Analysis
- user interaction
yes - max time kernel
1139s - max time network
1141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
03/07/2026, 17:27
General
- Target https://online-fix.me/games/officialservers/18138-meccha-chameleon-po-seti.html
- Sample260703-v1ww7ads21
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: LoadsDriver 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 34 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://online-fix.me/games/officialservers/18138-meccha-chameleon-po-seti.html1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff9652dc188,0x7ff9652dc194,0x7ff9652dc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,10074280470355857139,2541067350050860546,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,3417439625413139274,16464487956092432996,262144 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,8661631215671411354,17463282106422898745,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,9552860819512743715,14107011802737656072,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,1591915370564892983,6634696427773464731,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,15344056485991589732,2869034718531019983,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,5413156642881413153,334378266203006174,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,279876687602109044,3866826823358877484,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,10667798747786881929,6376014370612287825,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,16445491035720309052,15477347997459629469,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,16445491035720309052,15477347997459629469,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4456,i,1905505166633498466,17568893137801075866,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6280,i,10374398183300778852,7625110360856000415,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6372,i,5893584628822421134,10892165901414418739,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6428,i,5000459523105847586,14297163300860370189,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6656,i,9827961700921405790,13453595886198703480,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,9723235433889841063,14456391621206811657,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,10664015734195448484,4312031810368093201,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,17079194684499764314,1353219480169118896,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,278035252540093594,4966896952459335289,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7124,i,5143832069671338171,8752398531714587689,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6652,i,17678387431401090981,867793230050064070,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,13713783449830463168,16522038128200303172,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5912,i,235177679292408831,9780437642506675979,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,15706710223188683652,584893232289065833,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5484,i,881669921808902169,5481603293178561626,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7020,i,10659932026637801266,6893480161819779821,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6168,i,8611478290254504189,5602766917185311729,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=560,i,4333943816207925072,3719222141449190672,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3952,i,2659732711835349959,6242436406430882729,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=3028,i,13656674151569883417,15679672634261924405,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7444,i,9067607367347241695,11073319545900833090,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5252,i,8741807258519823807,15386580069827131116,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1248,i,10165986921842417170,5314559820232782783,262144 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7192,i,16957762711843939301,9614711068190828040,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6984,i,12311960614582319103,2536475586365006559,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7400,i,11243582532576915804,3476400555053752723,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=7704 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6948,i,11815567493782934064,11191008490047297632,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7740,i,2561855782682165074,5559002674677644590,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7644,i,9377636481415229452,13108645434123535028,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=7980 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8008,i,16818016110892456937,3650051706447726483,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=7988 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,10932905354850644954,18259298357153305584,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,17209062296849463566,2716800967689950944,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8316,i,5024864350463509432,14557185217135098347,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8320 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8464,i,16962841026582141519,15572005591479799343,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8492 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8468,i,594885486789148259,14054734097138063717,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8044 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8720,i,1877107992291482289,7449838604196732341,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8724 