Analysis
- user interaction
yes - max time kernel
1049s - max time network
1049s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
23/06/2026, 03:04
General
- Target ConsoleApplication1.exe
- Size 593KB
- Sample260623-dk5eysat9y
- SHA256 c23b03012f2033ad4553a115b837c9a349197e07f8fe5493386fcfb13a9eebe1
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 3 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
- Executes dropped EXE 20 IoCs
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 6 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- Suspicious use of SetThreadContext 5 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 33 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 7 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 17 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 12 IoCs
- Modifies data under HKEY_USERS 22 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: LoadsDriver 5 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 24 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ConsoleApplication1.exe"C:\Users\Admin\AppData\Local\Temp\ConsoleApplication1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\DisconnectAdd.htm1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffc3c01c188,0x7ffc3c01c194,0x7ffc3c01c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,4888252841835006469,3537043518535761855,524288 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,9814326935007090294,6166487626159421344,262144 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,17213164189981592070,16454964616171682124,524288 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,14676476929662830227,15874846455171074328,2097152 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,7946369132495901163,4991210563888545092,2097152 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,4605054251491976062,3448666116203957371,524288 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,10346361582887304225,8047517629191557988,524288 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,7292764232180960833,16865746251696384002,524288 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,7292764232180960833,16865746251696384002,524288 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6364,i,5644431608229992720,17242838633631628640,2097152 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6592,i,1503303587967937360,12712476256616586545,2097152 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6524,i,9823571559137893836,8435429398436005377,2097152 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6404,i,15233662849386689680,14657249555543706239,2097152 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6360,i,12456804356061625161,552508726834300166,2097152 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6436,i,4409446450313109026,14633866417571222491,2097152 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3924,i,2577972504187552421,11273336917059304306,2097152 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5076,i,4611853275083860738,11465224952421242195,2097152 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5044,i,3315952357863958886,16844218417134544065,2097152 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1400,i,7639475527927980312,2304605414750880536,524288 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1420,i,5902323300648350001,10476916421139456527,524288 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1428,i,6841541050674466163,844940061366960869,524288 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,10898072708699677005,15159084377033585296,524288 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6708,i,15516951960252500412,13008361953066670795,2097152 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,16027085694800994878,16337079043272606468,524288 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6808,i,10870014607928236901,11787396366344309744,2097152 --field-trial-handle=2380,i,2568979606663383159,4910716086996810476,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffc3c01c188,0x7ffc3c01c194,0x7ffc3c01c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,16440883161090959622,14377224451715895112,262144 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,6771529921206059118,12483019946280010424,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:113⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,17020189558464854337,10146233580998028464,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,7258196184162435428,11923689833153680368,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,7258196184162435428,11923689833153680368,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,15022769094350236966,14243940663431314981,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,8256509085700091352,10550202350022554434,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,2487026538852666563,2730026198471365553,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,17065082222035694724,5271679034374626412,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,14058595844724677222,11832251113279417067,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=840 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=836,i,8695768798412709113,18307787900943770438,262144 