Analysis
- user interaction
yes - max time kernel
1799s - max time network
1801s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 21:40
General
- Target http://twitter.com
- Sample260511-1jdbeaaz4s
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
- Drops file in System32 directory 11 IoCs
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs
- Suspicious use of FindShellTrayWindow 60 IoCs
- Suspicious use of SendNotifyMessage 34 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://twitter.com1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x210,0x7ffe8936c188,0x7ffe8936c194,0x7ffe8936c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,10988256530941850241,17706319610652040863,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,11855079615984325647,10911981759529035827,262144 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,17453195392898314751,6094649048787347792,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,11674221327522359764,4458182334230657439,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,4435749993176859077,17820398501934145536,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,13243439191906308707,5159391470544514509,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,6114966582141326484,13888798475935798870,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,5172021172697669310,13936683737270082410,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,1574830574703428177,13235610836567930618,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5116,i,7381091790840523950,11171885604471756848,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,13867866480140164296,3611173866169939060,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1692,i,16470101851293751269,11349069668935423335,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,4576742247519634022,3918754172286261589,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,4576742247519634022,3918754172286261589,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,3933099881826893913,10223926993725553620,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,18333144022523248209,13680401095948237927,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,15645849705317992095,3226766664970703826,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,3482010640318395225,17158366595210187521,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,6325948685605767902,49756835061239180,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,9190076512235376957,11367996186767953141,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,12417543096497847046,3993627314590055788,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,15210477780205035627,13280179909950211945,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,6268468319233139634,10755279903073946849,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,13947355430635781193,10582586998541489086,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,8497624917068403455,3744953026685694429,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,7225897963876904915,900397428450854384,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,4581671649517696757,10063978503614635063,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5596,i,7701219198921600947,9407785323925107464,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,10783991849733752906,12735679474900501574,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,6852796239257667987,1825918366322152237,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7116,i,15374331349548448583,14485006045431329296,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5940,i,10512026010317212096,16470996568254069335,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7384,i,6750402970060222410,13053805867006600938,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7344,i,6467989158812004748,429985781581213752,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7312,i,15370597199873135870,8509908872135775008,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7176,i,12211324837698419874,3162117652035745313,262144 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7188,i,14909798220569122724,720350589942237496,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,10201550179038245497,17370737927000136063,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7868,i,18188701318255452703,16866466154849256668,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,7180492216639004682,12520750012908578573,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7588,i,6538575963938482126,4735869903731237917,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=3988,i,13313556658288406687,929186420380024467,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7632,i,2494243833854428621,6525668758398886281,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7632,i,2494243833854428621,6525668758398886281,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=7344,i,3773152359038666132,13453189412945691980,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7416,i,16831279069723687425,9624681287301516521,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,16841483807977233700,16261201524886518370,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,17358138085802567110,14166467547341598045,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7320,i,17506948358138551015,16054962397467321530,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1352,i,3611331240848960145,8699834003523695807,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=4040,i,339392914600678468,7227873486705029217,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8024,i,684614561998466125,17505884374999468733,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7960 