Analysis
- user interaction
yes - max time kernel
1799s - max time network
1150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 09:39
General
- Target https://hyperbeam.com/app/
- Sample260503-lmzaqaex91
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 32 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 6 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 18 IoCs
- Modifies data under HKEY_USERS 6 IoCs
- Modifies registry class 26 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://hyperbeam.com/app/1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x280,0x7ffcaabbc188,0x7ffcaabbc194,0x7ffcaabbc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,10677403392443402645,5508960680131563765,524288 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,8419853073839169774,1173458929176641155,262144 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,2596254107636625525,5392603004914081795,524288 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,13088222859657519334,11032632802068014980,2097152 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,10814487658089024974,16952160350752988434,2097152 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,2195037238510530833,14405862911791984548,524288 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,10213874376350811562,15563052788683503445,524288 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,7800707541924437561,15595896801868907624,524288 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,3788372124897029500,12305841657816060905,524288 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11283⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,7800707541924437561,15595896801868907624,524288 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6456,i,8773472914366419551,17822334252888319324,2097152 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,13058394321807787488,10435339648757723265,524288 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,17869753535739754959,11257969105515376500,524288 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,6539075423190058916,13402210829762610962,524288 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,15623637540290742729,681645703573872374,524288 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,12900459778069950604,4530194583125039199,524288 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7032,i,337918390947623162,15575479614625662570,2097152 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,17688173778595617340,7146029269626210813,524288 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=772,i,13092212008808957558,9121596180697592385,2097152 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7596,i,4696559982818080583,18153478766615219498,524288 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7444,i,18063782186019407447,913391144607235994,2097152 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,10996230672046382219,16611475404445259631,524288 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,14176677908978563719,16320298434798652798,524288 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=1996,i,9662948620567004938,2771264754429399585,2097152 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7580,i,10653642544598004174,2139498120864768608,2097152 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=7912 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8092,i,13215883825918705647,14297905773412335939,524288 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=8076 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,3335024101008047985,17825045651171169883,524288 --field-trial-handle=2600,i,2348119075930846676,17802535494075212816,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\Hyperbeam Setup 0.21.0.exe"C:\Users\Admin\Downloads\Hyperbeam Setup 0.21.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Hyperbeam.exe" | %SYSTEMROOT%\System32\find.exe "Hyperbeam.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Hyperbeam.exe"4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\find.exeC:\Windows\System32\find.exe "Hyperbeam.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f0,0x7ffcaabbc188,0x7ffcaabbc194,0x7ffcaabbc1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,12264428443340775811,5953232380122331698,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1504,i,16445747725552608725,2109752710686271589,262144 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,8885349441518657697,12584647656760570134,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,15664261771692109792,11889567085973140691,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,15664261771692109792,11889567085973140691,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5024,i,3407409297853244297,15504300384504589530,2097152 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5032,i,434707105720553339,3556013057542335852,2097152 