Analysis
- user interaction
yes - max time kernel
1800s - max time network
1789s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/07/2026, 04:27
General
- Target https://cdn.discordapp.com/attachments/1497413030583992410/1510089326908674199/Velora1.3.exe?ex=6a543c47&is=6a52eac7&hm=18e6dbd6f4476df0c02e68db3013f3aca9fcb9452de364b5fcb948e3d096f172&
- Sample260712-e29lnscy6l
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 13 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 45 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 56 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1497413030583992410/1510089326908674199/Velora1.3.exe?ex=6a543c47&is=6a52eac7&hm=18e6dbd6f4476df0c02e68db3013f3aca9fcb9452de364b5fcb948e3d096f172&1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffc7e3dc188,0x7ffc7e3dc194,0x7ffc7e3dc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,4440080061840428638,7830988689232594532,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,8489648712864809658,1035856697930430315,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,11299622300694376709,6063072563412916692,262144 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,4114203916491770455,1567187558548768358,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,11913069272982838449,15957593404884500848,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,11125198794072323389,755843610430438509,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,9391903986765277740,764950582526505715,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,11424171898434088676,4748449274526147689,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,14210876417243679014,12201150799729485280,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,14639853080704657927,9015932242779622068,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5836,i,6833370023982808090,9050819921418491958,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,8471325522619034473,4540884190363667687,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,3050458279651368318,10074760619149006204,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,3050458279651368318,10074760619149006204,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,2841603324678617731,995409784426604935,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,2841603324678617731,995409784426604935,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5012,i,15830367376416391291,17007354918853470413,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4308,i,5851662822161667621,8547879027029219525,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,9089303665888340016,10649577266292163026,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,13239365274089123875,5158613952657517122,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,2959852752441634750,9150356961930907652,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7332,i,14941808815965678698,15962064786711743304,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7644,i,11667201199654634995,14084139491990450619,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=7624 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5352,i,16372519874756678476,11959296058919703392,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7740,i,14308850954963403880,15794067755470797836,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7812,i,869136013657759326,16179529067458013799,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7828,i,6274173538279303848,9299256723653457540,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7988,i,5441616558092718600,2140130475612002578,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5420,i,3578532138516227918,16104997416341206311,262144 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5612,i,4600489680091918894,12628037975027309420,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8044,i,5523415025893069291,16011589520140959417,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,1658240172950269763,11279586210000610098,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,17084311247461026493,13428439244573155255,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8200,i,9451749965786646118,15191801067447468288,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=8208 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=1100,i,302568988117020039,10419253903780910812,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5632,i,11081148694527783947,11428263453737317999,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=8452 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6724,i,11366588774389128953,3678263067133639850,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=6864,i,9934316073376160719,1039719183649971495,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8660,i,7727380812839337760,2480245038794593149,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=8600 