Analysis
- user interaction
yes - max time kernel
1020s - max time network
1020s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
16/08/2026, 04:22
General
- Target http://WEAREDEVS
- Sample260816-eza1bszbpb
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 42 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://WEAREDEVS1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffb8325c188,0x7ffb8325c194,0x7ffb8325c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,717349027229882683,12048793342288667670,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,17759801869744540872,15256901907512290658,262144 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,1038577660550563047,15503252194192836639,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,1851731003654066863,16062220098698633144,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,7808374577925601724,2338991842098050692,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,6099842348729800581,16456691173589094241,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,15439119650125478328,1017801273006937930,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5056,i,13311341260115333384,11546302525739528429,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,9596260178999583342,5153329135700564294,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,10759052266493333526,3929890272004239343,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,414976349280413930,326402622744060670,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,414976349280413930,326402622744060670,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6172,i,10869459092561486496,12788533279399016602,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6372,i,16159980059424928052,15287777509616227873,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5232,i,13498289715033858011,15144032749729756534,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6500,i,17492035586900229364,8784697339751589496,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6444,i,10068419932201325768,10750945250931489897,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6820,i,8022644991572080509,13082190175455584117,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5964,i,16574497318273031245,15412487551944360673,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5960,i,6281516764527517868,17369213972789235980,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3444,i,10924912247729725210,500355918166421638,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7100,i,4301742468373629230,2471391410477308513,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6864,i,5132692210266329209,16934451347880970642,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6764,i,13317711039761957062,1311128690991310142,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7428,i,10656131817149323233,3086739340750861232,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,1039640905685240439,9091761326146528147,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7596,i,13513363878785591450,8242741244115829766,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7860,i,2109396475989341482,9047735656849972991,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7624,i,6525759666617763238,12727257704899174283,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,5470333695111435609,6246022322325332701,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8380,i,17662717927957125237,11989958093456161827,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=8340 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8508,i,9774532602039537509,12952832823325479618,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=8500 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8200,i,8368348743573149498,11009126274681223233,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8028,i,14312743466954560783,17079237422615374488,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=8552 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8616,i,5973368305121220136,9519223503346506741,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8700,i,456990335533497090,10502117168179730685,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8800,i,2899985198335148222,17463352411164657737,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=8836 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=9076,i,2440508958510699553,11629411547643880005,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9048 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9284,i,2532698742005566945,9349080602382636629,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9420,i,9066598066930163381,844937723502114682,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9432 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9396,i,6909952108657337395,13133725046962725795,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9368 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9396,i,6909952108657337395,13133725046962725795,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9368 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8724,i,9655629884184559875,17601574724486021863,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,9592708909469519646,14800394434748174069,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8736,i,4308761023474036362,10222418863723970086,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=8724 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7692,i,13861796456852534638,14416824316419881107,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7404,i,1263154703097157300,11826103833012830049,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9232 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8060,i,12175131903465281594,11516979223256067458,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=8024 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9884,i,1646285995436484668,8196539358248760410,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9648,i,9921855041853379789,1927189323358613508,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9948 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10156,i,12431565352532925691,17619498055521318314,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=10152 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6624,i,13972879255414480048,8855920186832789604,262144 