Analysis
- user interaction
yes - max time kernel
1799s - max time network
1801s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
18/08/2026, 14:11
General
- Target http://modhub.net
- Sample260818-rhey6stdmc
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 32 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 47 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 38 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://modhub.net1⤵
- Enumerates connected drives
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffa448ec188,0x7ffa448ec194,0x7ffa448ec1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,8763240600827579251,16342983322181598138,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,3675878789607431172,6425494404784853038,262144 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,16996544215134920013,10730170171387581318,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,3610496313280437297,14878810537108346973,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,6561755979638986513,10828485537558023512,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,10798064250118318409,15254261088054471091,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,11743926287690992084,14329579080449311193,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5072,i,15980453397959845342,16313213712095498548,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,15716398191677647545,4583803569358394111,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,5919636861488758306,17544558232242299049,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5488,i,4481311236774774206,4909401915383784285,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,2944946533904799207,2227063126144160264,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,2944946533904799207,2227063126144160264,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,12269110173748106207,7109152251095312807,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3892,i,12534220256154688777,14591111533680475090,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6820,i,9164730720593921103,8760990476605308755,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7084,i,7400951876212605804,6858541613161420847,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4824,i,6499227009006344790,7253192451491269496,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4348,i,10327129980305017531,17079616408202808183,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5684,i,17286696545593558290,2502219329563419331,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6340,i,2024793627541230382,16467298310763416814,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7472,i,14948615228354143940,11665198177156746164,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7596,i,6869933072295353035,2262606627438985572,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7604,i,12145040712584491988,5018275642661432319,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7612,i,6345535440341067198,955049392944640385,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7788,i,15580227675063837376,11004263451203303168,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,18305911451310758614,18378166636604652624,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7888,i,8048093400024976980,12947294675386155426,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8064,i,1735450120718567685,4842730349466120131,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,12541364555839859987,11184554592977978653,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8244,i,6698272093214887112,406629785152915098,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8492,i,5107584098638598679,7379327195875691149,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,22362862347091687,13686756374998481380,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=764 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6100,i,9402096255757929793,6187298904118152014,262144 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8352,i,16571359316817988367,8741373123607006199,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=8320 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8356,i,16747047649137925031,6455499825034262203,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=8420 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,3588816959393969971,16950873999511433283,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,15207428035936173982,928823578366688647,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,266023854654728981,4148323870512259965,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8092,i,3736218023292919395,1217750695056104850,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=8400 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,12237671201269473184,3541591707658003104,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=8300 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8196,i,17229495355056919999,16886486888510090694,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8196,i,16165403018903600826,18140890202268157775,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,13908540144739300353,655752647408375831,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,1055492084603039959,5228108443956842583,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8240,i,12587615819492328338,9693618198466517366,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=5540,i,987644343465474176,12601378920561552998,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=6936,i,16521363374387659479,7864408173886846445,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=7120,i,8801886750973891329,1573756408908945123,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8040,i,8044261514175241255,17350787042504413272,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,15967816353339903608,2090793463905648237,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8776,i,839064642831981366,12755183177154851756,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=9204,i,12829566536069290754,7146929230497728905,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=9192 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=2488,i,16803630043333566451,12107788790924931200,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=9244 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9276,i,2989370015732649044,6951854139780572502,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=9336 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8380,i,12857574425032354994,6859758134579887900,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=9500 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=6652,i,15734579856256927298,9303024462858369298,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=9720,i,7591229696885961906,9317206399679382129,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=9728 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8152,i,4888900814373301363,14590580651029889094,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=8108 