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8560,i,7546010397994025361,15939510669802441326,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=8556 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8708,i,7091784239044751732,13698147126594433477,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=8868 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8628,i,1426580562525427917,14220352446019248915,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=9044 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8596,i,16641758983295244208,16119745417869745372,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9292,i,1467125595832126562,122900539735375630,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=9264 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9068,i,15755887236976974938,12239096319653877205,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=9124 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9068,i,9946558882353295413,18353009446371709559,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=8424 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9340,i,6454406043464900494,3007089652430716767,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=9136 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9460,i,17758352384422473676,17215304062769018975,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=9456 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9708,i,11108524727456959275,12984741583138759972,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=9680 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9108,i,12162889512571393208,11728350975514312885,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=8684 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8500,i,14101430235587912421,8794227281895918600,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=9052 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9032,i,3891534526885626229,9347003504466480614,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=9316 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9188,i,3311993042128525971,1287440852906895949,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=9200 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8624,i,10042525337808929680,626679266566024057,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8744,i,6016184697022842277,8573122147273930284,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8556,i,14716717910274959885,59451635273488392,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=8728 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=5044,i,59743607536218110,2049981239033051708,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=9360 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,11696171435341691993,10858960916399270071,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=8800 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8584,i,3187179064168276574,10775270055691833340,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=5920,i,14669927768617427632,17322370314471187864,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8668,i,10762829216387102890,5845805558258733412,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=1096,i,16051048308864281556,546702458300611272,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=9536 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9096,i,876887405608027869,15817126387794009877,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=8444 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,1690721595258993555,2076611316681022623,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=8880,i,18282634639670688047,1721401801243498366,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=8124,i,13750785265597608143,13961562044063111782,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=7384,i,12421118606304498048,3844648454700676946,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=9552 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=6756,i,17817304592490909976,15796000966883622610,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=9744 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=8452,i,3761097472825438115,15555433912357672936,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=8324,i,15507206116284918548,6485528217001498870,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=10168 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=5708,i,6015462189815066917,7646498123453261987,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,4809170207130452373,7477881108408435313,524288 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=6164,i,7053348294344154896,5996055995919480443,2097152 --field-trial-handle=2236,i,12602838231901289348,7521916597799571863,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Users\Admin\Desktop\Velora1.3.exe"C:\Users\Admin\Desktop\Velora1.3.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵
-
-
C:\Users\Admin\Desktop\Velora1.3.exe"C:\Users\Admin\Desktop\Velora1.3.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\dnSpy-net-win64\dnSpy.Console.exe"C:\Users\Admin\Desktop\dnSpy-net-win64\dnSpy.Console.exe"1⤵
-
C:\Users\Admin\Desktop\dnSpy-net-win64\dnSpy.exe"C:\Users\Admin\Desktop\dnSpy-net-win64\dnSpy.exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Users\Admin\Desktop\die_win64_portable_3.21_x64\die\die.exe"C:\Users\Admin\Desktop\die_win64_portable_3.21_x64\die\die.exe"1⤵
-
C:\Users\Admin\Desktop\die_win64_portable_3.21_x64\die\die.exe"C:\Users\Admin\Desktop\die_win64_portable_3.21_x64\die\die.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\die_win64_portable_3.21_x64\die\diel.exe"C:\Users\Admin\Desktop\die_win64_portable_3.21_x64\die\diel.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
38611785-03c7-40e7-854a-8b380e98cdc0.tmp
settings.dat
settings.dat
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
f_000058
f_000059
f_00005a
f_00006c
f_000070
f_000071
f_000072
f_000074
f_000075
f_000076
f_00007f
f_000082
f_000087
f_000088
f_000089
f_00008a
f_00008b
f_00008c
f_00008f
f_000090
f_00009b
f_0000d1
f_0000d2
f_0000d3
f_0000d4
f_0000d5
f_0000d6
f_0000d7
f_0000d8
f_0000d9
f_0000da
f_0000db
f_0000dc
f_0000dd
f_0000de
f_0000df
f_0000e0
f_0000e1
f_0000e2
f_0000e3
f_0000e4
f_0000e5
f_0000e7
f_0000e8
f_0000e9
f_000108
f_000117
f_000118
f_000119
f_00011a
f_00011d
f_00011e
f_000127
f_000128
f_00012c
01805c70faf7f8c5_0
03eef0e77feb64d4_0
08fc8b10b1c7a049_0
0e56a543b666e482_0
0eb1763f04b21312_0
0fdcae0b58cc64d1_0
11164e41198b99b0_0
14ff8116b518ca2d_0
1536e2d82963ab24_0
158bdc58c09cfb7e_0
1785884dc706d376_0
18c35b252ffa1dd1_0
1f1c4bba1674fa36_0
1f974568b3b7eb41_0
2456471f2060c1c7_0
256c6f57ec621f9b_0
25c90b4fb1c6ef85_0
2692617678c042d9_0
2b24301b5b52a71e_0
2f4680e8f8f8a14f_0
39a5e623cac641bd_0
4036892574e9e41e_0
45a16ff6d0d9ab5f_0
46c3712737d75b68_0
4e9b18b0f66a7183_0
51438acbcfff1bda_0
53ac5abc87e80789_0
61a0b4d20ae0e222_0
635e64b37935c888_0
654995e051d0a582_0
67fa50d7bedc5c56_0
688a4b4b23c2152a_0
6a5e8bb53a565b9f_0
6aa9a2943612cce1_0
6adaaccfc08d2f50_0
6bf8f69045173fbf_0
6db290dce274a012_0
71e860461e48b950_0
74b88724f60b0383_0
75cfb80648ba5652_0
7676d068754b406d_0
7810cb0b62bc7a4c_0
78bc646c0524ce58_0
790ef2ed8d38fbe1_0
796dac09c39cdfa6_0
7c467212f021aefb_0
7cf9843337c39c04_0
7e044207414e80a6_0
8baa13f7b32fb253_0
8e5987d08f7b6e11_0
90d7d7591a1b39bb_0
91a500b270aa51ea_0
92ea216a4e512cc9_0
9360c0309db26247_0
96bc766215a93e35_0
9dbb949d27873cbc_0
a067705c689d7daf_0
a8491f153f9a8de0_0
af2cfcaf6d9b18bc_0
b412c4b8e4263523_0
c796a9a28320e412_0
cdca258cfe1dd100_0
d0fa80d4db2d38ea_0
d3ecfbde9d1735e5_0
d45aae6d8d9c9ff2_0
d79e0a2891fc014a_0
de8842b625efa9e1_0
e3631bbaf3cd3cc0_0
e427fee57fa1a6ab_0
e6e93144ebbfec47_0
e88e996bb16c52cb_0
e8c8218aef51a783_0
e8f7fbc7edd9d2eb_0
e9c7e700cc3e33cf_0
ed2bce91487b3a82_0
f2e4bbad99a372cc_0
f5345f974401453e_0
f68525ea58303d53_0
f8199953156d487a_0
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe595d78.TMP
SiteList-Enterprise.json
Edge Profile.ico
MANIFEST-000001
3815268b-43a4-40f5-aff9-5b0ba686f412.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
temp-index
the-real-index
the-real-index~RFe5b6435.TMP
623cd082b6202da0_0
the-real-index
the-real-index
index.txt
index.txt
index.txt.tmp
the-real-index
the-real-index~RFe59f8be.TMP
0cfdc306379f61ed_0
the-real-index
the-real-index
sync_diagnostic.log
CURRENT
MANIFEST-000001
OperationConfig
OperationConfig~RFe59f7f3.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5a6bfa.TMP
6181ca8c-d560-4012-bb9b-7dba24d125a9.tmp
f389e135-a9fc-44f1-a124-688e81da0dd1.tmp
f73ae020-7e70-4b9d-9e4d-60c0fd1fa22f.tmp
Detect-It-Easy-master.zip.crdownload
Velora1.3.exe.crdownload
die_win64_portable_3.21_x64.zip.crdownload
dnSpy-master.zip.crdownload
memory/4440-1325-0x00007FF715730000-0x00007FF7161AA000-memory.dmp
memory/5064-4519-0x00007FFC6B650000-0x00007FFC6BB91000-memory.dmp
memory/5064-4518-0x00007FF6A8820000-0x00007FF6A9670000-memory.dmp
memory/5308-4516-0x00007FFC6B650000-0x00007FFC6BB91000-memory.dmp
memory/5308-4517-0x00007FF6A8820000-0x00007FF6A9670000-memory.dmp
memory/5672-1267-0x00007FFC9F4E0000-0x00007FFC9F4E2000-memory.dmp
memory/5672-1271-0x00007FF715730000-0x00007FF7161AA000-memory.dmp
memory/5672-1264-0x00007FFCA09E0000-0x00007FFCA09E2000-memory.dmp
memory/5672-1263-0x00007FFCA09D0000-0x00007FFCA09D2000-memory.dmp
memory/5672-1266-0x00007FFCA0A00000-0x00007FFCA0A02000-memory.dmp
memory/5672-1265-0x00007FFCA09F0000-0x00007FFCA09F2000-memory.dmp
memory/5672-1268-0x00007FFC9F4F0000-0x00007FFC9F4F2000-memory.dmp
memory/5672-1269-0x00007FFC9E070000-0x00007FFC9E072000-memory.dmp
memory/5672-1270-0x00007FFC9E080000-0x00007FFC9E082000-memory.dmp
memory/6220-4532-0x00007FFC6B650000-0x00007FFC6BB91000-memory.dmp