0000e8
f_0000fc
f_0001a2
f_0001af
f_0001f8
f_00020a
f_00020b
f_000218
f_00021a
f_00021c
f_00021d
f_000242
f_000248
f_000249
f_00024a
f_000252
f_000254
f_000257
f_0003d1
f_0003e4
f_0003ff
f_00057f
f_000590
f_000591
f_000595
f_000596
f_000598
f_0005ab
f_0005ac
f_0005ad
f_0005ae
5e77280eb4f302ee_0
9e4892f783337a3b_0
c46b8a46e01c58b9_0
e9e0fa334e662941_0
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5a1f32.TMP
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
HubApps
000003.log
LOG
LOG.old
000003.log
000006.log
000008.ldb
000012.ldb
000021.log
000023.ldb
000024.ldb
000025.ldb
000026.log
000028.ldb
000029.ldb
000030.ldb
LOG
LOG
LOG
LOG
LOG.old
MANIFEST-000001
MANIFEST-000001
000003.log
LOG
LOG
LOG.old
000017.ldb
000018.log
000020.ldb
LOG
MANIFEST-000001
1cb9e6cf-3670-48f9-ab36-fd1981d35285.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries~RFe6cd413.TMP
TransportSecurity
TransportSecurity~RFe6a7795.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
f230a9fcec01840d_0
the-real-index
the-real-index~RFe6d3f6f.TMP
the-real-index
the-real-index
the-real-index
the-real-index~RFe6ce633.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe6cdc21.TMP
4f2277ea2139c475_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5a0fa1.TMP
02bc076a7e78c9df_0
02bc076a7e78c9df_1
040325f9f646be58_0
040325f9f646be58_1
12ac83497277c0ea_0
12ac83497277c0ea_1
173726a74f06c1a0_0
173726a74f06c1a0_1
1a9cc9dd3fef15e7_0
1a9cc9dd3fef15e7_1
1fc437d7e4bebf21_0
1fc437d7e4bebf21_1
22ff7460c662cc2b_0
22ff7460c662cc2b_1
2f53d748c631762c_0
2f53d748c631762c_1
2f80e4753a5de945_0
2f80e4753a5de945_1
3bd382dcd0f9dcc5_0
3bd382dcd0f9dcc5_1
40f0b162b06fe2d1_0
40f0b162b06fe2d1_1
43d0c42346261371_0
43d0c42346261371_1
4d2707a2bd8aa9ef_0
4d2707a2bd8aa9ef_1
588da9daa177b1f7_0
588da9daa177b1f7_1
6abf69e2891709f1_0
6abf69e2891709f1_1
6ad29b89a7e96d6f_0
6ad29b89a7e96d6f_1
81fd71721170aae6_0
81fd71721170aae6_1
83f962d59df5d2c9_0
83f962d59df5d2c9_1
8816c8352d4a22bf_0
8816c8352d4a22bf_1
8ff5f32ff5979d44_0
8ff5f32ff5979d44_1
9979dfa59baae60c_0
9979dfa59baae60c_1
aa788de8f8818aff_0
aa788de8f8818aff_1
af7eeb91b855aeb3_0
af7eeb91b855aeb3_1
b6f1dc444109a9c0_0
b6f1dc444109a9c0_1
b8b370eb087dd18b_0
b8b370eb087dd18b_1
baeda5df7ac553a6_0
baeda5df7ac553a6_1
c7bdfefd3de461dc_0
c7bdfefd3de461dc_1
d0bcbc2a3bff6f7f_0
d0bcbc2a3bff6f7f_1
d53ff6cfc7a32f53_0
d53ff6cfc7a32f53_1
d5e8be34c210718c_0
d5e8be34c210718c_1
e791698e452c6763_0
e791698e452c6763_1
ebbcc5c30a581e88_0
ebbcc5c30a581e88_1
f134e3248b8234b8_0
f134e3248b8234b8_1
fa994cbfdf595d28_0
fa994cbfdf595d28_1
fc423f5814aeb1c3_0
fc423f5814aeb1c3_1
fec2bedb486a72e5_0
fec2bedb486a72e5_1
the-real-index
the-real-index
the-real-index~RFe58ec30.TMP
623cd082b6202da0_0
temp-index
the-real-index
the-real-index
the-real-index
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
the-real-index
the-real-index~RFe59e5b3.TMP
the-real-index
the-real-index~RFe59bd4b.TMP
index.txt
index.txt
index.txt
index.txt~RFe58fcba.TMP
73cb100cf1fe8262_0
73cb100cf1fe8262_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe583f27.TMP
92e25b1d3fef33d3_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5a1677.TMP
the-real-index
the-real-index~RFe5980a0.TMP
index
the-real-index
the-real-index
the-real-index
096a49aba3685359_0
cf790136f730d9c9_0
cf790136f730d9c9_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe583f27.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe582650.TMP
67a473248953641b_0
67a473248953641b_1
ba23d8ecda68de77_0
ba23d8ecda68de77_1
the-real-index
the-real-index
the-real-index
the-real-index~RFe594423.TMP
sync_diagnostic.log
CURRENT
MANIFEST-000001
Workspaces Internals Logs
domain_actions.dll
data.txt
9b53938c-f4c8-4ad4-9e36-116417406ffc.tmp
office_endpoints_list.json
wallet-checkout-eligible-sites.json
wallet-notification-config.json
wallet-stable.json
wallet-tokenization-config.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe586c51.TMP
safety_tips.pb
typosquatting_list.pb
Ruleset Data
Filtering Rules
LICENSE
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
keys.json
typosquatting_list.pb
well_known_domains.dll
nav_config.json
ranked_dicts
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
619226e6-253d-4252-abd1-9d3b28192636.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
d4764d60-a01c-44e4-992d-e543eb1c3875.tmp
e4d932c0-c071-4eb9-bf7e-2bbd8f7c30e4.tmp
41fbc326-ff12-423c-8cae-2e0fc7b42735.tmp
content_new.js
default.dic
ccba5a5986c77e43.customDestinations-ms