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,5266907171480525688,17371668166838742778,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,13715726260636172504,11734699540357496419,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7384,i,9618063343358966216,9432277720390238722,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7280,i,1794331659383555380,18056989481896699610,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8048,i,18072939639743824007,15669065729705453746,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=8000 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7936,i,9572155941774677621,10450089563661010759,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7432,i,16467018873005993775,6850051540776029673,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8044,i,8128055360484968154,1142503455040912504,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7488,i,10112624735787593913,1800215914177049364,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=8156 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7700,i,6754824681719964811,6304478666925504427,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,1549889105314162376,14049671741918261053,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7288,i,12090110067672063912,15389774392681089186,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1068,i,5869605083633483674,11667166922441882024,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,9757152387788009342,5083240765741422495,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=4328,i,7340567213050708028,13814265556265469050,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=2920,i,13511553097598497020,16602252275064656194,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7968 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=5620,i,16437027400735564135,8866976665022444741,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7872,i,14825332716970413092,11776190257617531707,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,9084242561373267031,6831462639123979738,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7508,i,7627545005258082145,555767785231993676,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7960 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7924,i,11739435427529066763,1946545669356588927,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,16827483423988064443,7802391381325096456,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7624 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,6043615542040877294,3004160419921663337,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7980,i,10067582006213152646,10259846680497055299,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,17751215174557790843,8818531760524136583,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7624 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,226054880701791682,7409321619880774545,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7976,i,9881044894876673218,13106097100287054760,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,11105608396710764840,518435921816320957,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=7352,i,3598420588201432860,16457822900703959616,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=5148,i,6701934270425533071,12503512891753537833,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7940 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7880,i,301909741277344835,15009924823728940830,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,2615099695037726332,18435369506014407982,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,2615099695037726332,18435369506014407982,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=8184,i,12617844613346275095,17291436772477243859,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=8048 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,8678897904601144828,13470786094012324128,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,8678897904601144828,13470786094012324128,524288 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=5556,i,9889074754833754354,12847468804558533446,2097152 --field-trial-handle=2356,i,7695443950190525513,8736650964065435719,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\WIN_20260410_11_18_35_Pro.jpg" /ForceBootstrapPaint3D1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
manifest.json
Staging
manifest.json
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
manifest.json
edge_checkout_page_validator.js
manifest.json
data.txt
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
protocols.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
crl-set
settings.dat
settings.dat
LOG.old
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
f_000082
f_000083
f_000088
f_000096
f_000098
f_000099
f_00009a
f_00009b
f_00009e
f_0000a0
f_0000a1
f_0000a4
f_0000a6
f_0000a7
f_0000a8
f_0000aa
f_0000ac
f_0000ad
f_0000b0
f_0000b2
f_0000b4
f_0000bc