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8948,i,4888933391147460263,16055430746991596895,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=1492 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=8828,i,16422884695750368096,7347308155619322638,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=8944,i,13235834933621816667,6409243564555001752,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=9212 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9448,i,13136417276056615721,5972928479998562873,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=9436 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=8912,i,13887695540356173870,18050192315875375454,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=8796 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=9116,i,14004236732972530580,9140393105319218968,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=9560 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=7812,i,11676011606148125456,14019036778341118083,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=9076 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=9240,i,12187377393514726416,13283945516494361069,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=9660 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=8988,i,4231353484803419781,4538055077569374785,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=9652 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=604,i,14403413762426155783,7204048535193633303,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=9324 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=7364,i,14913031979736762481,1446639739731186620,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=9152 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=9200,i,16230392368227823471,11202452263699064965,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=9228 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=9248,i,18165995949263062021,10948485610987759336,2097152 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=9180 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,1330805388671832724,12801053093544861968,524288 --field-trial-handle=2560,i,1952763646844058928,14855474204737719412,262144 --variations-seed-version --mojo-platform-channel-handle=9920 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\7z2301-x64.exe"C:\Users\Admin\Downloads\7z2301-x64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\7z2301-x64.exe"C:\Users\Admin\Downloads\7z2301-x64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\7z2301-x64.exe"C:\Users\Admin\Downloads\7z2301-x64.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\innoextract-1.9-windows\innoextract.exe"C:\Users\Admin\Downloads\innoextract-1.9-windows\innoextract.exe" C:\Users\Admin\Downloads\innoextract-1.9-windows\FarmingSimulator2019Patch1.7.1.exe1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap1290:108:7zEvent20642 -t7z -sae -- "C:\Users\Admin\Downloads\innoextract-1.9-windows\app.7z"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap23507:108:7zEvent24059 -ad -saa -- "C:\Users\Admin\Downloads\innoextract-1.9-windows\app"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
807d6c6f-a62c-4a92-b751-65dd629988e0.tmp
blocklist
settings.dat
settings.dat
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
f_000073
f_000074
f_000076
f_000077
f_00007a
f_00007d
f_00007f
f_000080
f_000082
f_000083
f_000084
f_000087
f_000088
f_000089
f_00008a
f_00008b
f_00008d
f_00008f
f_000094
f_000095
f_00009a
f_00009c
f_0000b0
f_0000b1
f_0000b2
f_0000b3
f_0000b4
f_0000b5
f_0000ba
f_0000bb
f_0000bf
f_0000c1
f_0000ec
f_0000f8
f_00012b
f_000133
f_00018e
f_000190
f_0001e0
f_0001e2
f_0001f1
00691dfa6b24d64b_0
0b4b8762beb4eb8b_0
0d0ffc4606b262b5_0
10090a0ecad3d0d8_0
14bc58d2874bdee2_0
33ca4c796610002b_0
36650fc6f1a9698f_0
4c46ab316d84eab1_0
599482f29f136204_0
690ccc8eea086670_0
69f91929ca3415c8_0
6d1b6c821e5413e7_0
6d5ec87abf3643b1_0
7a6268d420b60dbf_0
7ae8a95a635ba1f7_0
7ea8becbec31df48_0
9820ef3cdc166065_0
9865b8a7e1c25c70_0
a2c2b7678606fb5f_0
a37d9f5e5494fc07_0
a86c6824cc01f451_0
b5eb9d116b33df7b_0
e13bc984f321db52_0
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe590df0.TMP
SiteList-Enterprise.json
Edge Profile.ico
000003.log
CURRENT
LOG
LOG
LOG
LOG.old
MANIFEST-000001
000003.log
LOG
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity~RFe6cc30b.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58a16b.TMP
075c067aa7c31034_0
075c067aa7c31034_1
10ba3ae05eddcaf6_0
10ba3ae05eddcaf6_1
1369005787598e10_0
1369005787598e10_1
18031f09388d52ce_0
18031f09388d52ce_1
1a51f1be0a8fdf52_0
1a51f1be0a8fdf52_1
2a129ff85c6b1559_0
2a129ff85c6b1559_1
36e1e722092ca449_0
36e1e722092ca449_1
3742e809c03a504e_0
3742e809c03a504e_1
43f6f22263ae4558_0
43f6f22263ae4558_1
57010a3c857e1171_0
57010a3c857e1171_1
5a5d3e4b80e58225_0
5a5d3e4b80e58225_1
5e2fd1b97859a54c_0
5e2fd1b97859a54c_1
608f9d7ab5e6d6cb_0
608f9d7ab5e6d6cb_1
656683df38aee23e_0
656683df38aee23e_1
6afc2f541f484f9f_0
6afc2f541f484f9f_1
72c1574df5d41a8e_0
72c1574df5d41a8e_1
7a08a6a2b71ec915_0
7a08a6a2b71ec915_1
7aaa7b8e07870797_0
7aaa7b8e07870797_1
7b804abdfaf170cf_0
7b804abdfaf170cf_1
82f0d6250c1c7d8f_0
82f0d6250c1c7d8f_1
834d4a49393b64cb_0
834d4a49393b64cb_1
85f73dd0b35f337f_0
85f73dd0b35f337f_1
888c3f0851605c09_0
888c3f0851605c09_1
aa57973c1e26ae3d_0
aa57973c1e26ae3d_1
aaa872dfad0a00d5_0
aaa872dfad0a00d5_1
ab317b2503a74d4f_0
ab317b2503a74d4f_1
b15bd87405c3b242_0
b15bd87405c3b242_1
bd3f9ee3f2e520bc_0
bd3f9ee3f2e520bc_1
c65e36407de7ae26_0
c65e36407de7ae26_1
c71b92ffb846678f_0
c71b92ffb846678f_1
db66a72be9e9dd1f_0
db66a72be9e9dd1f_1
dedfedb2268549e2_0
dedfedb2268549e2_1
e33a7d9780334728_0
e33a7d9780334728_1
e3c5699b5189de47_0
e3c5699b5189de47_1
e4071f6047faef52_0
e4071f6047faef52_1
e6c0a08c45e55298_0
e6c0a08c45e55298_1
e7dedc7674095d3f_0
e7dedc7674095d3f_1
e86f2befc494797d_0
e86f2befc494797d_1
the-real-index
the-real-index~RFe58aab2.TMP
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58ab10.TMP
f40c9eef63ff087e_0
the-real-index
the-real-index
the-real-index
the-real-index~RFe5b026d.TMP
4f2277ea2139c475_0
the-real-index
the-real-index
the-real-index
the-real-index
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
ba23d8ecda68de77_0
ba23d8ecda68de77_1
the-real-index
the-real-index~RFe58a66c.TMP
44f81f41e81f9a0e_0
the-real-index
sync_diagnostic.log
000003.log
OperationConfig
OperationConfig~RFe58f3a2.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe586637.TMP
7c8597c9-2281-4008-a5ea-e28420d0cb3f.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
store_bigBagContainerLime.dds
plus360Disc8_diffuse.dds
t308Decals_diffuse.dds
titan11Decals_diffuse.dds
beltSystem_normal.dds
memory/3044-8111-0x0000000000400000-0x000000000052F000-memory.dmp
memory/3044-7726-0x0000000000400000-0x000000000052F000-memory.dmp
memory/3044-6999-0x0000000000400000-0x000000000052F000-memory.dmp
memory/3044-6120-0x0000000000400000-0x000000000052F000-memory.dmp
memory/3044-5559-0x0000000000400000-0x000000000052F000-memory.dmp
memory/3044-4896-0x0000000000400000-0x000000000052F000-memory.dmp
memory/3044-3325-0x0000000000400000-0x000000000052F000-memory.dmp