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,10661850752371162372,14877462242648648159,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,16960763202214436008,14451066190292114881,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,1286256837664239396,13107281460336382393,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6516,i,5810690900503561409,6133028451991398377,2097152 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,9326146382727199007,7861832259465236117,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,9854838761844760729,15883591335334909856,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,8865020359449325713,14672229879680311229,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6740,i,15974463064204495892,6057623428988913864,2097152 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,5128024686908448633,14694132502762681677,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,17075497715985470276,16809740388174904153,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,13020998886949387134,17373627943410751067,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,10274215627418357746,9888017794870754537,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6708,i,6125298894675057546,4923852889390342574,2097152 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,3190516197265769935,18323322708497980378,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,1831722815798003109,9535344922903481173,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2600,i,1242747948110181030,1044355344127167771,262144 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:103⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,6091495396001409406,9969925670883133617,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,13579953066202244671,8148713534400932960,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,1641203812273614055,13848743332274831511,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2708,i,8778856397093159631,3417955500199500259,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4092,i,12409001355390532876,14745438879404887575,524288 --field-trial-handle=2192,i,17536244278922204327,4779025723637137570,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x244,0x248,0x24c,0x240,0x2f0,0x7ffcaabbc188,0x7ffcaabbc194,0x7ffcaabbc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1688,i,10596048753696985075,18033279192148848265,524288 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,8254268244653072314,16359560633831057264,262144 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,12623422769511892396,15074101071039492028,524288 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,6044165739777092024,12333877206390035942,524288 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,6044165739777092024,12333877206390035942,524288 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4832,i,15988736393536522607,14562817812921748128,2097152 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,6688099449968787066,4878439733171441209,524288 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,16182009847787783685,12046387915348808688,524288 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5592,i,14054972952457913238,313663233994400140,2097152 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,15818661145447830852,5916237698487742601,524288 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,6051161849857283170,9681862417378476102,524288 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,13771019596255746087,12775533635865042153,524288 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,11046915554686180491,11382325797351642175,524288 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,5123133331098000289,17293633533139514192,524288 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5880,i,14062937869769833340,8161327071521377565,2097152 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6548,i,1803595660167870827,17945946758023293378,2097152 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,877584980128787348,7643796679706670134,524288 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6964,i,13808182736850656041,8164882709387458483,2097152 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,7867351898403342286,17289838061315262328,524288 --field-trial-handle=2204,i,6369004730904895941,14606713423192123800,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ffcaabbc188,0x7ffcaabbc194,0x7ffcaabbc1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,17772815359852066016,12437289491565754733,524288 --field-trial-handle=2264,i,12378177854181411209,889270384667184648,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,15553050326674826593,9617240073981287348,262144 --field-trial-handle=2264,i,12378177854181411209,889270384667184648,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,17835641437093440539,7220063248548832803,524288 --field-trial-handle=2264,i,12378177854181411209,889270384667184648,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,12483915442806802336,2659555948621525177,524288 --field-trial-handle=2264,i,12378177854181411209,889270384667184648,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,12483915442806802336,2659555948621525177,524288 --field-trial-handle=2264,i,12378177854181411209,889270384667184648,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4836,i,6113595726428048415,14400797232225754918,2097152 --field-trial-handle=2264,i,12378177854181411209,889270384667184648,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,13055400299994675746,12303074515655937569,524288 --field-trial-handle=2264,i,12378177854181411209,889270384667184648,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,15759399832411550568,17968060278997403165,524288 --field-trial-handle=2264,i,12378177854181411209,889270384667184648,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5536,i,6605624420777330896,16599930896760389371,2097152 --field-trial-handle=2264,i,12378177854181411209,889270384667184648,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,16135910860977934382,9848250232788191251,524288 --field-trial-handle=2264,i,12378177854181411209,889270384667184648,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,11783742868291809879,16230886249094534832,524288 --field-trial-handle=2264,i,12378177854181411209,889270384667184648,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,458866779998260686,14726984162598011712,524288 --field-trial-handle=2264,i,12378177854181411209,889270384667184648,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5252,i,7442395670047488110,2980201232183676118,262144 --field-trial-handle=2264,i,12378177854181411209,889270384667184648,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:105⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,8165415756541782202,14607971089672879243,524288 --field-trial-handle=2264,i,12378177854181411209,889270384667184648,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,2026175174378122469,17211442564825717359,524288 --field-trial-handle=2264,i,12378177854181411209,889270384667184648,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,16457309848875061141,17923061818148753570,524288 --field-trial-handle=2264,i,12378177854181411209,889270384667184648,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:145⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Programs\Hyperbeam\Hyperbeam.exe"C:\Users\Admin\AppData\Local\Programs\Hyperbeam\Hyperbeam.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Programs\Hyperbeam\Hyperbeam.exe"C:\Users\Admin\AppData\Local\Programs\Hyperbeam\Hyperbeam.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\hyperbeam" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1684,i,558587423186679701,4733249690105633985,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Hyperbeam\Hyperbeam.exe"C:\Users\Admin\AppData\Local\Programs\Hyperbeam\Hyperbeam.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\hyperbeam" --mojo-platform-channel-handle=1980 --field-trial-handle=1684,i,558587423186679701,4733249690105633985,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Hyperbeam\Hyperbeam.exe"C:\Users\Admin\AppData\Local\Programs\Hyperbeam\Hyperbeam.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hyperbeam" --app-path="C:\Users\Admin\AppData\Local\Programs\Hyperbeam\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2212 --field-trial-handle=1684,i,558587423186679701,4733249690105633985,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Hyperbeam\Hyperbeam.exe"C:\Users\Admin\AppData\Local\Programs\Hyperbeam\Hyperbeam.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\hyperbeam" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1540 --field-trial-handle=1684,i,558587423186679701,4733249690105633985,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc969dc728,0x7ffc969dc734,0x7ffc969dc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,18208424992867783557,18222422070313625604,524288 --field-trial-handle=2076,i,6567579008298987916,78052046054787164,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2100 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,12248541954370048205,18046300982511341957,262144 --field-trial-handle=2076,i,6567579008298987916,78052046054787164,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2060 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,9380512131065265078,3988767954162407809,524288 --field-trial-handle=2076,i,6567579008298987916,78052046054787164,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2360 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,12661997681343924610,3460694551182203604,2097152 --field-trial-handle=2076,i,6567579008298987916,78052046054787164,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3232 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,8604391161865262455,11850139839362646223,2097152 --field-trial-handle=2076,i,6567579008298987916,78052046054787164,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3276 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4204,i,7983660326660883600,12169982889306694628,2097152 --field-trial-handle=2076,i,6567579008298987916,78052046054787164,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4208 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4668,i,4197066532283903085,3086078488247846254,2097152 --field-trial-handle=2076,i,6567579008298987916,78052046054787164,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4600 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Programs\Hyperbeam\Hyperbeam.exe"C:\Users\Admin\AppData\Local\Programs\Hyperbeam\Hyperbeam.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Programs\Hyperbeam\Hyperbeam.exe"C:\Users\Admin\AppData\Local\Programs\Hyperbeam\Hyperbeam.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\hyperbeam" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1668,i,2980122066297066089,11120553953980155164,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Hyperbeam\Hyperbeam.exe"C:\Users\Admin\AppData\Local\Programs\Hyperbeam\Hyperbeam.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\hyperbeam" --mojo-platform-channel-handle=1964 --field-trial-handle=1668,i,2980122066297066089,11120553953980155164,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Hyperbeam\Hyperbeam.exe"C:\Users\Admin\AppData\Local\Programs\Hyperbeam\Hyperbeam.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hyperbeam" --app-path="C:\Users\Admin\AppData\Local\Programs\Hyperbeam\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2300 --field-trial-handle=1668,i,2980122066297066089,11120553953980155164,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc969dc728,0x7ffc969dc734,0x7ffc969dc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1736,i,15289618577516878392,12199015480930321369,524288 --field-trial-handle=2036,i,5889414242727373865,5266332768947791598,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2060 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1568,i,2553078886538208391,10695003955784684744,262144 --field-trial-handle=2036,i,5889414242727373865,5266332768947791598,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2032 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,17545245676711603058,15320209746205741597,524288 --field-trial-handle=2036,i,5889414242727373865,5266332768947791598,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2336 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,1579744680598384770,8854619836745934281,2097152 --field-trial-handle=2036,i,5889414242727373865,5266332768947791598,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3380 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3348,i,18186278107261414519,4010798532819190872,2097152 --field-trial-handle=2036,i,5889414242727373865,5266332768947791598,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3404 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4412,i,11239202116618301482,6404043139127176759,2097152 --field-trial-handle=2036,i,5889414242727373865,5266332768947791598,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4568 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5220,i,10918336259936057425,2031189389705822117,524288 --field-trial-handle=2036,i,5889414242727373865,5266332768947791598,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5128 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2ad7375b-500a-43ad-882e-c0d52c0a4d01.tmp
settings.dat
BrowsingTopicsState
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe59dce9.TMP
Local State
Local State
edge_autofill_global_block_list.json
v1FieldTypes.json
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
43989e62-51b3-420a-92fb-ee8bdb783cd3.tmp
LOG.old
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000073
f_0000d6
f_0000d7
f_0000d8
f_0000d9
f_0000db
f_0000f1
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58461c.TMP
SiteList-Enterprise.json
000003.log
LOG
dasherSettingSchema.json
Favicons
History
HubApps
000003.log
LOG
000003.log
LOG
Login Data
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
00213d1f3f31c3d3_0
049c89f8d5851a99_0
088b2b54e4056910_0
089013f17a74494e_0
0e05e6cb3312637f_0
0f1fdfccb1e2a2b2_0
1326e6f321ccf4b1_0
186f3ee5594e4e8b_0
27ceed6a91e57ac0_0
341a6098f0630805_0
354b7b577562a988_0
372233c46ab52fef_0
3b4b5e1faf97df78_0
3d27b2ba10afb7e0_0
3d297aeeb4ef40fa_0
3fd53f87f56a0cdb_0
4c3efceb7cfdb2db_0
4e3d1b31f95f768b_0
51e3dc8353bfb5f5_0
588a687d51d0d3af_0
58991c4241398987_0
5c83732c6610a19e_0
5f3f9834f2819e74_0
69d08a96d47b92d7_0
6cdca9a8aecb12f9_0
6dd6af37377aab76_0
76c5bcc172fd2a3b_0
7b08e4468aaaeb96_0
7eec8f666bf92b44_0
8141ecbb21b27212_0
8612a8df51687026_0
88e2f9553b24de92_0
8ac59b48181ade28_0
8b8f94ae6deae97c_0
8c2a2025739b6f24_0
925fa498b6be94aa_0
936c78959aa7a4d7_0
95066c23ab335e63_0