f_0000c3
f_0000c4
f_0000c5
f_0000c9
f_0000ce
f_0000cf
f_0000d0
f_0000d1
f_0000d2
f_0000d3
f_0000d5
f_0000d7
f_0000d8
f_0000d9
f_0000db
f_0000dc
f_0000dd
f_0000de
f_0000e2
f_0000e3
f_0000e4
f_0000e5
f_0000e6
f_0000e7
f_0000ed
f_0000ee
f_0000ef
f_0000f0
f_0000f2
f_000103
f_000104
f_000105
f_000106
f_000107
f_000108
f_00011a
f_00011e
f_00013d
f_00013e
f_000145
f_000148
f_000149
f_00014e
f_000150
f_000151
f_000153
f_000155
f_000156
f_000157
f_000158
f_000159
f_00015a
f_00015b
f_00015c
f_0001c5
f_0001d5
f_0001d6
f_0001d7
f_0001dd
f_0001de
f_0001e2
f_0001e3
f_0001e4
f_0001e5
f_0001e6
f_0001f8
f_0001f9
f_0001fa
f_000205
06355fd5fbac9e06_0
08493dd8cf0bc1df_0
0f08fdee0d7c52b4_0
1167df04a933d58e_0
116cbbceccdb78ed_0
1871b155b4ecaa7a_0
1cd93d8aacfc2e9f_0
1fbb2501bac32c9b_0
25eb276901036c63_0
2629c8a48e362393_0
284bd4cab2786126_0
2f7684e594443cc6_0
306076a0037ab342_0
34b85475d7678497_0
366a0a2fa21eb24d_0
39e5b7e4a7fccd34_0
3d646e327b978d33_0
4201118fd7056e63_0
4239c3bd9acd2852_0
4606b83b6df5c97d_0
48f3832e67f61a19_0
4ce187022b5cadb2_0
5a5e9e673af79d29_0
6a0ded3c57d58e8b_0
6c2b2bd288d6d342_0
6fbd29076e2e554d_0
78d9756dfbbf2de9_0
7a016c727db3af90_0
7c18c2014bd52fe1_0
819229b5a7171411_0
82e51452e4cc92c3_0
8e7433b11d75c23f_0
9a7fc863f42e3312_0
9b7b59937a0aad0c_0
9ce677edcbbac6ea_0
9da14049ee8cc205_0
a0ffbea3fe220143_0
a90751655703c2fa_0
b82e2e58b0ce30d4_0
be042d3d330e9894_0
c29d022894a3d48c_0
c7e7b1d23399354e_0
cb9bb240e50b671c_0
e72b729ecdf02d17_0
eac861d92777f9b6_0
f080cf2baedcfc3f_0
f2e9ea2c6a5d275c_0
ffc3dbc2e1afdb4a_0
temp-index
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
00000000
00000000
00000000
00000000
00000002
00000004
00000006
00000008
00000010
00000012
00000014
00000018
00000020
00000022
HubApps
000003.log
000005.ldb
LOG
LOG
LOG.old
MANIFEST-000001
MANIFEST-000001
000003.log
LOG
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries~RFe5a26c3.TMP
TransportSecurity
TransportSecurity~RFe6aa694.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
040f11e49243b61d_0
04a139df562abfb6_0
04a139df562abfb6_1
09303e245f71e11d_0
09303e245f71e11d_1
095b46367ab49088_0
095b46367ab49088_1
12fd58f3a6ed44f7_0
12fd58f3a6ed44f7_1
205fcfbdb983cd3a_0
205fcfbdb983cd3a_1
26f3d4172e060ff3_0
26f3d4172e060ff3_1
27f27acfb30af1fd_0
27f27acfb30af1fd_1
29e59e735013892c_0
29e59e735013892c_1
3183d89a75986603_0
3183d89a75986603_1
3e7027df0e5c6b9b_0
3e7027df0e5c6b9b_1
3ef081b6e8f31128_0
3ef081b6e8f31128_1
410840682884ae52_0
410840682884ae52_1
46d7aea8bb4be4a1_0
46d7aea8bb4be4a1_1
478ae91ed41b145c_0
478ae91ed41b145c_1
5532370e78aaf6ac_0
5532370e78aaf6ac_1
5bbb35ca6a42157b_0
5bbb35ca6a42157b_1
66f80f89991ce3c0_0
66f80f89991ce3c0_1
688612abca9bf894_0
688612abca9bf894_1
73ef7f5da4fe40ea_0
73ef7f5da4fe40ea_1
76eec926a5029e75_0
76eec926a5029e75_1
7f89e53121a5de82_0
7f89e53121a5de82_1
80ff1193dfe38aea_0
80ff1193dfe38aea_1
8c353b6491c63b35_0
8c353b6491c63b35_1
9632285566d50431_0
9632285566d50431_1
98b71053ba55b2f1_0
98b71053ba55b2f1_1
9b80876d68396a75_0
9b80876d68396a75_1
a2afe32e0e5b96af_0
a2afe32e0e5b96af_1
a563e5cdadbea12c_0
a563e5cdadbea12c_1
b21b35002a8fca9c_0
b21b35002a8fca9c_1
c14ba9386034e03c_0
c14ba9386034e03c_1
c48a91fe735aa12a_0
c48a91fe735aa12a_1
c4bbff8cdb4dc327_0
c4bbff8cdb4dc327_1
d4e736ea71d79649_0
d4e736ea71d79649_1
d679fff785e18b55_0
d679fff785e18b55_1
df738f1c5797e201_0
df738f1c5797e201_1
e0e6825be37cc859_0
e0e6825be37cc859_1
e3ccb69e22ec5e42_0
e3ccb69e22ec5e42_1
e49f1fd345623b31_0
e49f1fd345623b31_1
e776776a94d96167_0
e776776a94d96167_1
f6315868bb1da0d9_0
f6315868bb1da0d9_1
the-real-index
the-real-index
the-real-index~RFe599754.TMP
4f2277ea2139c475_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5a4c4c.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
the-real-index
the-real-index~RFe5b1029.TMP
the-real-index
the-real-index~RFe5aabf1.TMP
index.txt
index.txt
index.txt~RFe5a5c0c.TMP
ba23d8ecda68de77_0
ba23d8ecda68de77_1
the-real-index
the-real-index
the-real-index~RFe59ecd7.TMP
CURRENT
sync_diagnostic.log
MANIFEST-000001
domain_actions.dll
b4fe7175-8468-4554-99c8-dc8a4cbe1fa8.tmp
office_endpoints_list.json
wallet-checkout-eligible-sites.json
wallet-notification-config.json
wallet-stable.json
wallet-tokenization-config.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe59c2aa.TMP
safety_tips.pb
typosquatting_list.pb
Filtering Rules
LICENSE
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
keys.json
typosquatting_list.pb
well_known_domains.dll
nav_config.json
ranked_dicts
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
bd211a78-fb58-4178-859f-a592a6e9bbf2.tmp
fb1b7892-bb8b-4b52-877e-d07c329064b6.tmp
2cbcb1b2-2ea6-45d2-a865-01f910103977.tmp
content_new.js
default.dic
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
MAT-3KGm6xdE.zip
memory/4216-362849-0x000002037CB90000-0x000002037CBA0000-memory.dmp
memory/4216-362853-0x000002037D720000-0x000002037D730000-memory.dmp
memory/4216-362860-0x000002037D820000-0x000002037D821000-memory.dmp
memory/4216-362862-0x000002037D8A0000-0x000002037D8A1000-memory.dmp
memory/4216-362864-0x000002037D8A0000-0x000002037D8A1000-memory.dmp
memory/4216-362865-0x000002037D930000-0x000002037D931000-memory.dmp
memory/4216-362866-0x000002037D930000-0x000002037D931000-memory.dmp
memory/4216-362867-0x000002037D940000-0x000002037D941000-memory.dmp
memory/4216-362868-0x000002037D940000-0x000002037D941000-memory.dmp