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:103⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,17382697099811220691,17844885312115508705,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,5492166510793570655,17276309633276985403,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4988,i,17085236839210059197,3421096674829756128,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=1112,i,8793023873294902483,14404928078448459846,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,5898306847647950206,14337345328114316317,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,17674822484759415275,3718951651218129333,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6096,i,8207832878734811526,2003430032604338847,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6380,i,12075439887909358709,2258574292773551692,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6560,i,7365330284508040210,3578884719315982257,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6316,i,1132259610275907799,14145709096104783463,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6320,i,1219222251598448612,396837148250764941,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5300,i,16579027898660947413,16408376616643005258,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6536,i,16460485432357864419,15024263672100349360,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7260,i,15264292781248140631,14417316929253031385,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7384,i,2155859289790832581,17291127110555497495,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,920892329089138864,8740140664924553715,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7272,i,5552947577345536916,2974353748664793987,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,12076500678377954311,16295920010872674974,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,13680075384426274551,11830974535685432989,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,8804077756261681821,7466400047766867548,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5632,i,773273583684232222,5672692626769646581,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6132,i,2193091735991877829,8832769035433217137,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6836,i,5871174300353506559,3087724415517715870,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,8021753165717538619,6140941344429408809,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7468,i,3276061785826802758,12050799472014078540,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7420,i,6574587627102152163,10280570242950843709,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5428,i,14163250817412453832,16771667046795878057,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=6596,i,7713414079733478200,17661861968351071059,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7576,i,14286974679035638021,3843033897071140818,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7504,i,68751498786033003,1926539688458820435,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,1743369189225040380,15851993092331385600,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7684,i,16029581004209871433,1934806620770514617,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7912,i,12528280487512775715,13034259114300494852,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7668,i,2812555634522411952,1837376529849523135,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7888,i,5636363883600569783,967877066895927336,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7048,i,88186465308052173,14419960962759130227,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=7872,i,16643381711563027314,14647930335366618509,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=7904,i,12551179829597406605,9408435728616939304,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8052,i,13531915520878507521,4218135558957644810,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=8048 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8036,i,7503052003863088173,12535700943847083480,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=6936,i,8970587276544552537,1711281102470302089,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=7368,i,5359862152391659050,4525067651895247786,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=8036 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8108,i,6740925744328060341,2267082279481202580,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=8000 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,3602223228952921662,5760530806787262694,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8272,i,13609024326285308570,15684560417895655414,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8440,i,11761293590445244379,5462228170631869434,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=5768,i,11787847731379611119,544560172708625633,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=7068,i,13514631455530992969,14028587461361230317,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=8324 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=7456,i,17203610394606431892,7191443899447055645,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8628,i,10153754287287723459,4388024460103430890,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=8380 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=7220,i,13160537328418903191,3214513756382516599,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=8672 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8956,i,10175695925947913605,4119886955813082230,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=8948 