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8912,i,13714106076797191724,13744251257726919326,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8508,i,4956416600700724845,13026602613703914243,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9024 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9028,i,11750910738521007886,7761531358861942246,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8536 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7752,i,14195852121715029694,8166718825392131062,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8920 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9172,i,8060423555126283696,3335242126935419906,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=5300,i,17782170581151976479,11769350135027495797,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8652 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=7684,i,6386662361234845645,17386475940984003045,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=7992 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=6552,i,13181238291222711227,10532848299063844221,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8372 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8884,i,2879095657212435861,670579231481877978,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8432 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=9304,i,9149848579552861709,9772424356403765268,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9312 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=9296,i,6480283882879807334,8180396157330910678,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9324 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=9352,i,442739479234588294,7350633831615897028,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8968,i,14758972708989197626,15311057572110612025,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9004 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=7824,i,13090652059896427950,779376486488967572,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8144 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3124,i,13318699157127526086,12270193210262274486,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8636 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=7552,i,10180009437242741768,7114433074880795842,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9308 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=5300,i,12721019679243281484,7126133960666829843,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8432 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=9220,i,13619765051244418398,1161618582413870795,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9252 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=8616,i,3348543338203609162,8616950802279226435,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9192 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=8712,i,1795546476547431075,5298866599799004855,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8652 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=5228,i,1300755113519786448,7655352984394441215,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8648 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=7896,i,5428088462997962813,15048734634829411416,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=9448,i,8708716710003950001,17520092488638766476,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=9556,i,12704609267700270522,6914581235622943964,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9624 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=9552,i,2090864898263497917,11213176952796742524,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8884 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=6984,i,13826401692755149419,5326297115717081359,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9600 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=8280,i,6657133420952700939,7262982001913489258,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8372 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9508,i,15353744774238791701,3293206454436357426,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9376 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=9640,i,5153642521153001809,10602548542995534829,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8996 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=6232,i,4294484348546972104,14065387010077091850,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7976,i,4489316465263093243,11506501011750034410,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8888 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7536,i,6960681391582629850,2505028137212337914,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=8452,i,10026249560205672247,17262707627177326000,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7860,i,7153396642383229293,17588384228867085248,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=9128,i,5746449448870978627,2085408873880392493,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=7740,i,7272736413329221893,15545475934853679290,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=7972,i,3919380012219235731,14234039496069837779,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9056 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=9100,i,16536405117009174003,7047587566312651750,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9452 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=9324,i,13268145318827388097,9328379367645890758,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9232 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=8876,i,16813610341796014366,5564211341602323032,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=8556 