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8352,i,14727096797057376583,15105226004984623788,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=8776 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=3608,i,17226837663305675139,12527366044389729679,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=5156,i,8489347476494492706,15944275330456297712,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9600 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8680,i,9159978509972810566,11214731504376977852,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9700 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=4892,i,6676458792379179091,1345849794300980742,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9804 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,7616697471278137550,16144687748772452980,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7580,i,14247423057543754240,14002618926375659564,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,8607841295734421958,16143425507697137002,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=4012,i,16784165104171149217,3981665745619199517,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9728,i,6065978598849179946,17671326797258222467,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=8532 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=9864,i,10324443314889977946,3538826759843328641,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=8676 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=7500,i,7033011296893796780,1314455755888246065,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=10324 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=10436,i,5755496554754303057,6242314706443322603,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=10448 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=10432,i,1404942940660619085,10721668991741914334,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=10440 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=9252,i,5157338849153229733,17607936467550770047,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=10416 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=9424,i,14257219709237875287,4951811423327795872,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9876 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=5308,i,1334205923167945728,14342534162024657498,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9416 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=4020,i,2279464839554651392,14977566219276461652,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9188 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=4840,i,7799055957146378319,5500087034434774601,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=10544 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=9932,i,1485090365296866258,17264806045860876960,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9800 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10564,i,16916431199843070659,4311377078644493058,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=10616 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10516,i,6261079621229243846,6852482682809138988,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=8772 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9740,i,1918229492271006152,4468448261469180514,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=10504 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=560,i,16874851936512743896,13760705685399080135,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=10484,i,12821649400121271741,18307739432636883755,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=10472 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=10468,i,10998878049104508922,16505661878523538970,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=10480 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=10532,i,2183702372912214416,14269809874446848757,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9632 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=10600,i,16697577366515377706,7142812592005720908,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9464 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10548,i,785547000705079332,5643543791798133707,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=8692 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,16879900176409525253,5359213298010697709,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=10632 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=10444,i,10224145235764221202,18063783997572846758,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=10520 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=8988,i,13892182309643366633,11867293934867023221,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=11188 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=9760,i,9536046038635124424,9474941050348654116,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=10560 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=6688,i,2305916578845815587,9871613748680397901,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=11224 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=11392,i,12195758519065913206,14245732781580286050,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=11376 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=10404,i,9430424608476317375,2620724829004355157,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9824 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=10952,i,3852303510092291030,8404866462456740360,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=11604 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=10864,i,13146333568852006259,8204975744824910167,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=10948 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=5380,i,8546558117095949926,408332281010304291,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=11444,i,17973267454857434379,8435483127077518725,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=10360,i,6844299862171327876,3505259253028629608,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=10436 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=11240,i,5562546134328844703,7119792198035935645,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=11340 