959ff09b4852be83_0
95f6cf4548edb63e_0
9f5f917f4feef49f_0
a0b1f6fa16a81bbc_0
a4f547ebeb80a55e_0
a5be58b752356dc7_0
a784fb8ca33e38dc_0
afeb823b2865ad21_0
b0820ed059bc372a_0
b2dfd7b4ac0adf6b_0
b721ee62be09bf7b_0
b736aaae01148746_0
be069b1e02f783a9_0
be109ac6ebd43ecf_0
c27208d5ed8e322e_0
c6208bd810d6d198_0
c74852023efcada5_0
cb5a9fa22a59c43e_0
cd909cbdb7f331b8_0
ce279bdd2b7a8de2_0
d046046887ff1195_0
d376e623094296dc_0
d3d8248ecad5e734_0
d55137f103923b11_0
d575c4aa49fadac9_0
d8bd3fbde7f1df37_0
d9f1cd437e29c51b_0
e3f19b1d5e15a143_0
e8bbc4f127292a22_0
e9ff55fe8de42e8a_0
f17fdda3f38dd91f_0
f30bf08f678f1b9b_0
f4638ab983d0ccb6_0
f46af92cdb5e3bfa_0
f5a2a93cf9fa8924_0
f5dcefbe795fa990_0
fb6de0275e31526d_0
fc45423f6cbf169f_0
fd21dc6c3def079e_0
fe06c96747b53bfc_0
ffb17e377784db44_0
the-real-index
the-real-index~RFe5e5532.TMP
the-real-index
the-real-index~RFe5e17fa.TMP
the-real-index
the-real-index~RFe584774.TMP
the-real-index
the-real-index~RFe5e1f1f.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe5847a3.TMP
index.txt~RFe5e5532.TMP
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe589ecb.TMP
the-real-index~RFe5d75b0.TMP
the-real-index~RFe5eaa09.TMP
the-real-index
the-real-index
the-real-index
the-real-index~RFe58abbc.TMP
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58a3ad.TMP
the-real-index~RFe5d7998.TMP
the-real-index
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
000003.log
LOG
the-real-index
the-real-index
the-real-index
000003.log
LOG
LOG
sync_diagnostic.log
CURRENT
MANIFEST-000001
default_cloud_config.json
domain_actions.dll
data.txt
wallet-checkout-eligible-sites.json
wallet-notification-config.json
wallet-stable.json
wallet-tokenization-config.json
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
campaign_history
crs.pb
ct_config.pb
kp_pinslist.pb
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe587f0e.TMP
data_1
Filtering Rules
LICENSE
typosquatting_list.pb
Variations
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
SearchHoverUnifiedTileModelCache.dat
LICENSES.chromium.html
chrome_100_percent.pak
380429bf-bf11-4aa7-8c49-35f1275cb44c.tmp.node
LICENSE.electron.txt
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
en-GB.pak
en-US.pak
es-419.pak
es.pak
resources.pak
app-update.yml
app.asar
1024x1024.png
128x128.png
16x16.png
24x24.png
256x256.png
32x32.png
48x48.png
512x512.png
64x64.png
icon.ico
elevate.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
SpiderBanner.dll
StdUtils.dll
System.dll
WinShell.dll
nsExec.dll
nsis7z.dll
default.dic
f_000001
f_000002
f_000003
f_000005
f_000009
f_00000a
f_00000b
f_00000d
f_00000e
f_00000f
the-real-index
the-real-index
the-real-index
data_0
data_2
data_3
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State~RFe5ab884.TMP
TransportSecurity
TransportSecurity~RFe5b68b9.TMP
Preferences
Preferences~RFe59cf5c.TMP
index
the-real-index
the-real-index~RFe5a06d7.TMP
the-real-index
the-real-index~RFe5d6b6f.TMP
index.txt
index.txt
index.txt
index.txt~RFe5a0725.TMP
the-real-index
the-real-index~RFe59faa2.TMP
Hyperbeam Setup 0.21.0.exe:Zone.Identifier
autofill_bypass_cache_forms.json
manifest.json
edge_checkout_page_validator.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
LICENSE
manifest.json
keys.json
manifest.json
manifest.json
memory/1772-5351-0x000001FA12FC0000-0x000001FA12FC9000-memory.dmp
memory/1872-4986-0x0000018266510000-0x0000018266519000-memory.dmp
memory/1872-3215-0x0000018266510000-0x0000018266519000-memory.dmp
memory/3256-4974-0x0000024D1C1E0000-0x0000024D1C1E9000-memory.dmp
memory/3256-3216-0x0000024D1C1E0000-0x0000024D1C1E9000-memory.dmp
memory/3560-3557-0x000001ECEF800000-0x000001ECEF8AE000-memory.dmp
memory/3560-2828-0x00007FFCC9750000-0x00007FFCC9751000-memory.dmp
memory/3560-2827-0x00007FFCC8FD0000-0x00007FFCC8FD1000-memory.dmp
memory/3560-3227-0x000001ECEF800000-0x000001ECEF8AE000-memory.dmp
memory/3956-3893-0x000001BF30060000-0x000001BF30061000-memory.dmp
memory/3956-3882-0x000001BF30060000-0x000001BF30061000-memory.dmp
memory/3956-3883-0x000001BF30060000-0x000001BF30061000-memory.dmp
memory/3956-3889-0x000001BF30060000-0x000001BF30061000-memory.dmp
memory/3956-3891-0x000001BF30060000-0x000001BF30061000-memory.dmp
memory/3956-3884-0x000001BF30060000-0x000001BF30061000-memory.dmp
memory/3956-3894-0x000001BF30060000-0x000001BF30061000-memory.dmp
memory/3956-3892-0x000001BF30060000-0x000001BF30061000-memory.dmp
memory/3956-3888-0x000001BF30060000-0x000001BF30061000-memory.dmp
memory/3956-3890-0x000001BF30060000-0x000001BF30061000-memory.dmp
memory/4904-5355-0x0000021783570000-0x0000021783579000-memory.dmp
memory/5088-2293-0x0000000000E80000-0x0000000000F5F000-memory.dmp
memory/5168-2806-0x00007FFCC8950000-0x00007FFCC8951000-memory.dmp
memory/5468-2914-0x0000000000CD0000-0x0000000000DAF000-memory.dmp
memory/5640-5354-0x000002721E970000-0x000002721EA1E000-memory.dmp
memory/5888-149-0x000002544C000000-0x000002544C3BB000-memory.dmp