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=7880,i,14436331734387602526,2720453194782313313,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9392 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7448,i,14115106397799607076,11284425438267576054,524288 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9488 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=5936,i,18320775452057770428,7711937020100840185,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9144 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=8596,i,14019469810084864140,16850553844852012438,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9768 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=7920,i,709803910402832525,2215164005185427003,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=9764,i,17568031247912434246,7416023010062367528,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9732 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=5912,i,14552492469210689619,10638452360050973449,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=8284,i,14322010691404190077,1967549745390617191,2097152 --field-trial-handle=2196,i,5555550041256467560,5542170483229906063,262144 --variations-seed-version --mojo-platform-channel-handle=9212 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
71e839f6-7b3c-41cb-b5ea-7bb658ce1fad.tmp
settings.dat
settings.dat
0768f835-a22c-4891-a2c6-3afea5be0d99.tmp
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
f_0000b6
f_0000b7
f_0000b8
f_0000b9
f_0000ba
f_0000bb
f_0000bc
f_0000bd
f_0000be
f_0000bf
f_0000c0
f_0000c1
f_0000c2
f_0000c3
f_0000c4
f_0000c5
f_0000c6
f_0000c7
f_0000c8
f_0000ca
f_0000cc
f_0000ce
f_0000cf
f_0000d0
f_0000d1
f_0000d2
f_0000d4
f_0000d5
f_0000d7
f_0000d8
f_0000db
f_0000dc
f_0000dd
f_0000de
f_0000e0
f_0000e1
f_0000e6
f_0000e9
f_0000f0
f_0000f1
f_0000f4
f_0000f8
f_000108
f_000111
f_000112
f_000117
f_000118
f_000119
f_00011a
f_00011b
f_00011c
f_00011e
f_00011f
f_000120
f_000123
f_000126
f_000127
f_000128
f_00012b
f_00012e
f_000130
f_000135
f_00013a
f_000157
f_000161
f_000164
f_000193
f_000198
f_000199
f_00019a
f_00019b
f_00019c
f_00019d
f_00019f
f_0001a0
f_0001c1
f_0001d0
f_0001fb
f_000217
00691dfa6b24d64b_0
0773aea9a90b3a85_0
0b4b8762beb4eb8b_0
104a0dd4ae7d135b_0
1bc866f48325ad5b_0
1ca5a7af2bfb6667_0
1fd69ed93faf0be5_0
24f2f57cb0b6a6ed_0
2a1f464030cf60bd_0
30d402df118bbd51_0
30f9fe35a22956f9_0
31800bb83445c101_0
33ca4c796610002b_0
36650fc6f1a9698f_0
38c8f366c6f8d656_0
398e26995388ac94_0
46d60106e65a518f_0
480e193afa3cba3b_0
490bf09aa93bb673_0
533d10e86c1923c8_0
60da1c43a5e49edf_0
647ebdcdaf69c0fd_0
69f91929ca3415c8_0
6eb6c21622981eb3_0
6f09f6123b48220a_0
73f2f40910fcc7aa_0
77e9fa61f0f30b87_0
839ead2c0d609100_0
84dd5b43c77dc95c_0
85873bd66e5adedc_0
89e32bc39c403ec4_0
9081f2f14d363878_0
9337c7355d46dfe5_0
9b5ada3cd1735a3f_0
a1c139c7c71fa946_0
aefcc16b95037483_0
b1df7155bccef8f6_0
b43c8f12fa105b45_0
b5249cbac38a0fbc_0
b72e05b65933b9fc_0
bc2c7b1332e1538e_0
bf9a77945d755a20_0
c4b194855eb21099_0
ce8c43cd8d0f93c8_0
d2a1b51172b173e9_0
dab391ce189ba9a9_0
ec44e9a4f0a2b217_0
ee0efdb1bc168ad0_0
ef6a98bdd79fdeff_0
f47798777502ae62_0
f5d3d485b75962bb_0
f89e15500c9c3f49_0
fc8464d461fb2363_0
ff8652d0acb1a3c4_0
temp-index
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe588ebe.TMP
SiteList-Enterprise.json
Edge Profile.ico
domains_config.json
HubApps
000001.dbtmp
000003.log
LOG
LOG
LOG
LOG
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries~RFe5fe8a4.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5bb7b4.TMP
the-real-index~RFe60860c.TMP
040f11e49243b61d_0
10b2310b59aa93a4_0
10b2310b59aa93a4_1
1369005787598e10_0
1369005787598e10_1
18031f09388d52ce_0
18031f09388d52ce_1
278122a2eb096440_0
278122a2eb096440_1
306ff0086d2004f0_0
306ff0086d2004f0_1
36c0810d429ff2cd_0
36c0810d429ff2cd_1
3742e809c03a504e_0
3742e809c03a504e_1
4a44e11e728b5b79_0
4a44e11e728b5b79_1
53f0a9e501fcc806_0
53f0a9e501fcc806_1
5524d7e552fd889a_0
5524d7e552fd889a_1
5b47a1a9c0379d73_0
5b47a1a9c0379d73_1
62344765313d86e6_0
62344765313d86e6_1
7bf17127e97e4f71_0
7bf17127e97e4f71_1
80b04a8c01173ef4_0
80b04a8c01173ef4_1
81165f2c3ae61c22_0
81165f2c3ae61c22_1
85f73dd0b35f337f_0
85f73dd0b35f337f_1
8729351e4c427534_0
8729351e4c427534_1
90276fa133edf2ce_0
90276fa133edf2ce_1
ab16bb8739b19e11_0
ab16bb8739b19e11_1
ab317b2503a74d4f_0
ab317b2503a74d4f_1
bbc951a86f6b4bcd_0
bbc951a86f6b4bcd_1
bd3f9ee3f2e520bc_0
bd3f9ee3f2e520bc_1
c65e36407de7ae26_0
c65e36407de7ae26_1
d517a059fb13b5c8_0
d517a059fb13b5c8_1
d7f49e75ac125fd1_0
d7f49e75ac125fd1_1
da32ab5266272d15_0
da32ab5266272d15_1
db66a72be9e9dd1f_0
db66a72be9e9dd1f_1
dbaea9cdd343884b_0
dbaea9cdd343884b_1
de437ca04e516225_0
de437ca04e516225_1
e3652d98938d2fd2_0
e3652d98938d2fd2_1
e3c5699b5189de47_0
e3c5699b5189de47_1
e4071f6047faef52_0
e4071f6047faef52_1
e520122abf21a8fa_0
e520122abf21a8fa_1
e6c0a08c45e55298_0
e6c0a08c45e55298_1
e7dedc7674095d3f_0
e7dedc7674095d3f_1
f37e06e6e1664560_0
f37e06e6e1664560_1
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe608188.TMP
todelete_4f2277ea2139c475_0_1
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5b12c9.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
4cb013792b196a35_0
4cb013792b196a35_1
the-real-index
the-real-index
the-real-index~RFe5b13d3.TMP
the-real-index
sync_diagnostic.log
the-real-index
the-real-index~RFe58f056.TMP
index.txt
index.txt
index.txt
index.txt~RFe589fc5.TMP
OperationConfig
OperationConfig~RFe592c65.TMP
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe59a3f7.TMP
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
default.dic
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
MecchaChameleon_Fix_Repair_Steam_Generic.rar.crdownload
OperaGXSetup.exe.crdownload