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=8444,i,5981662089287043302,14263377709932484085,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9356,i,2749410326188079976,1387958317095431947,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=8960 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,17594169477453259965,495867646762254874,524288 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=6304,i,12020760403334148847,5060232383603143967,2097152 --field-trial-handle=2204,i,3626976973185832850,1100013019829609977,262144 --variations-seed-version --mojo-platform-channel-handle=9196 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffc3c01c188,0x7ffc3c01c194,0x7ffc3c01c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,729018701175856985,16960090940635579600,262144 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,118887971767557711,10655278663518904017,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:114⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,5635229257726430008,16049639305439407329,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,12870344112212076491,8007465737539857399,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,12870344112212076491,8007465737539857399,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5092,i,10129420350703882983,10367826228739374182,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5096,i,14744785299762265173,17453929741427584823,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,9355721331366698122,9850030269386106568,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,12771483164679691282,10977386545450426611,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,3805645533116631952,10870255452570203110,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,11449679397422172355,6345858516565901698,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,5685610407475582284,11470174194388508274,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6280,i,2962728943136707625,12086752597254790617,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5568,i,9243553369338014644,14518018908662171779,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6412,i,6531391037673648732,3040687345645425891,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6284,i,9197929246538227247,8096067662579968767,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6776,i,765912080094553474,11987452656886584088,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6724,i,2922698251346531707,10813444917153763747,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6928,i,15316370780630888838,14033059594859101852,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6848,i,7239880430272462336,7954107154235781791,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6840,i,14687237161205202056,16460937969469703484,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,1925480896462709638,4292206100881475438,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6640,i,10004284831787317882,8948693969844315783,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7096,i,1541091431383467433,1766752914347950874,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7036,i,8069000469929156623,3952622017147628498,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,50294387197695463,13213635764897957785,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6672,i,210337305527000363,6849337082086150597,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,9639274221443947341,8577941690057051934,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6396,i,1849861729295110490,109529557593338882,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6816,i,16552748454481234398,12403798836301334623,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6892,i,751566914406844445,17544995364485258045,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6732,i,6325346420893682867,1172860573393876732,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7264,i,3902689018637953874,7359583380173867347,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6420,i,5681913985742862593,8469936400267431443,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6936,i,3240636556043580650,7641554806904121127,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7888,i,8790427387544544905,2047376882472716400,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7860,i,14277753809744183082,8745622182722786004,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7028,i,1472341846545177379,3401544790978685379,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8256 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8280,i,2071134383913770147,12349941165337844971,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8284 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7908,i,1722639205661350172,11057886945613127117,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=6628,i,2782410782447133905,3875550439914001784,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7884,i,3587546578950205129,15781715204889638768,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8480 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8456,i,15581298403101714422,15610835543535909565,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8344 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8280,i,16482868470726294553,12556915906556542123,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7932,i,3500868205339969695,10392311214307464372,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8288 