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=5332,i,7033719610653108728,8155440501232988097,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9436,i,18140591097573435510,851439567739774888,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=11412 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=9816,i,16611393121963018274,13549402282655174895,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=8516 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=6816,i,15887224364992156429,3194559429607490716,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=5436,i,4397363771332132539,14776769807903645590,2097152 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9656 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,10754552070956476435,2989446948762641871,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=11536 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10312,i,3805461889954160916,5979037267428807182,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9980 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9180,i,14860100504893025736,18104700844528685895,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=10572 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,9973649938563920187,1319908033861085944,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11456,i,8617075807060779154,6280811584688318756,524288 --field-trial-handle=2584,i,4680801020970318582,3019250814944168553,262144 --variations-seed-version --mojo-platform-channel-handle=9172 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
blocklist
settings.dat
settings.dat
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
f_000073
f_000074
f_000075
f_000076
f_000077
f_000078
f_00007a
f_00007b
f_000087
f_0000a0
f_0000ae
f_0000b4
f_0000b5
f_0000b6
f_0000ba
f_0000bb
f_0000bd
f_0000bf
f_0000c1
f_0000c2
f_0000c3
f_0000c5
f_0000c6
f_0000c8
f_0000c9
f_0000cf
f_0000d0
f_0000d5
f_0000d6
f_0000d7
f_0000dc
f_0000dd
f_0000e0
f_0000e1
f_0000fc
f_0000fd
f_000100
f_000101
f_000113
f_000114
f_000116
f_000128
f_00012a
f_00012c
f_00012d
f_00012e
f_00013f
f_000168
f_00016f
f_00017b
f_00017d
f_00017e
f_00017f
f_0001df
f_0001e3
f_0001e4
f_0001f2
f_00021a
f_00021b
f_000224
f_000226
f_000227
f_000228
f_000229
f_00022a
f_00022b
f_00022d
f_00022f
f_000238
f_000239
f_00023c
f_000240
f_000242
f_000243
f_000244
f_000245
f_000246
f_000247
00691dfa6b24d64b_0
0b4b8762beb4eb8b_0
0b77b5dceb386684_0
0f54957f594985c3_0
11104fe27cea1141_0
14bc58d2874bdee2_0
1781f4c6780c06a0_0
1f1c4bba1674fa36_0
205a05a8fe2dfb45_0
20ff6f048024802c_0
28db7c5eb04a5dd2_0
2ed183d46af5954b_0
2f4680e8f8f8a14f_0
30d402df118bbd51_0
33ca4c796610002b_0
36650fc6f1a9698f_0
3874ebefa0c7aeb3_0
39147f6733682c4c_0
39a5e623cac641bd_0
3e98e0aac7734b25_0
41a57d54e9060509_0
4c46ab316d84eab1_0
599482f29f136204_0
5a53f6a2eca06b5c_0
5dd016d767bf505a_0
5fea537559441a26_0
6048c53dd280a81c_0
690ccc8eea086670_0
697e632891c1812d_0
69f91929ca3415c8_0
6d1b6c821e5413e7_0
6d5ec87abf3643b1_0
70a2df18c93be1d6_0
73080e9e1fcbcc7d_0
76e61c1c89c5ebe1_0
7853c5422f7aa119_0
78b99223269c8493_0
7974f33de2935706_0
7a6268d420b60dbf_0
7ea8becbec31df48_0
821465221ccd72d8_0
89e32bc39c403ec4_0
8adfc74cf5ece283_0
8baa13f7b32fb253_0
8d66f2a73fddcb67_0
92aa708729096273_0
9820ef3cdc166065_0
9881b95790103d21_0
9cc31446b2cdd202_0
9cc31446b2cdd202_0
a103ddf7825209ae_0
a271a2ae31cc0c71_0
a288d6af801cc437_0
a2c2b7678606fb5f_0
a37d9f5e5494fc07_0
a4d78697d978ffb1_0
a5dbf24ad19a2bf1_0
abb0b29c5e6831bc_0
abc803e3be039b69_0
b563eee2bbdbd30c_0
b5901ac71d8cfbee_0
b5eb9d116b33df7b_0
b827c624dbf27111_0
bc93828712e47f15_0
c16c5a17ad753d1e_0
c2fcc3fbc0745dec_0
c53b773eca1104c8_0
c6aa8e61aaa87dc0_0
c7283e25f121a3ca_0
c796a9a28320e412_0
cb695a9415c713b6_0
d79e0a2891fc014a_0
dc7b47f23bfbb5eb_0
e0513585c34859ad_0
e2ec9d1138bca871_0
e8800f3901e39ee9_0
e93bf8a6b9ea2225_0
e9c7e700cc3e33cf_0
f5d3d485b75962bb_0
fac04c66d8725008_0
fc15564f196d27a8_0
fed8b13fc8831351_0
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
000003.log
CURRENT
LOG
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries~RFe58b07f.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
4f2277ea2139c475_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
040f11e49243b61d_0
075c067aa7c31034_0
075c067aa7c31034_1
0c91d61d7ba597f8_0
0c91d61d7ba597f8_1
10ba3ae05eddcaf6_0
10ba3ae05eddcaf6_1
18031f09388d52ce_0
18031f09388d52ce_1
1a51f1be0a8fdf52_0
1a51f1be0a8fdf52_1
2a129ff85c6b1559_0
2a129ff85c6b1559_1
2c53cde658823a94_0
2c53cde658823a94_1
36e1e722092ca449_0
36e1e722092ca449_1
3742e809c03a504e_0
3742e809c03a504e_1
43f6f22263ae4558_0
43f6f22263ae4558_1
57010a3c857e1171_0
57010a3c857e1171_1
5a5d3e4b80e58225_0
5a5d3e4b80e58225_1
5e2fd1b97859a54c_0
5e2fd1b97859a54c_1
608f9d7ab5e6d6cb_0
608f9d7ab5e6d6cb_1
656683df38aee23e_0
656683df38aee23e_1
6afc2f541f484f9f_0
6afc2f541f484f9f_1
72c1574df5d41a8e_0
72c1574df5d41a8e_1
78bd57ab70227e9f_0
78bd57ab70227e9f_1
7a08a6a2b71ec915_0
7a08a6a2b71ec915_1
7aaa7b8e07870797_0
7aaa7b8e07870797_1
7b804abdfaf170cf_0
7b804abdfaf170cf_1
82f0d6250c1c7d8f_0
82f0d6250c1c7d8f_1
834d4a49393b64cb_0
834d4a49393b64cb_1
85f73dd0b35f337f_0
85f73dd0b35f337f_1
888c3f0851605c09_0
888c3f0851605c09_1
aa57973c1e26ae3d_0
aa57973c1e26ae3d_1
aaa872dfad0a00d5_0
aaa872dfad0a00d5_1
b15bd87405c3b242_0
b15bd87405c3b242_1
bd3f9ee3f2e520bc_0
bd3f9ee3f2e520bc_1
c65e36407de7ae26_0
c65e36407de7ae26_1
c71b92ffb846678f_0
c71b92ffb846678f_1
db66a72be9e9dd1f_0
db66a72be9e9dd1f_1
dedfedb2268549e2_0
dedfedb2268549e2_1
e33a7d9780334728_0
e33a7d9780334728_1
e3c5699b5189de47_0
e3c5699b5189de47_1
e4071f6047faef52_0
e4071f6047faef52_1
e6c0a08c45e55298_0
e6c0a08c45e55298_1
e7dedc7674095d3f_0
e7dedc7674095d3f_1
e86f2befc494797d_0
e86f2befc494797d_1
the-real-index
the-real-index
the-real-index~RFe58b551.TMP
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe599224.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
67a473248953641b_0
67a473248953641b_1
ba23d8ecda68de77_0
ba23d8ecda68de77_1
the-real-index
the-real-index
the-real-index~RFe5937c0.TMP
Session_13431328219938448
the-real-index
sync_diagnostic.log
MANIFEST-000001
OperationConfig
OperationConfig~RFe593d1f.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe58a488.TMP
25f574b7-0035-4352-a466-065209201afb.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
Xeno-v1.3.0a.zip.crdownload
Xeno-v1.3.60.zip.crdownload