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8580,i,11533852604933362521,4103335253217054208,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8544 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8720,i,14699287378879212520,17716399532005495021,262144 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8724 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=6896,i,6169836597987358805,4219437734061032116,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8648 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7944,i,17919252401963733401,1452682560967168106,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8596,i,1827792894677871343,5676758409284511020,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8852,i,15171602908782415123,6169652805813941636,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8472,i,4641750894834237832,5532407505346854153,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8716 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=6296,i,10942655286201983191,15730978839877538691,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=5584,i,6037940037509738907,1928126457200045700,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8140,i,7348696990685620971,4963863339035975716,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8056 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8068,i,6187713658902290150,2153762276967029462,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8724 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,12620517494117304189,6774682865640625901,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8600 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=5772,i,15273970404090491238,1584150967294690655,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=5572,i,6375624757955750510,2304858546570645913,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8636,i,17231402115892063702,2467377751422412334,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8392 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=3780,i,2112131571772561667,2573367124418773030,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=6664,i,5375327836626927308,14155955546186016023,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=5828,i,13729457449946931681,7018183876740109396,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8908 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7544,i,13194101299900872341,5414056083502975362,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:124⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9032,i,13068756617178334803,708405071638845560,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=8892,i,11898116535389812928,15299052422117668313,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=8932,i,9520864004944612676,8323141578409575336,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8876 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=8972,i,11763743714516712267,7752493327357230517,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=9092 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=8648,i,4565442535207600140,10221053222934505854,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8964 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=3628,i,8366714783975433949,2726469580553316182,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=8648,i,2513265876030175669,5821506377926131885,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=9756,i,883215425200622315,17074179598047694318,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=9636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=8064,i,8964933692065510556,7303934687038893206,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=9068 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=9884,i,7443170433793294251,13240318522090991162,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=9616 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,12491845667064531461,3685110360002992410,524288 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=9768 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=5676,i,13102107956722852817,7140463784055783792,2097152 --field-trial-handle=2356,i,12185733480680965768,15557858339196471602,262144 --variations-seed-version --mojo-platform-channel-handle=9632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffc3c01c188,0x7ffc3c01c194,0x7ffc3c01c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,8146776247291367103,11528303188287826747,524288 --field-trial-handle=2520,i,10044523293072099876,17631370734743063234,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,1515481495620279058,5042010089421141179,262144 --field-trial-handle=2520,i,10044523293072099876,17631370734743063234,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,14450085019516942268,13882366528138902839,524288 --field-trial-handle=2520,i,10044523293072099876,17631370734743063234,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,2199636972797631150,6664614631975664438,524288 --field-trial-handle=2520,i,10044523293072099876,17631370734743063234,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,2199636972797631150,6664614631975664438,524288 --field-trial-handle=2520,i,10044523293072099876,17631370734743063234,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,4367643955199397828,13922205965327453991,524288 --field-trial-handle=2520,i,10044523293072099876,17631370734743063234,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,9661431309327748531,9653835297781691041,524288 --field-trial-handle=2520,i,10044523293072099876,17631370734743063234,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,6968688979459614773,1104889277546782920,524288 --field-trial-handle=2520,i,10044523293072099876,17631370734743063234,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4360,i,9200773222627878131,7768920369911737178,262144 --field-trial-handle=2520,i,10044523293072099876,17631370734743063234,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:105⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,1891506190079636567,2081807767235662333,524288 --field-trial-handle=2520,i,10044523293072099876,17631370734743063234,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:145⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\Desktop\snapshot_2026-05-27_12-11\release\x96dbg.exe"C:\Users\Admin\Desktop\snapshot_2026-05-27_12-11\release\x96dbg.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\snapshot_2026-05-27_12-11\release\x96dbg.exe"C:\Users\Admin\Desktop\snapshot_2026-05-27_12-11\release\x96dbg.exe" ::install2⤵
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Users\Admin\Desktop\ConsoleApplication1.exe"C:\Users\Admin\Desktop\ConsoleApplication1.exe" C:\Users\Admin\Desktop\x64dbg.lnk1⤵
-
C:\Users\Admin\Desktop\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe"C:\Users\Admin\Desktop\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe" C:\Users\Admin\Desktop\ConsoleApplication1.exe1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\ConsoleApplication1.exe"C:\Users\Admin\Desktop\ConsoleApplication1.exe"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\DisconnectAdd.htm1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\ida-freeware_softradar-com.exe"C:\Users\Admin\Desktop\ida-freeware_softradar-com.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-0HPLQ.tmp\is-6V7R0.tmp"C:\Users\Admin\AppData\Local\Temp\is-0HPLQ.tmp\is-6V7R0.tmp" /SL4 $E02FA "C:\Users\Admin\Desktop\ida-freeware_softradar-com.exe" 23955586 491522⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\IDA Demo 5.1\idag.exe"C:\Program Files (x86)\IDA Demo 5.1\idag.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\IDA Demo 5.1\idag.exe"C:\Program Files (x86)\IDA Demo 5.1\idag.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\DisconnectAdd.htm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Users\Admin\Desktop\idademo51.exe"C:\Users\Admin\Desktop\idademo51.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-GS29O.tmp\is-L0CUS.tmp"C:\Users\Admin\AppData\Local\Temp\is-GS29O.tmp\is-L0CUS.tmp" /SL4 $D02FC "C:\Users\Admin\Desktop\idademo51.exe" 23955586 491522⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\IDA Demo 5.1\idag.exe"C:\Program Files (x86)\IDA Demo 5.1\idag.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\Desktop\binaryninja_free_win64.exe"C:\Users\Admin\Desktop\binaryninja_free_win64.exe"1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Programs\Vector35\BinaryNinja\vc_redist.x64.14.34.exeC:\Users\Admin\AppData\Local\Programs\Vector35\BinaryNinja\vc_redist.x64.14.34.exe /install /quiet /norestart2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{704F780F-B554-4065-AADF-80B305562067}\.cr\vc_redist.x64.14.34.exe"C:\Windows\Temp\{704F780F-B554-4065-AADF-80B305562067}\.cr\vc_redist.x64.14.34.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Programs\Vector35\BinaryNinja\vc_redist.x64.14.34.exe" -burn.filehandle.attached=728 -burn.filehandle.self=732 /install /quiet /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{3D4499C0-7FF5-4B84-8194-C7FA8688B2C8}\.be\VC_redist.x64.exe"C:\Windows\Temp\{3D4499C0-7FF5-4B84-8194-C7FA8688B2C8}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{6630F4B5-877B-416F-931E-D5309F69BF77} {CE73747E-C3B3-47FF-960B-AE5A50F0B52C} 56164⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d4cecf3b-b68f-4995-8840-52ea0fab646e} -burn.filehandle.self=1164 -burn.embedded BurnPipe.{DBD8518E-9F56-4AC6-B8E7-A997CDBBE911} {04E74D43-43B8-4CB1-85D0-DC0CBD7E6D15} 6085⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d4cecf3b-b68f-4995-8840-52ea0fab646e} -burn.filehandle.self=1164 -burn.embedded BurnPipe.{DBD8518E-9F56-4AC6-B8E7-A997CDBBE911} {04E74D43-43B8-4CB1-85D0-DC0CBD7E6D15} 6086⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Vector35\BinaryNinja\vc_redist.x86.14.34.exeC:\Users\Admin\AppData\Local\Programs\Vector35\BinaryNinja\vc_redist.x86.14.34.exe /install /quiet /norestart2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{8E66C57B-0963-4807-B3AA-45E03AA2C549}\.cr\vc_redist.x86.14.34.exe"C:\Windows\Temp\{8E66C57B-0963-4807-B3AA-45E03AA2C549}\.cr\vc_redist.x86.14.34.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Programs\Vector35\BinaryNinja\vc_redist.x86.14.34.exe" -burn.filehandle.attached=592 -burn.filehandle.self=600 /install /quiet /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{7D111AAF-35CF-4203-8667-3A5755A06F43}\.be\VC_redist.x86.exe"C:\Windows\Temp\{7D111AAF-35CF-4203-8667-3A5755A06F43}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{7D9283F9-D0C1-45A5-8EFA-E7C0FAB89399} {34A9A719-6EDA-42DB-9D18-ED002F5D3491} 35964⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={4f84f2dc-3f70-433a-8f50-8293e0089b0f} -burn.filehandle.self=1132 -burn.embedded BurnPipe.{9BC3EF1F-B8A4-4D11-947C-105CFA35958C} {1D8E29CF-E772-41E6-9D0C-41D7FA418820} 60605⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={4f84f2dc-3f70-433a-8f50-8293e0089b0f} -burn.filehandle.self=1132 -burn.embedded BurnPipe.{9BC3EF1F-B8A4-4D11-947C-105CFA35958C} {1D8E29CF-E772-41E6-9D0C-41D7FA418820} 60606⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{1AC8B988-F34B-4717-912B-2EC41E0D114F} {DE55ECB8-B645-429A-8F3F-8AA4488AF89D} 19847⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Package Cache\{d4cecf3b-b68f-4995-8840-52ea0fab646e}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d4cecf3b-b68f-4995-8840-52ea0fab646e}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{d4cecf3b-b68f-4995-8840-52ea0fab646e}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d4cecf3b-b68f-4995-8840-52ea0fab646e}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260623041943.log" /install2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{d4cecf3b-b68f-4995-8840-52ea0fab646e}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d4cecf3b-b68f-4995-8840-52ea0fab646e}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d4cecf3b-b68f-4995-8840-52ea0fab646e}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260623041943.log" /install3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{d4cecf3b-b68f-4995-8840-52ea0fab646e}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d4cecf3b-b68f-4995-8840-52ea0fab646e}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{973F3E84-7241-4705-B2A0-04CA430F0215} {6B06474D-7F3D-4AC1-8BCA-85ADDFD777E1} 58644⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d4cecf3b-b68f-4995-8840-52ea0fab646e} -burn.filehandle.self=1016 -burn.embedded BurnPipe.{2D6D15BB-19B1-4840-AC98-26049D3E2333} {BF7954B9-2A2F-410C-BD15-850C942312FC} 37525⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d4cecf3b-b68f-4995-8840-52ea0fab646e} -burn.filehandle.self=1016 -burn.embedded BurnPipe.{2D6D15BB-19B1-4840-AC98-26049D3E2333} {BF7954B9-2A2F-410C-BD15-850C942312FC} 37526⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{E70B7EEB-CDD6-4AC8-9369-2CC3D833F022} {5A6D9DD9-978E-4E9C-BE97-40786EBE82D5} 39007⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
-
-
-
C:\ProgramData\Package Cache\{4f84f2dc-3f70-433a-8f50-8293e0089b0f}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4f84f2dc-3f70-433a-8f50-8293e0089b0f}\VC_redist.x86.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4f84f2dc-3f70-433a-8f50-8293e0089b0f}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4f84f2dc-3f70-433a-8f50-8293e0089b0f}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260623042002.log" /install2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4f84f2dc-3f70-433a-8f50-8293e0089b0f}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4f84f2dc-3f70-433a-8f50-8293e0089b0f}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4f84f2dc-3f70-433a-8f50-8293e0089b0f}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=584 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260623042002.log" /install3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4f84f2dc-3f70-433a-8f50-8293e0089b0f}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4f84f2dc-3f70-433a-8f50-8293e0089b0f}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{EEE5BE33-CE33-4144-A237-6818321AA930} {94AE3206-A3CB-44CB-901D-5FE8B3122732} 12404⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Vector35\BinaryNinja\binaryninja.exe"C:\Users\Admin\AppData\Local\Programs\Vector35\BinaryNinja\binaryninja.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
e661326.rbs
e661332.rbs
e661339.rbs
e661348.rbs
e66134f.rbs
e661354.rbs
e661361.rbs
e661370.rbs
idag.exe
idahelp.chm
is-M159P.tmp
is-QK6EN.tmp
vc32rtf.sig
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
35eea332-8980-4e8b-aafd-cd170a4b385c.tmp
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
data_0
data_1
data_2
data_3
f_00008d
f_0000be
f_0000c0
f_0000c4
f_0000c5
f_0000ca
f_0000cf
f_0000d0
f_0000d2
f_0000d4
f_0000d8
f_0000db
f_0000dd
f_0000e3
f_0000e6
f_0000ea
f_0000ed
f_000172
f_000173
f_000177
f_00017d
f_00019e
f_0001a7
f_0001a8
f_0001ae
f_0001af
f_0001bf
f_0001c7
f_00027f
f_000295
f_0002a8
f_0002a9
01805c70faf7f8c5_0
09c3692ef2ad76cf_0
0e56a543b666e482_0
0eb1763f04b21312_0
0f6a58ec10105e6f_0
11164e41198b99b0_0
14ff8116b518ca2d_0
1d0aa42226a1112a_0
1f1c4bba1674fa36_0
1f974568b3b7eb41_0
25c90b4fb1c6ef85_0
2692617678c042d9_0
2f4680e8f8f8a14f_0
39a5e623cac641bd_0
4036892574e9e41e_0
42a6ce50b3ee58cd_0
45a16ff6d0d9ab5f_0
4e9b18b0f66a7183_0
51438acbcfff1bda_0
53ac5abc87e80789_0
5a46500467f55f18_0
61a0b4d20ae0e222_0
62630ccb9735e330_0
67fa50d7bedc5c56_0
6854e3962701a5e2_0
688a4b4b23c2152a_0
69a25a89e58d653c_0
6a5e8bb53a565b9f_0
6adaaccfc08d2f50_0
6ba0e3d0409c5a0f_0
74b88724f60b0383_0
79f864c88e4ed4d1_0
7a088aff44aed23c_0
7e044207414e80a6_0
8baa13f7b32fb253_0
90d7d7591a1b39bb_0
92ea216a4e512cc9_0
96bc766215a93e35_0
9959e8b2faa60944_0
9dbb949d27873cbc_0
a067705c689d7daf_0
a8491f153f9a8de0_0
ad6d2ce4518bdf54_0
af2cfcaf6d9b18bc_0
bc792bbef26beb2f_0
be538164e9eb3903_0
ce6c2c9436987e9e_0
cf7fbfb668f94100_0
d0fa80d4db2d38ea_0
d5c89a89e21b0363_0
d79e0a2891fc014a_0
dd90e7e5e8d29829_0
de8842b625efa9e1_0
deb11b8c706c3aed_0
def9f74cd64f120a_0
e6e93144ebbfec47_0
e8c8218aef51a783_0
e9c7e700cc3e33cf_0
ed2bce91487b3a82_0
eea5227499d35f2d_0
f2e1232ad889ddd8_0
f2e4bbad99a372cc_0
f5345f974401453e_0
f76d59b7c22901f5_0
f7b7a0c3aa8120df_0
f8d5c521b777b0e2_0
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe59cd2a.TMP
SiteList-Enterprise.json
LOG
LOG
Favicons
data_0
data_1
History
HubApps
000003.log
CURRENT
LOG
MANIFEST-000001
000003.log
LOG
Cookies
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
TransportSecurity
TransportSecurity
TransportSecurity
bf926d15-7ee6-4574-930d-cc33d0cb4ec1.tmp
d8ccfbc5-03ee-47ea-90e4-6f0ba3a5f766.tmp
fb6f3dcd-e460-4175-ae02-6aeebbd67a34.tmp
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index~RFe632e59.TMP
index.txt
index.txt~RFe632e88.TMP
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5f214c.TMP
4f2277ea2139c475_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5fd8c5.TMP
index.txt
index.txt
index.txt
index.txt.tmp
LOG
ba23d8ecda68de77_0
ba23d8ecda68de77_1
the-real-index
the-real-index
the-real-index~RFe5f73c2.TMP
000003.log
LOG
LOG
sync_diagnostic.log
Web Data
index.txt
index.txt~RFe616b2d.TMP
default_cloud_config.json
000003.log
LOG
000003.log
LOG
data_1
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
campaign_history
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe599a13.TMP
data_1
Ruleset Data
Variations
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
Uninstall.exe
banner.bmp
mac-x86.c
vxworks-ppc32.c
is-L0CUS.tmp
_shfoldr.dll
default.exc
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
e661333.msi
miniwallet.bundle.js.LICENSE.txt
notification.bundle.js.LICENSE.txt
strings.json
Staging
edge_checkout_page_validator.js
hyph-bn.hyb
hyph-mr.hyb
hyph-nn.hyb
wixstdba.dll
logo.png
VC_redist.x64.exe
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
VC_redist.x86.exe
license.rtf
thm.wxl
thm.xml
memory/464-11945-0x0000000000400000-0x0000000000413000-memory.dmp
memory/464-11915-0x0000000000400000-0x0000000000413000-memory.dmp
memory/464-8900-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1100-16746-0x00007FFC5AE60000-0x00007FFC5AE7B000-memory.dmp
memory/1100-16745-0x00007FFC5ABD0000-0x00007FFC5AC5E000-memory.dmp
memory/1100-16744-0x00007FFC5AEB0000-0x00007FFC5AEBC000-memory.dmp
memory/1608-7350-0x0000000005A20000-0x0000000005A47000-memory.dmp
memory/1608-7359-0x0000000000400000-0x0000000000685000-memory.dmp
memory/1608-7363-0x0000000000DE0000-0x0000000000E1A000-memory.dmp
memory/1608-7344-0x0000000000DE0000-0x0000000000E1A000-memory.dmp
memory/1608-7345-0x0000000000400000-0x0000000000685000-memory.dmp
memory/1608-7346-0x0000000005A20000-0x0000000005A36000-memory.dmp
memory/1608-7347-0x0000000005A20000-0x0000000005A41000-memory.dmp
memory/1608-7348-0x0000000005A20000-0x0000000005A38000-memory.dmp
memory/1608-7349-0x0000000005A20000-0x0000000005A4D000-memory.dmp
memory/1608-7362-0x0000000010000000-0x0000000010130000-memory.dmp
memory/1608-7361-0x00000000400B0000-0x00000000401F9000-memory.dmp
memory/1608-7360-0x0000000040000000-0x00000000400AD000-memory.dmp
memory/1984-17126-0x0000000000980000-0x00000000009F7000-memory.dmp
memory/2396-11944-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2396-11916-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2564-16887-0x0000000000A60000-0x0000000000AD7000-memory.dmp
memory/2688-16873-0x0000000000A60000-0x0000000000AD7000-memory.dmp
memory/2724-16886-0x0000000000A60000-0x0000000000AD7000-memory.dmp
memory/2904-16870-0x0000000000A60000-0x0000000000AD7000-memory.dmp
memory/3128-17152-0x00007FF62EC00000-0x00007FF62FC00000-memory.dmp
memory/3128-17153-0x00007FFC24A60000-0x00007FFC25082000-memory.dmp
memory/3900-16872-0x0000000000A60000-0x0000000000AD7000-memory.dmp
memory/4572-1659-0x0000000059550000-0x0000000059565000-memory.dmp
memory/4572-847-0x0000000059550000-0x0000000059565000-memory.dmp
memory/4572-843-0x00007FFC25AE0000-0x00007FFC26035000-memory.dmp
memory/4824-17127-0x0000000000980000-0x00000000009F7000-memory.dmp
memory/4884-7343-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4884-4030-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4884-6502-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4996-6513-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4996-7342-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/5200-7368-0x00000000058D0000-0x00000000058E8000-memory.dmp
memory/5200-7365-0x0000000000400000-0x0000000000685000-memory.dmp
memory/5200-7372-0x0000000040000000-0x00000000400AD000-memory.dmp
memory/5200-7374-0x0000000010000000-0x0000000010130000-memory.dmp
memory/5200-7371-0x0000000000400000-0x0000000000685000-memory.dmp
memory/5200-7373-0x00000000400B0000-0x00000000401F9000-memory.dmp
memory/5200-7375-0x0000000000C70000-0x0000000000CAA000-memory.dmp
memory/5200-7370-0x00000000058D0000-0x00000000058F7000-memory.dmp
memory/5200-7367-0x00000000058D0000-0x00000000058F1000-memory.dmp
memory/5200-7369-0x00000000058D0000-0x00000000058FD000-memory.dmp
memory/5200-7366-0x00000000058D0000-0x00000000058E6000-memory.dmp
memory/5200-7364-0x0000000000C70000-0x0000000000CAA000-memory.dmp
memory/5960-17124-0x0000000000980000-0x00000000009F7000-memory.dmp
memory/6096-11961-0x0000000005A10000-0x0000000005A3D000-memory.dmp
memory/6096-11974-0x0000000010000000-0x0000000010130000-memory.dmp
memory/6096-11972-0x0000000040000000-0x00000000400AD000-memory.dmp
memory/6096-11975-0x0000000000DA0000-0x0000000000DDA000-memory.dmp
memory/6096-11962-0x0000000005A10000-0x0000000005A37000-memory.dmp
memory/6096-11971-0x0000000000400000-0x0000000000685000-memory.dmp
memory/6096-11973-0x00000000400B0000-0x00000000401F9000-memory.dmp
memory/6096-11960-0x0000000005A10000-0x0000000005A28000-memory.dmp
memory/6096-11959-0x0000000005A10000-0x0000000005A31000-memory.dmp
memory/6096-11958-0x0000000005A10000-0x0000000005A26000-memory.dmp
memory/6096-11949-0x0000000000400000-0x0000000000685000-memory.dmp
memory/6096-11948-0x0000000000DA0000-0x0000000000DDA000-memory.dmp